Last Comment Bug 720675 - OOM Crash [@ JSString::isFlat] with NULL deref
: OOM Crash [@ JSString::isFlat] with NULL deref
Status: RESOLVED FIXED
js-triage-done
: crash, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
: -- critical (vote)
: mozilla13
Assigned To: Tom Schuster [:evilpie]
:
Mentors:
Depends on:
Blocks: langfuzz
  Show dependency treegraph
 
Reported: 2012-01-24 05:26 PST by Christian Holler (:decoder)
Modified: 2013-01-14 08:48 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
check for NULL before ->ensureFixed (1.37 KB, patch)
2012-01-24 07:26 PST, Tom Schuster [:evilpie]
bhackett1024: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2012-01-24 05:26:47 PST
The following test crashes on mozilla-central revision 42368fe44c8c (options -m -n):


gcparam("maxBytes", gcparam("gcBytes") + 4*1024);
arr = [1e0, 5e1, 9e19, 0.1e20, 1.3e20, 1e20, 9e20, 9.99e20, 
    0.1e21, 1e21, 1e21+65537, 1e21+65536, 1e21-65536, 1]; 
for (var i = 0; i < 4000; i++) {
    arr.push(1e19 + i*1e19);
}
for (var i in arr) {}


As far as I can tell, there is an OOM happening during the call to js_IntToString which causes the returned string to be NULL which is then again dereferenced without a further OOM (NULL) check. Let me know if that description is somewhat accurate :D
Comment 1 Tom Schuster [:evilpie] 2012-01-24 07:26:57 PST
Created attachment 591085 [details] [diff] [review]
check for NULL before ->ensureFixed

>As far as I can tell, there is an OOM happening during the call to >js_IntToString which causes >the returned string to be NULL which is then >again dereferenced without a further OOM (NULL) >check. Let me know if that >description is somewhat accurate :D
Spot on!

Some way or another we could probably also OOM, with ToStringSlow(cx, IdToValue(id)), but that probably involves some E4X, so I am out ;)
Comment 2 Mozilla RelEng Bot 2012-01-27 19:45:16 PST
Try run for 66e63166c199 is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=66e63166c199
Results (out of 244 total builds):
    success: 177
    warnings: 22
    failure: 45
Builds (or logs if builds failed) available at:
http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/evilpies@gmail.com-66e63166c199
 Timed out after 06 hours without completing.
Comment 3 Mozilla RelEng Bot 2012-02-04 11:30:26 PST
Try run for 153baab05b46 is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=153baab05b46
Results (out of 206 total builds):
    success: 183
    warnings: 23
Builds (or logs if builds failed) available at:
http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/evilpies@gmail.com-153baab05b46
Comment 5 Marco Bonardo [::mak] (Away 6-20 Aug) 2012-02-06 00:48:46 PST
https://hg.mozilla.org/mozilla-central/rev/196733360636
Comment 6 Christian Holler (:decoder) 2013-01-14 08:48:12 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug720675.js.

Note You need to log in before you can comment on or make changes to this bug.