720675 - OOM Crash [@ JSString::isFlat] with NULL deref

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test crashes on mozilla-central revision 42368fe44c8c (options -m -n):


gcparam("maxBytes", gcparam("gcBytes") + 4*1024);
arr = [1e0, 5e1, 9e19, 0.1e20, 1.3e20, 1e20, 9e20, 9.99e20, 
    0.1e21, 1e21, 1e21+65537, 1e21+65536, 1e21-65536, 1]; 
for (var i = 0; i < 4000; i++) {
    arr.push(1e19 + i*1e19);
}
for (var i in arr) {}


As far as I can tell, there is an OOM happening during the call to js_IntToString which causes the returned string to be NULL which is then again dereferenced without a further OOM (NULL) check. Let me know if that description is somewhat accurate :D

Comment 1

[Tom S]

Attachment: check for NULL before ->ensureFixed

>As far as I can tell, there is an OOM happening during the call to >js_IntToString which causes >the returned string to be NULL which is then >again dereferenced without a further OOM (NULL) >check. Let me know if that >description is somewhat accurate :D
Spot on!

Some way or another we could probably also OOM, with ToStringSlow(cx, IdToValue(id)), but that probably involves some E4X, so I am out ;)

Comment 2

[Mozilla RelEng Bot]

Try run for 66e63166c199 is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=66e63166c199
Results (out of 244 total builds):
    success: 177
    warnings: 22
    failure: 45
Builds (or logs if builds failed) available at:
http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/[e-mail]-66e63166c199
 Timed out after 06 hours without completing.

Comment 3

[Mozilla RelEng Bot]

Try run for 153baab05b46 is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=153baab05b46
Results (out of 206 total builds):
    success: 183
    warnings: 23
Builds (or logs if builds failed) available at:
http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/[e-mail]-153baab05b46

Comment 4

[Tom S]

https://hg.mozilla.org/integration/mozilla-inbound/rev/196733360636

Comment 5

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/196733360636

Comment 6

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug720675.js.