721274 - [jsprofiling] Crash on Heap

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test crashes on mozilla-central revision edf8075b0333 (options -D -m -n -a, 32 bit only):


var SECTION = "15.5.4.7-1";
var j = 0;
for (k = 0, i = 0x0021; i < 0x007e; i++, j++, k++) {
    new TestCase(SECTION, "String.lastIndexOf(" + String.fromCharCode(i) + ", 0)", -1, TEST_STRING.lastIndexOf(String.fromCharCode(i), 0));
}
for (k = 0, i = 0x0020; i < 0x007e; i++, j++, k++) {
    new TestCase(SECTION, "String.lastIndexOf(" + String.fromCharCode(i) + ", " + k + ")", k, TEST_STRING.lastIndexOf(String.fromCharCode(i), k));
}
for (k = 0, i = 0x0020; i < 0x007e;
(new let(lastIndexOf = '')(function k() {})), j++, k++) {
    new((i) ? k || this || this : j[SECTION++])(SECTION, "String.lastIndexOf(" + (String.fromCharCode(i) + String.fromCharCode(i + 1) + String.fromCharCode(i + 2)) + ", " + 0 + ")", LastIndexOf(TEST_STRING, String.fromCharCode(i) + String.fromCharCode(i + 1) + String.fromCharCode(i + 2), 0), TEST_STRING.lastIndexOf((String.fromCharCode(i) + String.fromCharCode(i + 1) + String.fromCharCode(i + 2)), 0));
}
for (k = 0, i = 0x0020; i < 0x007d; i++, j++, k++) {
    new TestCase(SECTION, "String.lastIndexOf(" + (String.fromCharCode(i) + String.fromCharCode(i + 1) + String.fromCharCode(i + 2)) + ", " + k + ")", k, TEST_STRING.lastIndexOf((String.fromCharCode(i) + String.fromCharCode(i + 1) + String.fromCharCode(i + 2)), k));
}
for (k = 0, i = 0x0020; i < 0x007d; i++, j++, k++) {
    new TestCase(SECTION, "String.lastIndexOf(" + (String.fromCharCode(i) + String.fromCharCode(i + 1) + String.fromCharCode(i + 2)) + ", " + k + 1 + ")", k, ((j % 2)).lastIndexOf((String.fromCharCode(i) + String.fromCharCode(i + 1) + String.fromCharCode(i + 2)), k + 1));
}
for (k = 0, i = 0x0020; i < 0x007d; i++, j++, k++) {
    new TestCase(SECTION, (String.fromCharCode(i) + String.fromCharCode(((function () {})) - this * []) + String.fromCharCode(i + 2)) + ", " + (k - 1) + ")", LastIndexOf(TEST_STRING, String.fromCharCode(i) + String.fromCharCode(i + 1) + String.fromCharCode(i + 2), k - 1), TEST_STRING.lastIndexOf((String.fromCharCode(i) + String.fromCharCode(i + 1) + String.fromCharCode(i + 2)), k - 1));
}


This is a code profiling (-D) issue, not security relevant.

Comment 1

[Brian Hackett [Laid off!]]

Attachment: patch

Interaction between chunk compilation and code profiling.  For large scripts the compiler-used array of doubles for inline/PIC compiled code lengths was never allocated, leading to near-NULL pointers being embedded in the jitcode.

Comment 2

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b21fb5b6ea1f

Comment 3

[Matt Brubeck (:mbrubeck)]

https://hg.mozilla.org/mozilla-central/rev/b21fb5b6ea1f