JS OOM Testing: Assertion failure: function() && types && types->hasScope(), at ../jsscriptinlines.h:224 or Crash [@ JSScript::nesting]

RESOLVED FIXED in mozilla14

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: bhackett)

Tracking

({assertion, crash, testcase})

Trunk
mozilla14
x86_64
Linux
assertion, crash, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: js-triage-needed)

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following command crashes/aborts on mozilla-central revision d45c7d7b0079:

js -m -n -a -A 1325 -f js/src/tests/shell.js -f js/src/tests/ecma_5/shell.js -f js/src/tests/ecma_5/strict/shell.js -f js/src/tests/ecma_5/strict/10.4.2.js

Stepping through assertion crashes:

Program received signal SIGSEGV, Segmentation fault.
0x00000000004ac050 in JSScript::nesting (this=0x7ffff651cb78) at ../jsscriptinlines.h:225
225         return types->nesting;
(gdb) bt
#0  0x00000000004ac050 in JSScript::nesting (this=0x7ffff651cb78) at ../jsscriptinlines.h:225
#1  0x000000000050b160 in js::StackFrame::functionPrologue (this=0x7ffff676e0d8, cx=0xb5fae0) at /home/decoder/LangFuzz/mozilla-central/js/src/vm/Stack-inl.h:380
#2  0x00000000004f1791 in js::InvokeKernel (cx=0xb5fae0, args=..., construct=js::NO_CONSTRUCT) at /home/decoder/LangFuzz/mozilla-central/js/src/jsinterp.cpp:510
#3  0x000000000045e49d in js::Invoke (cx=0xb5fae0, args=..., construct=js::NO_CONSTRUCT) at /home/decoder/LangFuzz/mozilla-central/js/src/jsinterp.h:157
#4  0x00000000004a6dd2 in js_fun_call (cx=0xb5fae0, argc=1, vp=0x7ffff676e0a0) at /home/decoder/LangFuzz/mozilla-central/js/src/jsfun.cpp:1641
#5  0x0000000000509afb in js::CallJSNative (cx=0xb5fae0, native=0x4a6c3a <js_fun_call(JSContext*, uintN, JS::Value*)>, args=...) at ../jscntxtinlines.h:311
#6  0x00000000004f16f4 in js::InvokeKernel (cx=0xb5fae0, args=..., construct=js::NO_CONSTRUCT) at /home/decoder/LangFuzz/mozilla-central/js/src/jsinterp.cpp:499
#7  0x00000000004fd514 in js::Interpret (cx=0xb5fae0, entryFrame=0x7ffff676e030, interpMode=js::JSINTERP_NORMAL) at /home/decoder/LangFuzz/mozilla-central/js/src/jsinterp.cpp:2702
#8  0x000000000068645f in js::mjit::EnterMethodJIT (cx=0xb5fae0, fp=0x7ffff676e030, code=0x7ffff7fc9ab0, stackLimit=0x7ffff6b4e000, partial=false)
    at /home/decoder/LangFuzz/mozilla-central/js/src/methodjit/MethodJIT.cpp:1079

225         return types->nesting;
(gdb) p types
$1 = (js::types::TypeScript *) 0x0


Safe null-pointer crash, no security impact.
(Assignee)

Comment 1

5 years ago
Created attachment 613608 [details] [diff] [review]
patch

TypeMonitorCall is used to ensure the callee script has had a TypeScript allocated, whether TI is enabled or not.  If this allocation fails then the caller needs to throw.
Assignee: general → bhackett1024
Attachment #613608 - Flags: review?(luke)
(Assignee)

Updated

5 years ago
Duplicate of this bug: 735013

Updated

5 years ago
Attachment #613608 - Flags: review?(luke) → review+
(Assignee)

Comment 3

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/48881a94f5eb
https://hg.mozilla.org/mozilla-central/rev/48881a94f5eb
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla14
You need to log in before you can comment on or make changes to this bug.