730810 - Assertion failure: ((js_CodeSpec[lhs->getOp()].format) & 0x001f) != 2, at js/src/frontend/BytecodeEmitter.cpp:3707 or Crash [@ JSScript::getAtom]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test crashes on mozilla-central revision 2dc40eb83023 (no options required):

const K = 20; K += "0";


Stepping through the assertion reveals a (likely exploitable) crash:

Program received signal SIGABRT, Aborted.
Assertion failure: index < natoms, at ../../jsscript.h:721

Program received signal SIGABRT, Aborted.

Program received signal SIGSEGV, Segmentation fault.
0x000000000041361e in JSScript::getAtom (this=0x7ffff6107180, index=15616) at ../../jsscript.h:722
722             return atoms[index];

Comment 1

[Christian Holler (:decoder)]

The first bad revision is:
changeset:   87695:f4e955f78de9
user:        Jeff Walden
date:        Fri Feb 03 18:53:29 2012 -0800
summary:     Bug 720316 - Use uint32_t indexes for JOF_ATOM opcodes.  r=jorendorff

Comment 2

[Jeff Walden [:Waldo]]

                if (lhs->isOp(JSOP_CALLEE)) {
                    if (Emit1(cx, bce, JSOP_CALLEE) < 0)
                        return false;
                } else if (lhs->isOp(JSOP_NAME)) {
                    if (!EmitIndex32(cx, lhs->getOp(), atomIndex, bce))
                        return false;
                } else {
                    JS_ASSERT(JOF_OPTYPE(lhs->getOp()) != JOF_ATOM);
                    EMIT_UINT16_IMM_OP(lhs->getOp(), atomIndex);
                }

The middle block needs to also handle isOp(JSOP_GETGNAME).  I'll get a patch together when I get to the office.

Comment 3

[Jeff Walden [:Waldo]]

Attachment: Patch and test

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

http://hg.mozilla.org/integration/mozilla-inbound/rev/7bb7889f568a

Comment 5

[Jeff Walden [:Waldo]]

And https://hg.mozilla.org/integration/mozilla-inbound/rev/6a5d5cbced04 because I fail at life.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

http://hg.mozilla.org/mozilla-central/rev/7bb7889f568a
http://hg.mozilla.org/mozilla-central/rev/6a5d5cbced04