736807 - "Assertion failure: addr % Cell::CellSize == 0" with exception crossing compartment boundary

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: stack trace

function f()
{
    try {
        evalcx("x", newGlobal('new-compartment'))
    } catch(e) {
        assertEq("" + e, "ReferenceError: x is not defined");
    }
}
gczeal(2,1,true);
f(function(){}, {}, {});


Assertion failure: addr % Cell::CellSize == 0, at js/src/jsgc.h:861


The first bad revision is:
changeset:   1d61262c243c
user:        Bobby Holley
date:        Thu Mar 15 15:19:52 2012 -0700
summary:     Bug 735544 - Allow exception stacks to cross compartment boundaries. r=luke

Comment 1

[Jesse Ruderman]

This bug can also cause other assertion failures or crashes during GC.

Comment 2

[Luke Wagner [:luke]]

Blarg, s/Vector<Values>/AutoValueVector/.  Patch in a second.

Comment 3

[Luke Wagner [:luke]]

Attachment: fix and test

Comment 4

[Luke Wagner [:luke]]

https://hg.mozilla.org/mozilla-central/rev/fc8534cfca3d

Comment 5

[Luke Wagner [:luke]]

and because gczeal is only defined in debug builds:
https://hg.mozilla.org/mozilla-central/rev/8414a5a38e56

Comment 6

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 7

[Daniel Veditz [:dveditz]]

Is this just a leak, or a potential security problem we'd want the fix for in mozilla 13?

Comment 8

[Daniel Veditz [:dveditz]]

I must have misread the regressing bug. If this is really a regression from bug 735544 then Firefox 13 should not be affected.

Comment 9

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug736807.js.