757811 - IonMonkey: Assertion failure: (extendedJumpTable_ + i * SizeOfJumpTableEntry) < size() - SizeOfJumpTableEntry, at ion/x64/Assembler-x64.cpp:158

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: Testcase for shell

The attached testcase asserts on ionmonkey revision d5545e6d927b (run with --ion -n).

Comment 1

[Christian Holler (:decoder)]

As discussed with jandem already, the testcase here is highly fragile and might not reproduce easily. It might also be necessary to use --ion-eager.

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Patch

We discussed this a bit on IRC, I don't know the code very well but it seems the assert should use <= instead of <.

If we have the following jumps:

jump 0 - offset 0
jump 1 - offset 16
jump 2 - offset 32

size() -> 48

Then (extendedJumpTable_ + i * SizeOfJumpTableEntry) is 32 for i == 2. In this case size() - SizeOfJumpTableEntry is also 32.

Comment 3

[Daniel Veditz [:dveditz]]

Given that the patch simply changes the assert we're saying there's no possible security bug here, right?

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

(In reply to Daniel Veditz [:dveditz] from comment #3)
> Given that the patch simply changes the assert we're saying there's no
> possible security bug here, right?

Yup.

Comment 5

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/projects/ionmonkey/rev/082a0b357b50

Comment 6

[Christian Holler (:decoder)]

Testcase is too complex to add.