763226 - IonMonkey: Crash [@ QuoteString]

Status: RESOLVED DUPLICATE of bug 779390

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: Testcase for shell

The attached testcase crashes on ionmonkey revision 5cfb73435e06 (run with --ion -n -m --ion-eager).

Comment 1

[Christian Holler (:decoder)]

Valgrind shows:

==27586== Invalid read of size 2
==27586==    at 0x581B1F: QuoteString(js::Sprinter*, JSString*, unsigned int) (jsopcode.cpp:951)
==27586==    by 0x581E63: js_QuoteString (jsopcode.cpp:1012)
==27586==    by 0x5F171F: js_ValueToSource(JSContext*, JS::Value const&) (jsstr.cpp:3274)
==27586==    by 0x42EC50: JS_ValueToSource (jsapi.cpp:514)
==27586==    by 0x40B877: ToSource(JSContext*, JS::Value*, JSAutoByteString*) (js.cpp:1214)
==27586==    by 0x40BA76: AssertEq(JSContext*, unsigned int, JS::Value*) (js.cpp:1245)
==27586==    by 0x403829C: ???
==27586==    by 0xC71223F: ???
==27586==    by 0x7FEFFD257: ???
==27586==    by 0x43F: ???
==27586==  Address 0xc7fffff is not stack'd, malloc'd or (recently) free'd
==27586== 
==27586== Invalid read of size 2
==27586==    at 0x581B31: QuoteString(js::Sprinter*, JSString*, unsigned int) (jsopcode.cpp:953)
==27586==    by 0x581E63: js_QuoteString (jsopcode.cpp:1012)
==27586==    by 0x5F171F: js_ValueToSource(JSContext*, JS::Value const&) (jsstr.cpp:3274)
==27586==    by 0x42EC50: JS_ValueToSource (jsapi.cpp:514)
==27586==    by 0x40B877: ToSource(JSContext*, JS::Value*, JSAutoByteString*) (js.cpp:1214)
==27586==    by 0x40BA76: AssertEq(JSContext*, unsigned int, JS::Value*) (js.cpp:1245)
==27586==    by 0x403829C: ???
==27586==    by 0xC71223F: ???
==27586==    by 0x7FEFFD257: ???
==27586==    by 0x43F: ???
==27586==  Address 0xc800047 is 7 bytes inside a block of size 32 free'd
==27586==    at 0x4C2695D: free (vg_replace_malloc.c:366)
==27586==    by 0x403C14: js_free (Utility.h:169)
==27586==    by 0x403C4E: js::Foreground::free_(void*) (Utility.h:588)
==27586==    by 0x41B48F: JSRuntime::free_(void*) (jscntxt.h:880)
==27586==    by 0x41B4E3: JSContext::free_(void*) (jscntxt.h:1320)
==27586==    by 0x581A40: js::Sprint(js::Sprinter*, char const*, ...) (jsopcode.cpp:914)
==27586==    by 0x581D27: QuoteString(js::Sprinter*, JSString*, unsigned int) (jsopcode.cpp:986)
==27586==    by 0x581E63: js_QuoteString (jsopcode.cpp:1012)
==27586==    by 0x5F171F: js_ValueToSource(JSContext*, JS::Value const&) (jsstr.cpp:3274)
==27586==    by 0x42EC50: JS_ValueToSource (jsapi.cpp:514)
==27586==    by 0x40B877: ToSource(JSContext*, JS::Value*, JSAutoByteString*) (js.cpp:1214)
==27586==    by 0x40BA76: AssertEq(JSContext*, unsigned int, JS::Value*) (js.cpp:1245)

Comment 2

[Daniel Veditz [:dveditz]]

Not sure if this is exploitable... is it just a bug local to QuoteString, and so always interpreting the unclean data as strings?

Comment 3

[Sean Stangl [:sstangl]]

Can't reproduce locally. Fixed by Bug 762936?

Comment 4

[Christian Holler (:decoder)]

The bot would have mentioned that, but trying to get explicity confirmation.

Comment 5

[Christian Holler (:decoder)]

I forgot that the bot cannot cope with archived testcases yet. But I found an easier testcase on tip now (rev 7ab88528503e, options as in comment 0):


gcPreserveCode();
gczeal(2);
var obj = {
    1: 1,
    2.5: 2.5,
    1073741822: 1073741822,
    1073741823: 1073741823,
    1073741824: 1073741824,
  };
for (var s in obj) {
  var n = obj[s];
  assertEq(JSON.stringify(obj, [n]), '{"' + s + '":' + n + '}', "Failed (" + n + ")");
  assertEq(JSON.stringify(obj, [s, ]), '{"' + s + '":' + n + '}', "Failed (" + s + "', " + n + ")");
  assertEq(JSON.stringify(obj, [n, s]), '{"' + s + '":' + n + '}', "Failed (" + n + ", '" + s + "')" );
}

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

decoder, I can't seem to reproduce the test case in comment #5 on tip or the given cset.

Comment 7

[Christian Holler (:decoder)]

Just tried this again and it reproduced for me (rev b02a7b214e49):

$ /srv/repos/ionmonkey/js/src/debug64/js --ion -n -m --ion-eager test.js 
Segmentation fault

What configure options did you use and did you try linux 64 bit?

Comment 8

[David Anderson [:dvander] - inactive, e-mail if emergency]

This is another one I still can't reproduce, either on the given cset or tip, using either test case. --enable-valgrind and valgrind shows no errors either.

Comment 9

[David Anderson [:dvander] - inactive, e-mail if emergency]

Sweet, I can reproduce this on the given cset on the fuzzing box. It doesn't repro on tip and hg bisect claims it was bug 779390, which is very believable.

Comment 10

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 779390).