Closed Bug 777992 Opened 8 years ago Closed 8 years ago

"Assertion failure: [barrier verifier] Unmarked edge: element,"

Categories

(Core :: JavaScript Engine, defect, critical)

x86
macOS
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla17
Tracking Status
firefox14 --- unaffected
firefox15 --- unaffected
firefox16 + fixed
firefox17 + verified
firefox-esr10 --- unaffected

People

(Reporter: gkw, Assigned: terrence)

References

Details

(5 keywords, Whiteboard: [js:p1:fx17][advisory-tracking-])

Attachments

(2 files)

Attached file stack
verifyprebarriers()
x = []
function z() {}
Object.defineProperty(x, 2, {
    value: z
})
gczeal(2, 2)
y = x.slice(2)
y.e = (function() {})

asserts js opt shell on m-c changeset deb98a757d4a without any CLI arguments at Assertion failure: [barrier verifier] Unmarked edge: element,

My opt shell is compiled with --enable-gczeal, --enable-profiling, --enable-debug-symbols, --enable-more-deterministic and --enable-valgrind among others.

s-s because gczeal is involved just-to-be-safe.
Assignee: general → wmccloskey
(not sure if this is really correct)

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   99987:139a8f2a8538
user:        Terrence Cole
date:        Wed Jun 20 18:48:56 2012 -0700
summary:     Bug 764962 - Add a verifier mode for GenerationalGC post barriers; r=billm

I verify that the parent changeset 440ac3414c64 of this changeset, does not assert with the following testcase:

verifybarriers()
x = []
function z() {}
Object.defineProperty(x, 2, {
    value: z
})
gczeal(2, 2)
y = x.slice(2)
y.e = (function() {})

(I changed verifyprebarriers() to verifybarriers() here)
Whiteboard: [js:p1:fx17]
Woohoo! My first sec-crit fuzz bug :-).
(In reply to Terrence Cole [:terrence] from comment #2)
> Woohoo! My first sec-crit fuzz bug :-).

Setting sec-critical. :)
Attached patch v0Splinter Review
Bill, thanks for all the help with tracking this down!  I couldn't put the fix quite where we planned for reasons I added to the comment.

What do I need to do to land this?  Do we need a cover bug?  Should I gin up a fake commit message?  Should it land in Aurora and Beta too?
Assignee: wmccloskey → terrence
Status: NEW → ASSIGNED
Attachment #646663 - Flags: review?(wmccloskey)
Comment on attachment 646663 [details] [diff] [review]
v0

This affects aurora but not beta. Since this doesn't affect a release, I think it's fine to land on inbound and aurora with a simple commit message like "Move array slowification barrier."
Attachment #646663 - Flags: review?(wmccloskey) → review+
https://hg.mozilla.org/integration/mozilla-inbound/rev/71c43f0a8e2c
Whiteboard: [js:p1:fx17] → [js:p1:fx17] [leave open]
(In reply to Terrence Cole [:terrence] from comment #6)
> https://hg.mozilla.org/integration/mozilla-inbound/rev/71c43f0a8e2c

Since this appears to have stuck on central, could you please nominate for Aurora?
Comment on attachment 646663 [details] [diff] [review]
v0

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Use after free if incremental GC is triggered in a certain spot.
User impact if declined: Rare crash during Incremental GC.
Testing completed (on m-c, etc.): Has been on m-c for a couple days now.
Risk to taking this patch (and alternatives if risky): Low.
String or UUID changes made by this patch: None.
Attachment #646663 - Flags: approval-mozilla-aurora?
Comment on attachment 646663 [details] [diff] [review]
v0

low risk, approving for aurora and if you could drop in a mozilla-central url with where this landed as well as update the status flags once this is uplifted that would be appreciated, thank you.
Attachment #646663 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Target Milestone: --- → mozilla17
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: mozilla17 → ---
Whiteboard: [js:p1:fx17] [leave open] → [js:p1:fx17]
Target Milestone: --- → mozilla17
And backed out in:
https://hg.mozilla.org/releases/mozilla-aurora/rev/e0d6e40bc40b

I forgot that we have updated the name of the verifybarriers() function.
Status: RESOLVED → VERIFIED
JSBugMon: This bug has been automatically verified fixed.
Whiteboard: [js:p1:fx17] → [js:p1:fx17][advisory-tracking-]
Group: core-security
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug777992.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.