The default bug view has changed. See this FAQ.

IonMonkey: Crash on heap near [@ EnterIon] with invalid read

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
major
RESOLVED FIXED
5 years ago
4 years ago

People

(Reporter: decoder, Assigned: jandem)

Tracking

(Blocks: 2 bugs, {crash, testcase})

Other Branch
x86_64
Linux
crash, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update][ion:p1:fx18], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following testcase crashes on ionmonkey revision 54f9ee5403f0 (run with --ion -n):


for(var i = 0; i < 9; (i)) {
  x = ''.charAt(-1);
}
(Reporter)

Comment 1

5 years ago
Crash info:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7f63e50 in ?? ()
(gdb) bt
#0  0x00007ffff7f63e50 in ?? ()
#1  0x00007ffff7f640ba in ?? ()
#2  0x00000000000000c1 in ?? ()
#3  0x00007ffff07070e9 in ?? ()
#4  0x0000000000000000 in ?? ()
(gdb) x /i $pc
=> 0x7ffff7f63e50:      movzwl (%rbx,%rdx,2),%ebx
(gdb) info reg rbx rdx ebx
rbx            0x7ffff0823810   140737228453904
rdx            0xffffffff       4294967295
ebx            0xf0823810       -259901424

==23264== Invalid read of size 2
==23264==    at 0x4032E50: ???
==23264==    by 0x8152A0: EnterIon(JSContext*, js::StackFrame*, void*) (Ion.cpp:1150)
==23264==    by 0x815604: js::ion::SideCannon(JSContext*, js::StackFrame*, unsigned char*) (Ion.cpp:1194)
==23264==    by 0x51DF3B: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsinterp.cpp:1535)
==23264==    by 0x518C83: js::RunScript(JSContext*, JSScript*, js::StackFrame*) (jsinterp.cpp:321)
==23264==    by 0x5198B7: js::ExecuteKernel(JSContext*, JSScript*, JSObject&, JS::Value const&, js::ExecuteType, js::StackFrame*, JS::Value*) (jsinterp.cpp:507)
==23264==    by 0x519AFE: js::Execute(JSContext*, JSScript*, JSObject&, JS::Value*) (jsinterp.cpp:545)
==23264==    by 0x44C1DF: JS_ExecuteScript (jsapi.cpp:5511)
==23264==    by 0x408B98: Process(JSContext*, JSObject*, char const*, bool) (js.cpp:435)
==23264==    by 0x413D3D: ProcessArgs(JSContext*, JSObject*, js::cli::OptionParser*) (js.cpp:4837)
==23264==    by 0x413F85: Shell(JSContext*, js::cli::OptionParser*, char**) (js.cpp:4878)
==23264==    by 0x4148EC: main (js.cpp:5083)
==23264==  Address 0x20c72380e is not stack'd, malloc'd or (recently) free'd
(Assignee)

Comment 2

5 years ago
Created attachment 647536 [details] [diff] [review]
Patch

LBoundsCheck should do an unsigned comparison if both operands are constant.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attachment #647536 - Flags: review?(dvander)
Attachment #647536 - Flags: review?(dvander) → review+
Whiteboard: [jsbugmon:update] → [jsbugmon:update][ion:p1:fx18]
(Assignee)

Comment 3

5 years ago
https://hg.mozilla.org/projects/ionmonkey/rev/07e292dd5d3f
Group: core-security
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
(Reporter)

Comment 4

4 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug779125.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.