Closed Bug 779812 Opened 12 years ago Closed 12 years ago

IonMonkey: Crash [@ js::EncapsulatedPtr] with use-after-free

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86_64
Linux
defect
Not set
major

Tracking

()

VERIFIED FIXED
Tracking Status
firefox17 --- unaffected
firefox-esr10 --- unaffected

People

(Reporter: decoder, Assigned: dvander)

References

Details

(4 keywords, Whiteboard: [jsbugmon:update][ion:p1:fx18])

Crash Data

Attachments

(1 file)

The following testcase crashes on ionmonkey revision 2169bca0c9a5 (run with --ion -n -m --ion-eager -a):


gczeal(2,1);
(function () {
  var m = {}
  return { stringify: stringify };
})();
Crash info:

==9467== Invalid read of size 8
==9467==    at 0x4150E0: js::EncapsulatedPtr<JSObject, unsigned long>::operator JSObject*() const (Barrier.h:172)
==9467==    by 0x426C71: js::ObjectImpl::hasSingletonType() const (ObjectImpl.h:1129)
==9467==    by 0x94F0EF: js::ion::CodeGenerator::visitNewObject(js::ion::LNewObject*) (CodeGenerator.cpp:1306)
==9467==    by 0x8941DA: js::ion::LNewObject::accept(js::ion::LInstructionVisitor*) (LIR-Common.h:250)
==9467==    by 0x94E78D: js::ion::CodeGenerator::generateBody() (CodeGenerator.cpp:1137)
==9467==    by 0x9562C7: js::ion::CodeGenerator::generate() (CodeGenerator.cpp:2638)
==9467==    by 0x823414: js::ion::GenerateCode(js::ion::IonBuilder&, js::ion::MIRGraph&) (Ion.cpp:827)
==9467==    by 0x8234AE: js::ion::TestCompiler(js::ion::IonBuilder&, js::ion::MIRGraph&) (Ion.cpp:842)
==9467==    by 0x82A4FB: bool js::ion::IonCompile<&(js::ion::TestCompiler(js::ion::IonBuilder&, js::ion::MIRGraph&))>(JSContext*, JSScript*, JSFunction*, unsigned char*, bool) (Ion.cpp:876)
==9467==    by 0x827877: js::ion::MethodStatus js::ion::Compile<&(js::ion::TestCompiler(js::ion::IonBuilder&, js::ion::MIRGraph&))>(JSContext*, JSScript*, JSFunction*, unsigned char*, bool) (Ion.cpp:992)
==9467==    by 0x823B38: js::ion::CanEnter(JSContext*, JSScript*, js::StackFrame*, bool) (Ion.cpp:1082)
==9467==    by 0x52B446: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsinterp.cpp:2495)
==9467==  Address 0xdadadadadadadae2 is not stack'd, malloc'd or (recently) free'd
Whiteboard: [jsbugmon:update] → [jsbugmon:update][ion:p1:fx18]
MIR.h is using HeapPtr<> instead of CompilerRoot<>
Assignee: general → dvander
Status: NEW → ASSIGNED
Attached patch fixSplinter Review
Attachment #648474 - Flags: review?(sstangl)
Attachment #648474 - Flags: review?(sstangl) → review+
https://hg.mozilla.org/projects/ionmonkey/rev/9f3dc298e25b
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Status: RESOLVED → VERIFIED
JSBugMon: This bug has been automatically verified fixed.
Group: core-security
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: