810925 - IonMonkey: Assertion failure: [barrier verifier] Unmarked edge: <unknown>, at js/src/jsgc.cpp:5437

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision b2bdbfe06b10 (run with --ion-eager):


var actual = '';
function reportCompare (expected, actual, description) {
  var testcase = new TestCase("unknown-test-name", description, expected, actual);
  try  {  }  catch(ex)  {  }
}
var lfcode = new Array();
lfcode.push("0");
lfcode.push("var expect = 'No Error';");
lfcode.push("\
function TestCase(n, d, e, a) {\
  this.description=(Math.E = this) \
}\
re = /0./;\
s = 10203040506070809000;\
AddRegExpCases(re, \"re = \" + re , s, String(s), 1, [\"02\"]);\
function AddRegExpCases(\
  regexp, str_regexp, string, str_string, index, matches_array ) {\
  gczeal(4);\
}\
var date = new Date(\"06/05/2005 00:00:00 GMT-0000\");\
reportCompare(expect, actual, 'Date.toLocaleFormat(\"%A\")');\
reportCompare(expect, actual, 'Date.toLocaleFormat(\"%b\")');\
reportCompare(expect, actual, 'Date.toLocaleFormat(\"%B\")');\
reportCompare(expect, actual, 'Date.toLocaleFormat(\"%d\")');\
reportCompare(expect, actual, 'Date.toLocaleFormat(%H)');\
");
while (true) {
	var file = lfcode.shift(); if (file == undefined) { break; }
        loadFile(file)
}
function loadFile(lfVarx) {
        if (lfVarx.substr(-3) == ".js") {
        } else if (!isNaN(lfVarx)) {
            lfRunTypeId = parseInt(lfVarx);
        } else {
            switch (lfRunTypeId) {
                default: evaluate(lfVarx); break;
            }
	}
}

Comment 1

[Christian Holler (:decoder)]

S-s because this is GC related.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

I missed this case when fixing bug 805747.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 680745 [details] [diff] [review]
fix

[Security approval request comment]
How easily can the security issue be deduced from the patch?

Not easily.

Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?

No.

Which older supported branches are affected by this flaw?

Firefox 18.

If not all supported branches, which bug introduced the flaw?

IonMonkey.

Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be?

This patch should apply to Firefox 18.

How likely is this patch to cause regressions; how much testing does it need?

Very unlikely; very little.

Comment 4

[Alex Keybl [:akeybl]]

Assuming sec-critical given the sec-approval nom, and the rating of bug 805747

Comment 5

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   111211:2583a19e59ef
user:        Kannan Vijayan
date:        Tue Oct 23 22:18:11 2012 -0400
summary:     Bug 795801 - IC StrictPropertyOp setters in IonMonkey. (r=dvander)

This iteration took 0.298 seconds to run.

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ef467dfbbc0d

Comment 7

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision a7ed19f7d21a).

Comment 8

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/ef467dfbbc0d

Comment 9

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 10

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 680745 [details] [diff] [review]
fix

[Approval Request Comment]
Bug caused by (feature/regressing bug #): IonMonkey
User impact if declined: Potential security bug
Testing completed (on m-c, etc.): Yes
Risk to taking this patch (and alternatives if risky): Almost none
String or UUID changes made by this patch:

Comment 11

[Alex Keybl [:akeybl]]

Comment on attachment 680745 [details] [diff] [review]
fix

[Triage Comment]
Low risk fix for a sec-critical IonMonkey regression.

If this is landed on mozilla-aurora before ~11AM PT tomorrow, this will make the merge from Aurora 18 to Beta 18. If landed 11AM-5PM PT tomorrow on mozilla-beta, it will make the first FF18 Beta. If landed after that, it will end up in the second FF18 beta.

Comment 12

[David Anderson [:dvander] - inactive, e-mail if emergency]

https://hg.mozilla.org/releases/mozilla-aurora/rev/51b78d081436

Comment 13

[u279076]

Can this be put in testsuite?