815241 - Assert or crash on shutdown with gczeal(9, 2)

Status: RESOLVED DUPLICATE of bug 801721

(Core :: JavaScript: GC, defect)

Description

[Jesse Ruderman]

Attachment: testcase (see comment 0)

1. Create a new profile (mkdir -p ~/px/a; firefox -profile ~/px/a)
2. Install https://www.squarefree.com/extensions/domFuzzLite3.xpi
3. Run Firefox with the testcase filename on the command line.
4. Wait for the browser to exit (gczeal makes this take several minutes)


Result with a local debug build:
Assertion failure: cx->iterValue.isMagic(JS_NO_ITER_VALUE), at js/src/jsinterp.cpp:342

Result with a Tinderbox build:

Crash [@ MarkValueInternal]


js> help(gczeal)       
    9: Incremental GC in two slices: 1) mark all 2) new marking and finish

Comment 1

[Jesse Ruderman]

Attachment: stack trace for assertion

Comment 2

[Jesse Ruderman]

Attachment: stack trace for crash

Comment 3

[Daniel Veditz [:dveditz]]

I have no idea how to rate this or if it's even a security issue given the crash on null. Is there any other bad values that can creep in here?

Comment 4

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Not sure how serious this is. I'll take a look.

Comment 5

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

I'm adding a dependency on bug 801721 that's the assertion that fires. Once that bug is fixed we'll need to run it again and see if anything bad happens.

Comment 6

[Daniel Veditz [:dveditz]]

totally guessing at "sec-moderate"

Comment 7

[Jan de Mooij [:jandem]]

I'm looking at old security bugs. Bill, how serious is this?

Comment 8

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

I don't know much about the assertion. It would certainly be nice to fix it since we've had bugs and crashes related to it for over a year. It has something to do with the slow script dialog. Basically, if we run long enough to get the slow script dialog in debug builds, we seem to assert in this way.

The opt crash might not be serious. It looks like a NULL pointer deref that might be related to the assertion. I don't think I was ever able to reproduce it though.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

See also bug 853001, which we continue to hit intermittently on TBPL.

Comment 10

[Jesse Ruderman]

This is trivial to find even without a fuzzer, and sounds like it's not a big problem, so I'm making it public.

Comment 11

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Jon, is this still applicable?

Comment 12

[Jim Blandy :jimb]

I think since bug 801721 is resolved, this is probably fine.