819797 - IonMonkey: Crash [@ js::ion::CodeGenerator::visitCallKnown] or "Assertion failure: hasScript(),"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

x = y = z = this
toSource = (function() {
    return function() {
        (function() {
            y.eval
        })()
    }
})()
__defineGetter__("eval", Array.reduce)
uneval(z)

asserts js debug shell on IonMonkey changeset 725eb8792d27 with --ion-eager at Assertion failure: hasScript(), and crashes js opt shell at js::ion::CodeGenerator::visitCallKnown

Setting s-s just-in-case but seems to be a null deref, so assuming sec-moderate and csec-dos.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: regressing changeset range

Comment 2

[Hannes Verschore [:h4writer]]

Attachment: Create script of lazy function

Create the script of a lazy function, before taking the script to do checks on...

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Null derefs are marked sec-other instead of sec-moderate unless otherwise discovered.

Comment 4

[Hannes Verschore [:h4writer]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1181c5df5866

I had no idea if I could just upload the testcase. Is that allowed in security bugs?

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> I had no idea if I could just upload the testcase. Is that allowed in
> security bugs?

For nightly-only bugs, it should be alright.

Comment 6

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/a4a0aa798038
https://hg.mozilla.org/mozilla-central/rev/1181c5df5866

Comment 7

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 8

[Sean Stangl [:sstangl]]

Unmarking S-S: fixed in all builds.