Various assertions found with patches for bug 865059 and bug 867753

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86_64
Mac OS X
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments, 2 obsolete attachments)

(Reporter)

Description

5 years ago
Created attachment 744827 [details]
stack

disassemble("-r", Function("\
    2(function() {\
        1(function() {\
            for (var a = 0; a < 9; a++) {\
                1\
            }\
        })\
    })\
"))

asserts js debug shell on m-i changeset 5ac1564bff87 without any CLI arguments at Assertion failure: tn->kind < ArrayLength(TryNoteNames), at shell/js.cpp

bhackett specially requested for fuzzing this changeset to find regressions to the patch(es) in bug 865059.
(Reporter)

Updated

5 years ago
Flags: needinfo?(bhackett1024)
(Reporter)

Comment 1

5 years ago
Created attachment 744872 [details]
Pastebin patch

bhackett requested to use the patch in http://www.pastebin.mozilla.org/2369647 (replicated here) to fuzz again, which has fixes for this bug and bug 867753.

This likely found:

evalcx("for each(c in print())''", newGlobal(''))

Assertion failure: fun(), at ion/CompileInfo.h
(Reporter)

Updated

5 years ago
Assignee: general → gary
Status: NEW → ASSIGNED
(Reporter)

Comment 2

5 years ago
Oops, wrong bug.
Assignee: gary → general
Status: ASSIGNED → NEW
Depends on: 868564
(Reporter)

Comment 3

5 years ago
Created attachment 745315 [details] [diff] [review]
Pastebin patch v2

http://www.pastebin.mozilla.org/2369719 is an updated pastebin patch provided by bhackett to fix the bug in comment 1. (replicated here)
Attachment #744872 - Attachment is obsolete: true
(Reporter)

Comment 4

5 years ago
Created attachment 745338 [details]
stack for assertion

function f() {}
for (var a = 0; a < 99; a++) {
    f()
}

Assertion failure: script->types, at jsinferinlines.h (Pastebin patch v2 applied on m-i rev 99b086e10c8d, tested on 32-bit debug shell)

This blocks all further fuzzing on jsfunfuzz.
Attachment #744827 - Attachment is obsolete: true
(Reporter)

Updated

5 years ago
Summary: Assertion failure: tn->kind < ArrayLength(TryNoteNames), at shell/js.cpp → Various assertions found with patches for bug 865059 and bug 867753
(Reporter)

Comment 5

5 years ago
All requested fuzzing here was finished.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Flags: needinfo?(bhackett1024)
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.