909461 - Root Analysis: Crash on Heap

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 4887845b1142 (run with --fuzzing-safe --ion-eager), built with rooting analysis enabled:


gczeal(6);
var null_count = 0;
var original_string_count = 0;
var actual = null_count + original_string_count;
    var bag = prepare_arays();
    function prepare_arays() {
        var bag = [];
        for (var i = 0; i != 50; ++i) {
            var a = [0];
            a.length = i + actual;
            bag.push(a);
    }
}

Comment 1

[Christian Holler (:decoder)]

Crash trace:


Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7f9c26a in ?? ()
(gdb) bt
#0  0x00007ffff7f9c26a in ?? ()
#1  0x00007ffff7f9c018 in ?? ()
#2  0x00007ffff7f91554 in ?? ()
#3  0x0000000000000183 in ?? ()
#4  0x00007ffff67623c0 in ?? ()
#5  0x0000000000000000 in ?? ()
(gdb) x /i $pc
=> 0x7ffff7f9c26a:      cmp    %r11,(%r15)
(gdb) info reg r15
r15            0x7fffda762580   140736858563968

Comment 2

[Jon Coppeard (:jonco)]

(In reply to Christian Holler (:decoder) from comment #1)

This one doesn't reproduce for me.  I tired normal build and 32 bit build.

Comment 3

[Terrence Cole [:terrence]]

Given that the poisoned value leaked into jit code, I believe this is another false positive from a missing skip-root on the jit's stack.