912978 - Assertion failure: bindingIndex < count(), at /srv/repos/mozilla/central-asan-opt-dbg/js/src/jsscript.cpp:246

Status: RESOLVED INCOMPLETE

(Core :: JavaScript Engine, defect)

Description

[Frederik Braun [:freddy]]

I am having this reproducible segfault (assertion failure), but cannot get other sensible information out of the crash (e.g. using an address sanitizer build) except addresses in libxul.so on stdout.

I am not sure if this crash is exploitable, but as it requires heavy user interaction (see STR), I am not marking it core-security. Feel free to disagree :)

STR:
1) I am debugging a JS file using the developer tools debugger
2) I am setting a breakpoint on a function that is repeatedly called
3) The breakpoint is hit and I am navigating through the stack using the breadcrumbs in the UI (this step seems to be important)
4) I continue to the code, the breakpoint is hit a few more times, I always click on the run button.
5) Crash

My test case is rather big and dirty, but I fail at minimizing it. Bugzilla doesn't like zip attachments. Should I throw my folder somewhere in the clouds and link it from here?

Comment 1

[Frederik Braun [:freddy]]

According to hg, the affected code line was added in bug 767013. If that helps...CCing Luke