Closed
Bug 949903
Opened 12 years ago
Closed 12 years ago
Memory corruption with ParallelArray, Worker
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WORKSFORME
| Tracking | Status | |
|---|---|---|
| firefox26 | --- | unaffected |
| firefox27 | --- | unaffected |
| firefox28 | --- | unaffected |
| firefox29 | --- | disabled |
| firefox30 | --- | affected |
People
(Reporter: jruderman, Unassigned)
Details
(4 keywords)
Attachments
(2 files, 1 obsolete file)
In a debug build:
Assertion failure: ctorValue.isObject() && ctorValue.toObject().is<JSFunction>(), at ../../../js/src/builtin/ParallelArray.cpp:121
In an ASan build, at the next GC:
SEGV on unknown address in PushMarkStack
|
Reporter | |
Comment 1•12 years ago
|
||
Bug 944074 will remove ParallelArray, but it might be worth investigating what causes this problem anyway.
|
|
Reporter | |
Comment 2•12 years ago
|
||
Attachment #8347055 -
Attachment is obsolete: true
|
||
Updated•12 years ago
|
Keywords: sec-critical
|
||
Comment 3•12 years ago
|
||
Niko do you want to look at this one?
status-firefox26:
--- → unaffected
status-firefox27:
--- → unaffected
status-firefox28:
--- → unaffected
status-firefox29:
--- → affected
Flags: needinfo?(nmatsakis)
|
||
Updated•12 years ago
|
Group: javascript-core-security
|
|
||
Comment 4•12 years ago
|
||
Presumably 29 is unaffected now because of bug 949903? Shall we close?
|
|
||
Comment 6•12 years ago
|
||
Sorry for the delayed response. I am not at all sure that this is *fixed*, though it may be quite hard to reproduce at this point, since ParallelArray is removed.
Flags: needinfo?(nmatsakis)
|
|
||
Comment 7•12 years ago
|
||
This is trunk-only and may not still apply, so I'm just going to lower this to high.
status-firefox30:
--- → affected
Keywords: sec-critical → sec-high
|
||
Comment 8•12 years ago
|
||
Resolving as "works for me." Please re-open if it reappears.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
|
|
||
Updated•11 years ago
|
Group: javascript-core-security
|
||
Updated•10 years ago
|
Group: core-security → core-security-release
|
|
||
Updated•8 years ago
|
Group: core-security-release
You need to log in
before you can comment on or make changes to this bug.
Description
•