Crash [@ js::BarrieredValue::pre] or Crash [@ getClass] due to unhandled OOM in CloneObject

VERIFIED FIXED in mozilla29

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
4 years ago
3 years ago

People

(Reporter: decoder, Assigned: decoder)

Tracking

(Blocks: 2 bugs, {sec-want})

Trunk
mozilla29
x86
Linux
sec-want
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Assignee)

Description

4 years ago
Created attachment 8359260 [details] [diff] [review]
clone-oom.patch

This code in CloneObject does not check the return value of CloneFunctionObject before using it, causing crashes:

>     clone = CloneFunctionObject(cx, fun, cx->global(), kind, TenuredObject);
>     // To be able to re-lazify the cloned function, its name in the
>     // self-hosting compartment has to be stored on the clone.
>     if (hasName)
>         clone->as<JSFunction>().setExtendedSlot(0, StringValue(fun->atom()));

Patch attached.
Attachment #8359260 - Flags: review?(jdemooij)
Comment on attachment 8359260 [details] [diff] [review]
clone-oom.patch

Review of attachment 8359260 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch.
Attachment #8359260 - Flags: review?(jdemooij) → review+
(Assignee)

Comment 2

4 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/d86046660b1f
https://hg.mozilla.org/mozilla-central/rev/d86046660b1f
Status: ASSIGNED → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla29

Updated

3 years ago
Keywords: verifyme

Comment 4

3 years ago
Socorro shows no crashes with the signatures in this bug for the last 4 weeks.
Status: RESOLVED → VERIFIED
Keywords: verifyme
You need to log in before you can comment on or make changes to this bug.