Closed Bug 1004457 Opened 11 years ago Closed 11 years ago

Assertion failure: [barrier verifier] Unmarked edge: callee, at gc/Verifier.cpp:315

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla32
Tracking Flags:
Tracking Status
firefox31 --- unaffected
firefox32 --- verified
firefox-esr24 --- unaffected

People

(Reporter: decoder, Assigned: terrence)

References

Details

(5 keywords, Whiteboard: [jsbugmon:update])

Attachments

(2 files)

[crash-signature] Machine-readable crash signature
(deleted), text/plain
Details
fuzz_1004457-v0.diff
(deleted), patch
jonco
: review+
Details | Diff | Splinter Review
The following testcase asserts on mozilla-central revision b227a707080f (run with --fuzzing-safe): var argObj = (function () { return arguments })(); gczeal(4); delete argObj.callee;
Marked s-s because this is a GC-related assertion with unknown impact until triaged.
status-firefox32: --- → affected
Keywords: crash
Whiteboard: [jsbugmon:update,bisect]
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result: === Tinderbox Build Bisection Results by autoBisect === The "good" changeset has the timestamp "20140429121708" and the hash "d1e4a93e5b6c". The "bad" changeset has the timestamp "20140429124009" and the hash "57292971f110". Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=d1e4a93e5b6c&tochange=57292971f110
Regressed by bug 989414, needinfo from terrence based on comment 3 :)
Flags: needinfo?(terrence)
Yup, this is almost certainly the BarrieredPtr rewrite. Taking.
Assignee: nobody → terrence
Flags: needinfo?(terrence)
Attached patch fuzz_1004457-v0.diff (deleted) — — Splinter Review
Gah! This was dumb. HeapBase dispatches to Heap<T>, so misses pre-barriers. Fortunately the one and only spot this could bite was through the setMagic I added at the same time. Thankfully the solution is trivial.
Attachment #8416039 - Flags: review?(jcoppeard)
Comment on attachment 8416039 [details] [diff] [review] fuzz_1004457-v0.diff Review of attachment 8416039 [details] [diff] [review]: ----------------------------------------------------------------- Ah yes, indeed it does.
Attachment #8416039 - Flags: review?(jcoppeard) → review+
https://hg.mozilla.org/mozilla-central/rev/728803659bcb
Status: NEW → RESOLVED
Closed: 11 years ago
status-firefox32: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla32
Status: RESOLVED → VERIFIED
JSBugMon: This bug has been automatically verified fixed.
Did this only affect trunk from the checkin on May 1?
status-firefox30: --- → ?
status-firefox31: --- → ?
status-firefox-esr24: --- → unaffected
Flags: needinfo?(terrence)
The issue was present in m-c between 29 Apr and 14 May. I'm not sure what branches that covers.
Flags: needinfo?(terrence)
That's the day after we branches so this is trunk only.
status-firefox30: ? → ---
status-firefox31: ? → unaffected
JSBugMon: This bug has been automatically verified fixed on Fx32
Blocks: 989414
Group: core-security
Keywords: regression, sec-high
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: