Closed Bug 1415748 Opened 7 years ago Closed 7 years ago

Crash in js::InterpreterFrame::prologue

Categories

(Core :: JavaScript Engine, defect, P1)

Product:
Core
Component:
JavaScript Engine
Version:
56 Branch
Platform:
Unspecified
Windows 7
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla59
Tracking Flags:
Tracking Status
firefox-esr52 --- wontfix
firefox56 --- wontfix
firefox57 --- wontfix
firefox58 --- fixed
firefox59 --- fixed

People

(Reporter: jesup, Assigned: tcampbell)

References

Details

(Keywords: crash, csectype-uaf, sec-high, Whiteboard: [adv-main58+][post-critsmash-triage])

Crash Data

This bug was filed from the Socorro interface and is report bp-fcc1786c-69e6-4a16-a156-3aa030171103. ============================================================= Top 10 frames of crashing thread: 0 xul.dll js::InterpreterFrame::prologue js/src/vm/Stack.cpp:244 1 xul.dll Interpret js/src/vm/Interpreter.cpp:1910 2 xul.dll js::RunScript js/src/vm/Interpreter.cpp:435 3 xul.dll js::ExecuteKernel js/src/vm/Interpreter.cpp:724 4 xul.dll ExecuteInExtensibleLexicalEnvironment js/src/builtin/Eval.cpp:465 5 xul.dll js::ExecuteInJSMEnvironment js/src/builtin/Eval.cpp:551 6 xul.dll js::ExecuteInJSMEnvironment js/src/builtin/Eval.cpp:509 7 xul.dll mozJSComponentLoader::ObjectForLocation js/xpconnect/loader/mozJSComponentLoader.cpp:852 8 xul.dll mozJSComponentLoader::LoadModule js/xpconnect/loader/mozJSComponentLoader.cpp:385 9 xul.dll nsComponentManagerImpl::KnownModule::Load xpcom/components/nsComponentManager.cpp:754 ============================================================= UAF going back to at least 52esr/53, and probably further. The numbers of e5 crashes seem to have bumped up in 57b10/b11 for some reason. Crashes appear to occur at two different locations in the function.
status-firefox56: --- → wontfix
status-firefox57: --- → wontfix
status-firefox58: --- → affected
status-firefox-esr52: --- → affected
Flags: needinfo?(nihsanullah)
Group: core-security → javascript-core-security
Likely a duplicate of bug 1409179.
Switching ni? to Jan who's investigating the other bug.
Flags: needinfo?(nihsanullah) → needinfo?(jdemooij)
Priority: -- → P1
Ted, another XDR bug for your collection.
Flags: needinfo?(jdemooij) → needinfo?(tcampbell)
Thanks Jan! Almost certainly is. The crash graph for nightly went flat after I landed mitigations last week.
Assignee: nobody → tcampbell
Depends on: 1418894
Flags: needinfo?(tcampbell)
Crash doesn't appear in 58.0b9 and earlier crashes are consistent with problems Bug 1418894 addresses.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
This is rated sec-high, but it looks like ESR52 rarely hits these crashes in practice. Should we push on backporting the XDR hardening patches there anyway or let them ride 58?
status-firefox58: affected → fixed
status-firefox59: --- → fixed
Flags: needinfo?(dveditz)
Target Milestone: --- → mozilla59
Moving this conversation to Bug 1423616.
Flags: needinfo?(dveditz)
Group: javascript-core-security → core-security-release
Flags: qe-verify-
Whiteboard: [adv-main58+] → [adv-main58+][post-critsmash-triage]
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.