Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upTwitter triggers segfaults within SM internals called from JITed JS code. #10229
Comments
|
Seen on 0826a5b STR: open https://twitter.com/whitequark (or some other profile), scroll down. Happens both with and without webrender. This might just be a problem in spidermonkey, but we might also be forgetting to root something here. Not yet tried with rr. |
|
It would be really valuable to use a debug-mozjs build and grab the backtrace from that. |
|
I agree, without a debug build, it's really hard to get to the bottom of That being said, there have been lots of bug fixes around GC, and lots of |
|
I tried to repro with a debug build, but hit something else first. |
|
This manifests itself as a stack overflow for me. |
|
Backtrace:
|
|
Another backtrace:
|
|
This hits a stack guard, so it's a stack overflow in C++ code. |
|
|
#jsapi says we're missing |
JavaScript stack overflows. Addresses servo/servo#10229.
JavaScript stack overflows. Addresses servo/servo#10229.
|
For what it's worth, this is likely not exploitable due to the guard page correctly catching the stack overflow and bringing down the process. If some way to overshoot the guard page could be found, though, it would be. |
Set the native stack quota per Gecko's defaults to defend against JavaScript stack overflows. Addresses servo/servo#10229. r? @jdm <!-- Reviewable:start --> --- This change is [<img src="https://reviewable.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/rust-mozjs/249) <!-- Reviewable:end -->
Update js (fixes #10229). <!-- Reviewable:start --> This change is [<img src="https://reviewable.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/10283) <!-- Reviewable:end -->
I expect these to be pretty random (but they do happen every time for me). Example:
Another example from @Manishearth: