Closed Bug 1295003 Opened 8 years ago Closed 8 years ago

Crash in js::Debugger::wrapDebuggeeObject after a Proxy is revoked

Tracking

()

Status:

RESOLVED DUPLICATE of bug 1291011

Tracking Flags:

Tracking

Status

firefox50

---

firefox51

---

unaffected

People

(Reporter: WeirdAl, Unassigned)

Details

(4 keywords)

Crash Data

Signature:

#0 0x00007f40e4ad8259 in js::Debugger::wrapDebuggeeObject(JSContext*, JS::Handle<JSObject*>, JS::MutableHandle<js::DebuggerObject*>) (this=0x7f40c77bf000, cx=0x7f40d0246000, obj=0x0, result=0x0) at /home/ajvincent/aurora/mozilla-aurora/js/src/vm/Debugger.cpp:1143 #1 0x00007f40e4af1e42 in js::DebuggerObject::scriptedProxyTarget(JSContext*, JS::Handle<js::DebuggerObject*>, JS::MutableHandle<js::DebuggerObject*>) (cx=0x7f40d0246000, object=(js::DebuggerObject * const) 0x7f40b080e2e0

[object Object]

, result=0x0) at /home/ajvincent/aurora/mozilla-aurora/js/src/vm/Debugger.cpp:9907 #2 0x00007f40e4af1cab in js::DebuggerObject::proxyTargetGetter(JSContext*, unsigned int, JS::Value*) (cx=0x7f40d0246000, argc=0, vp=0x7ffc8812be98) at /home/ajvincent/aurora/mozilla-aurora/js/src/vm/Debugger.cpp:8502 #3 0x00007f40e4b9936d in js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) (cx=0x7f40d0246000, native=0x7f40e4af1ba0 <js::DebuggerObject::proxyTargetGetter(JSContext*, unsigned int, JS::Value*)>, args=...) at /home/ajvincent/aurora/mozilla-aurora/js/src/jscntxtinlines.h:232 #4 0x00007f40e4b82f24 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (cx=0x7f40d0246000, args=..., construct=js::NO_CONSTRUCT) at /home/ajvincent/aurora/mozilla-aurora/js/src/vm/Interpreter.cpp:453 #5 0x00007f40e4b832fd in InternalCall(JSContext*, js::AnyInvokeArgs const&) (cx=0x7f40d0246000, args=...) at /home/ajvincent/aurora/mozilla-aurora/js/src/vm/Interpreter.cpp:498 #6 0x00007f40e4b616a6 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) (cx=0x7f40d0246000, fval=$jsval((JSObject *) 0x7f40bd913a00

[object Function "get proxyTarget"]

), thisv=$jsval((JSObject *) 0x7f40b080e2e0

[object Object]

), args=..., rval=JSVAL_VOID) at /home/ajvincent/aurora/mozilla-aurora/js/src/vm/Interpreter.cpp:517 #7 0x00007f40e4b83d25 in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) (cx=0x7f40d0246000, thisv=$jsval((JSObject *) 0x7f40b080e2e0

[object Object]

), getter=$jsval((JSObject *) 0x7f40bd913a00

[object Function "get proxyTarget"]

), rval=JSVAL_VOID) at /home/ajvincent/aurora/mozilla-aurora/js/src/vm/Interpreter.cpp:631 #8 0x00007f40e4bc9025 in CallGetter(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<js::Shape*>, JS::MutableHandle<JS::Value>) (cx=0x7f40d0246000, obj=(JSObject * const) 0x7f40bd919be0

[object Object]

delegate, receiver=$jsval((JSObject *) 0x7f40b080e2e0

[object Object]

), shape=0x7f40bd912660, vp=JSVAL_VOID) at /home/ajvincent/aurora/mozilla-aurora/js/src/vm/NativeObject.cpp:1737 #9 0x00007f40e4bb7329 in GetExistingProperty<(js::AllowGC)1>(JSContext*, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::Shape*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType) (cx=0x7f40d0246000, receiver=$jsval((JSObject *) 0x7f40b080e2e0

[object Object]

), obj=(js::NativeObject * const) 0x7f40bd919be0

[object Object]

delegate, shape=0x7f40bd912660, vp=JSVAL_VOID) at /home/ajvincent/aurora/mozilla-aurora/js/src/vm/NativeObject.cpp:1785 #10 0x00007f40e4bb765e in NativeGetPropertyInline<(js::AllowGC)1>(JSContext*, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<jsid, (js::AllowGC)1>::HandleType, IsNameLookup, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType) (cx=0x7f40d0246000, obj=(js::NativeObject * const) 0x7f40b080e2e0

[object Object]

, receiver=$jsval((JSObject *) 0x7f40b080e2e0

[object Object]

), id=$jsid("proxyTarget"), nameLookup=NotNameLookup, vp=JSVAL_VOID) at /home/ajvincent/aurora/mozilla-aurora/js/src/vm/NativeObject.cpp:2012 #11 0x00007f40e4bb748a in js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) (cx=0x7f40d0246000, obj=(js::NativeObject * const) 0x7f40b080e2e0

[object Object]

, receiver=$jsval((JSObject *) 0x7f40b080e2e0

[object Object]

), id=$jsid("proxyTarget"), vp=JSVAL_VOID) at /home/ajvincent/aurora/mozilla-aurora/js/src/vm/NativeObject.cpp:2046 #12 0x00007f40e43c69af in js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) (cx=0x7f40d0246000, obj=(JSObject * const) 0x7f40b080e2e0

[object Object]

, receiver=$jsval((JSObject *) 0x7f40b080e2e0

[object Object]

), id=$jsid("proxyTarget"), vp=JSVAL_VOID) at /home/ajvincent/aurora/mozilla-aurora/js/src/vm/NativeObject.h:1478 #13 0x00007f40e4ab3ca6 in js::Wrapper::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) const (this=0x7f40e7a5b3d8 <js::CrossCompartmentWrapper::singleton>, cx=0x7f40d0246000, proxy=(JSObject * const) 0x7f40c8494260

[object Proxy]

, receiver=$jsval((JSObject *) 0x7f40b080e2e0

[object Object]

), id=$jsid("proxyTarget"), vp=JSVAL_VOID) at /home/ajvincent/aurora/mozilla-aurora/js/src/proxy/Wrapper.cpp:143 #14 0x00007f40e4a3fc68 in js::CrossCompartmentWrapper::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) const (this=0x7f40e7a5b3d8 <js::CrossCompartmentWrapper::singleton>, cx=0x7f40d0246000, wrapper=(JSObject * const) 0x7f40c8494260

[object Proxy]

, receiver=$jsval((JSObject *) 0x7f40c8494260

[object Proxy]

), id=$jsid("proxyTarget"), vp=JSVAL_VOID) at /home/ajvincent/aurora/mozilla-aurora/js/src/proxy/CrossCompartmentWrapper.cpp:205 #15 0x00007f40e4a456d0 in js::Proxy::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) (cx=0x7f40d0246000, proxy=(JSObject * const) 0x7f40c8494260

[object Proxy]

, receiver_=$jsval((JSObject *) 0x7f40c8494260

[object Proxy]

), id=$jsid("proxyTarget"), vp=JSVAL_VOID) at /home/ajvincent/aurora/mozilla-aurora/js/src/proxy/Proxy.cpp:310 #16 0x00007f40e4a471f5 in js::proxy_GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) (cx=0x7f40d0246000, obj=(JSObject * const) 0x7f40c8494260

[object Proxy]

, receiver=$jsval((JSObject *) 0x7f40c8494260

[object Proxy]

), id=$jsid("proxyTarget"), vp=JSVAL_VOID) at /home/ajvincent/aurora/mozilla-aurora/js/src/proxy/Proxy.cpp:583 #17 0x00007f40e43c695c in js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) (cx=0x7f40d0246000, obj=(JSObject * const) 0x7f40c8494260

[object Proxy]

, receiver=$jsval((JSObject *) 0x7f40c8494260

[object Proxy]

), id=$jsid("proxyTarget"), vp=JSVAL_VOID) at /home/ajvincent/aurora/mozilla-aurora/js/src/vm/NativeObject.h:1477 #18 0x00007f40e43c68b5 in js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, js::PropertyName*, JS::MutableHandle<JS::Value>) (cx=0x7f40d0246000, obj=(JSObject * const) 0x7f40c8494260

[object Proxy]

, receiver=$jsval((JSObject *) 0x7f40c8494260

[object Proxy]

), name="proxyTarget", vp=JSVAL_VOID) at /home/ajvincent/aurora/mozilla-aurora/js/src/jsobj.h:836 #19 0x00007f40e4b86320 in js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) (cx=0x7f40d0246000, v=$jsval((JSObject *) 0x7f40c8494260

[object Proxy]

), name="proxyTarget", vp=JSVAL_VOID) at /home/ajvincent/aurora/mozilla-aurora/js/src/vm/Interpreter.cpp:4161 #20 0x00007f40e4798012 in js::jit::ComputeGetPropResult(JSContext*, js::jit::BaselineFrame*, JSOp, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>, JS::MutableHandle<JS::Value>) (cx=0x7f40d0246000, frame=0x7ffc8812cfc8, op=JSOP_GETPROP, name="proxyTarget", val=$jsval((JSObject *) 0x7f40c8494260

[object Proxy]

), res=JSVAL_VOID) at /home/ajvincent/aurora/mozilla-aurora/js/src/jit/SharedIC.cpp:2664 #21 0x00007f40e478010f in js::jit::DoGetPropFallback(JSContext*, void*, js::jit::ICGetProp_Fallback*, JS::MutableHandle<JS::Value>, JS::MutableHandle<JS::Value>) (cx=0x7f40d0246000, payload=0x7ffc8812cfc8, stub_=0x7f40b69a4540, val=$jsval((JSObject *) 0x7f40c8494260

[object Proxy]

), res=JSVAL_VOID) at /home/ajvincent/aurora/mozilla-aurora/js/src/jit/SharedIC.cpp:2744 #22 0x00007f40f47e4c4d in ()

Attachments

(1 file)

proxyDebugTest.html 8 years ago Alex Vincent [:WeirdAl] 436 bytes, text/html		Details

Alex Vincent [:WeirdAl]

Reporter

Description

•

8 years ago

Attached file proxyDebugTest.html — Details

Steps to reproduce:
(1) Open the attached HTML page, and then the Devtools Debugger alongside it.
(2) Place a breakpoint on line 15 of the HTML page.
(3) With the debugger open, click on the button that says "Click here".
(4) You should find yourself stopped on line 15.
(5) Click the "Step in" button in the debugger, trying to go to the next line.

I was able to reproduce the crash in FF50 Aurora from today's code, but not in FF48 as released on Fedora Linux.  I also saw this crash on MacOSX 10, so it's not platform specific.

Alex Vincent [:WeirdAl]

Reporter

Comment 1

•

8 years ago

[Tracking Requested - why for this release]:
It appears to be fixed in today's mozilla-central (FF51) code.  So it might be a simple matter of finding the right patch and uplifting it to aurora.

status-firefox50: --- → affected

status-firefox51: --- → unaffected

tracking-firefox50: --- → ?

OS: Unspecified → All

Alex Vincent [:WeirdAl]

Reporter

Comment 2

•

8 years ago

mach mozregression suggests
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=efe097e5399aff7e926471411cbf9f102753af1f&tochange=c9879bf9369e8410c0e44d8ca35565b76c99e7e4

https://hg.mozilla.org/integration/mozilla-inbound/rev/de2206532859 from bug 1291011 is almost certainly where this fix came from.

Alex Vincent [:WeirdAl]

Reporter

Updated

•

8 years ago

Status: NEW → RESOLVED

Closed: 8 years ago

Resolution: --- → DUPLICATE

Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)

Comment 4

•

8 years ago

No need to track this one, the fix from the other bug 1291011 is approved for uplift to Aurora50.

tracking-firefox50: ? → -

Andrew Overholt [:overholt]

Comment 5

•

8 years ago

Removing affected per comment 4.

status-firefox50: affected → ---

You need to log in before you can comment on or make changes to this bug.

Bugzilla

Quick Search

Crash in js::Debugger::wrapDebuggeeObject after a Proxy is revoked

Categories

(Core :: JavaScript Engine, defect)

Tracking

()

People

(Reporter: WeirdAl, Unassigned)

References

Details

(4 keywords)

Crash Data

Security

(public)

User Story

Attachments

(1 file)

Description

Comment 1

Comment 2

Updated

Comment 4

Comment 5

Attachment

General

Description

File Name

Content Type