1143706 - CGC tests failing with: Assertion failure: global, at gc/Marking.cpp:1071

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect)

Description

[Jon Coppeard (:jonco) (PTO until 5th Jan)]

Multiple tests failing, for example see:

https://treeherder.mozilla.org/logviewer.html#?job_id=7651574&repo=mozilla-inbound

Comment 1

[Jon Coppeard (:jonco) (PTO until 5th Jan)]

Attachment: base-shape-global

This seems to be due to the parent-removal changes in bug 805052.

ScanBaseShape() allows the global to be null, but BaseShape::markChildren() asserts it is non-null.  The original code allowed both the global and the parent to be null.  Allowing that in markChildren() fixes the issue.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Hrm.  So the original code allowed the parent to be null because some things had null parents.

However, the global of an object should never be null, right?  I guess we could have a shape still alive for some reason after all objects are gone and the compartment global has gone away....  :(

Comment 3

[Andrew McCreight (out until 2026) [:mccr8]]

Hiding for now because this sounds sketchy.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Should probably add some of the testcases from the dups.

Comment 7

[Jon Coppeard (:jonco) (PTO until 5th Jan)]

Added test case and pushed to inbound:

https://hg.mozilla.org/integration/mozilla-inbound/rev/aede36df2ed9

Comment 8

[Jon Coppeard (:jonco) (PTO until 5th Jan)]

(In reply to Not doing reviews right now from comment #2)
> However, the global of an object should never be null, right? 

I did some more investigation, and in this case we are in the process of creating the global but so far we have only created a base shape for its shape, which is rooted on the stack.

Comment 10

[Andrew McCreight (out until 2026) [:mccr8]]

(In reply to Jon Coppeard (:jonco) from comment #8)
> I did some more investigation, and in this case we are in the process of
> creating the global but so far we have only created a base shape for its
> shape, which is rooted on the stack.

So is there no security issue here?  Just a null deref?

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/aede36df2ed9

Comment 12

[Jon Coppeard (:jonco) (PTO until 5th Jan)]

(In reply to Andrew McCreight [:mccr8] from comment #10)
> So is there no security issue here?  Just a null deref?

That's right.