1180047 - Assertion failure: !IsInternalFunctionObject(*obj), at js/src/vm/Debugger.cpp:809

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision f5e3bacfb60e (build with --enable-optimize --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug, run with --fuzzing-safe --thread-count=2):

var g = this;
function arrayContains(arr, expected) {
  Object.defineProperty(obj, "0", {
      get: function() {}
  });
}
var lfGlobal = newGlobal();
for (lfLocal in this) { 
  if (!(lfLocal in lfGlobal)) { 
        lfGlobal[lfLocal] = this[lfLocal]; 
  }
}
lfGlobal.offThreadCompileScript("var dbg = new Debugger(); dbg.addDebuggee(g); dbg.findObjects();");
lfGlobal.runOffThreadScript();



Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x0000000000666ced in js::Debugger::wrapDebuggeeValue (this=this@entry=0x7ffff6960000, cx=cx@entry=0x7ffff691b4e0, vp=vp@entry=...) at js/src/vm/Debugger.cpp:809
#0  0x0000000000666ced in js::Debugger::wrapDebuggeeValue (this=this@entry=0x7ffff6960000, cx=cx@entry=0x7ffff691b4e0, vp=vp@entry=...) at js/src/vm/Debugger.cpp:809
#1  0x000000000066c01d in js::Debugger::findObjects (cx=0x7ffff691b4e0, argc=<optimized out>, vp=<optimized out>) at js/src/vm/Debugger.cpp:3985
#2  0x000000000069a9d2 in js::CallJSNative (cx=0x7ffff691b4e0, native=0x66bb00 <js::Debugger::findObjects(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:235
#3  0x0000000000689d52 in js::Invoke (cx=cx@entry=0x7ffff691b4e0, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:711
#4  0x000000000067c0c2 in Interpret (cx=cx@entry=0x7ffff691b4e0, state=...) at js/src/vm/Interpreter.cpp:2959
#5  0x0000000000689753 in js::RunScript (cx=cx@entry=0x7ffff691b4e0, state=...) at js/src/vm/Interpreter.cpp:655
#6  0x00000000006947f6 in js::ExecuteKernel (cx=cx@entry=0x7ffff691b4e0, script=..., script@entry=..., scopeChainArg=..., thisv=..., newTargetValue=..., type=type@entry=js::EXECUTE_GLOBAL, evalInFrame=evalInFrame@entry=..., result=result@entry=0x7fffffffb718) at js/src/vm/Interpreter.cpp:895
#7  0x0000000000696ae3 in js::Execute (cx=cx@entry=0x7ffff691b4e0, script=script@entry=..., scopeChainArg=..., rval=rval@entry=0x7fffffffb718) at js/src/vm/Interpreter.cpp:929
#8  0x0000000000a88ffb in ExecuteScript (cx=cx@entry=0x7ffff691b4e0, scope=..., script=..., rval=0x7fffffffb718) at js/src/jsapi.cpp:4325
#9  0x0000000000a890ef in JS_ExecuteScript (cx=cx@entry=0x7ffff691b4e0, scriptArg=..., scriptArg@entry=..., rval=..., rval@entry=...) at js/src/jsapi.cpp:4350
#10 0x000000000047d401 in runOffThreadScript (cx=0x7ffff691b4e0, argc=<optimized out>, vp=0x7fffffffb718) at js/src/shell/js.cpp:3483
#11 0x000000000069a9d2 in js::CallJSNative (cx=0x7ffff691b4e0, native=0x47d2f0 <runOffThreadScript(JSContext*, unsigned int, jsval*)>, args=...) at js/src/jscntxtinlines.h:235
#12 0x0000000000689d52 in js::Invoke (cx=cx@entry=0x7ffff691b4e0, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:711
#13 0x000000000068bbc6 in js::Invoke (cx=cx@entry=0x7ffff691b4e0, thisv=..., fval=..., argc=<optimized out>, argv=0x7fffffffc2e8, rval=...) at js/src/vm/Interpreter.cpp:768
#14 0x0000000000b95744 in js::DirectProxyHandler::call (this=this@entry=0x1c21d20 <js::CrossCompartmentWrapper::singleton>, cx=cx@entry=0x7ffff691b4e0, proxy=..., proxy@entry=..., args=...) at js/src/proxy/DirectProxyHandler.cpp:77
#15 0x0000000000b9c352 in js::CrossCompartmentWrapper::call (this=0x1c21d20 <js::CrossCompartmentWrapper::singleton>, cx=0x7ffff691b4e0, wrapper=..., args=...) at js/src/proxy/CrossCompartmentWrapper.cpp:289
#16 0x0000000000ba8b62 in js::Proxy::call (cx=cx@entry=0x7ffff691b4e0, proxy=proxy@entry=..., args=...) at js/src/proxy/Proxy.cpp:391
#17 0x0000000000ba8c1e in js::proxy_Call (cx=0x7ffff691b4e0, argc=<optimized out>, vp=<optimized out>) at js/src/proxy/Proxy.cpp:697
#18 0x000000000069a9d2 in js::CallJSNative (cx=0x7ffff691b4e0, native=0xba8b80 <js::proxy_Call(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:235
#19 0x000000000068a03d in js::Invoke (cx=cx@entry=0x7ffff691b4e0, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:699
#20 0x000000000068bbc6 in js::Invoke (cx=cx@entry=0x7ffff691b4e0, thisv=..., fval=..., argc=argc@entry=0, argv=argv@entry=0x7fffffffc778, rval=..., rval@entry=...) at js/src/vm/Interpreter.cpp:768
#21 0x00000000008ade0a in js::jit::DoCallFallback (cx=0x7ffff691b4e0, frame=0x7fffffffc7a8, stub_=<optimized out>, argc=<optimized out>, vp=0x7fffffffc768, res=...) at js/src/jit/BaselineIC.cpp:9859
#22 0x00007ffff7feebdf in ?? ()
[...]
#32 0x0000000000000000 in ?? ()
rax	0x0	0
rbx	0x7ffff691b4e0	140737330132192
rcx	0x7ffff6ca53cd	140737333842893
rdx	0x0	0
rsi	0x7ffff6f7a9d0	140737336814032
rdi	0x7ffff6f791c0	140737336807872
rbp	0x7fffffff99b0	140737488329136
rsp	0x7fffffff9870	140737488328816
r8	0x7ffff7fe0780	140737354008448
r9	0x6372732f736a2f6c	7165916604736876396
r10	0x7fffffff9630	140737488328240
r11	0x7ffff6c27960	140737333328224
r12	0x7fffffff9a60	140737488329312
r13	0x7ffff6960000	140737330413568
r14	0xffffff01	4294967041
r15	0x7ffff7e74480	140737352516736
rip	0x666ced <js::Debugger::wrapDebuggeeValue(JSContext*, JS::MutableHandle<JS::Value>)+1789>
=> 0x666ced <js::Debugger::wrapDebuggeeValue(JSContext*, JS::MutableHandle<JS::Value>)+1789>:	movl   $0x329,0x0
   0x666cf8 <js::Debugger::wrapDebuggeeValue(JSContext*, JS::MutableHandle<JS::Value>)+1800>:	callq  0x4961f0 <abort()>

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
=== Treeherder Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20150630155644" and the hash "486709a9d6f8".
The "bad" changeset has the timestamp "20150630160449" and the hash "827e17b69b0f".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=486709a9d6f8&tochange=827e17b69b0f

Comment 2

[Jim Blandy :jimb]

Attachment: Debugger.prototype.findObjects should not return objects that must not be exposed to JS.

I have to admit, I don't quite understand why the test case doesn't reduce more. But this does crash without the change to Debugger.cpp.

Comment 3

[Nick Fitzgerald [:fitzgen] [⏰PST; UTC-8]]

Comment on attachment 8630080 [details] [diff] [review]
Debugger.prototype.findObjects should not return objects that must not be exposed to JS.

Review of attachment 8630080 [details] [diff] [review]:
-----------------------------------------------------------------

(In reply to Jim Blandy :jimb from comment #2)
> I have to admit, I don't quite understand why the test case doesn't reduce
> more.

The beauty of fuzzers: it doesn't really matter! We discovered the bug and fixed it :D

Comment 4

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1a1e2a0c86d2

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/1a1e2a0c86d2