1225471 - Crash [@ GetProperty] with Debugger and ES6 Classes

Status: RESOLVED DUPLICATE of bug 1232685

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision bc74dbdea094 (build with --enable-optimize --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --disable-debug, run with --fuzzing-safe --no-threads):

var dbg = newGlobal().Debugger(this);
dbg.onExceptionUnwind = function () {
  return { return:"sproon" };
};
setJitCompilerOption("baseline.warmup.trigger", 2);
class base {}
class middle extends base {
    constructor() { 1; }
}
class derived extends middle {
    constructor() { super(); }
}
new derived().testChain();



Backtrace:

Program received signal SIGSEGV, Segmentation fault.
GetProperty (vp=..., id=..., receiver=..., obj=..., cx=0x7ffff6907400) at js/src/vm/NativeObject.h:1431
#0  GetProperty (vp=..., id=..., receiver=..., obj=..., cx=0x7ffff6907400) at js/src/vm/NativeObject.h:1431
#1  GetProperty (vp=..., name=0x7ffff7e77b98, receiver=..., obj=..., cx=0x7ffff6907400) at js/src/jsobj.h:834
#2  js::GetProperty (cx=0x7ffff6907400, v=..., name=..., vp=...) at js/src/vm/Interpreter.cpp:3914
#3  0x00000000007e93c3 in GetPropertyOperation (vp=..., lval=..., pc=<optimized out>, script=..., fp=<optimized out>, cx=<optimized out>) at js/src/vm/Interpreter.cpp:167
#4  Interpret (cx=0x7ffff6907400, state=...) at js/src/vm/Interpreter.cpp:2413
#5  0x00000000007f6c1d in js::RunScript (cx=cx@entry=0x7ffff6907400, state=...) at js/src/vm/Interpreter.cpp:341
#6  0x00000000007f864b in js::ExecuteKernel (cx=cx@entry=0x7ffff6907400, script=script@entry=..., scopeChainArg=..., thisv=..., newTargetValue=..., type=type@entry=js::EXECUTE_GLOBAL, evalInFrame=evalInFrame@entry=..., result=<optimized out>, result@entry=0x0) at js/src/vm/Interpreter.cpp:603
#7  0x00000000007f8a09 in js::Execute (cx=cx@entry=0x7ffff6907400, script=script@entry=..., scopeChainArg=..., rval=0x0) at js/src/vm/Interpreter.cpp:640
#8  0x00000000006c968d in ExecuteScript (cx=cx@entry=0x7ffff6907400, scope=..., scope@entry=..., script=script@entry=..., rval=rval@entry=0x0) at js/src/jsapi.cpp:4390
#9  0x00000000006c9785 in JS_ExecuteScript (cx=cx@entry=0x7ffff6907400, scriptArg=scriptArg@entry=...) at js/src/jsapi.cpp:4423
#10 0x00000000004268fa in RunFile (compileOnly=false, file=0x7ffff698c800, filename=<optimized out>, cx=0x7ffff6907400) at js/src/shell/js.cpp:515
#11 Process (cx=cx@entry=0x7ffff6907400, filename=<optimized out>, forceTTY=forceTTY@entry=false, kind=kind@entry=FileScript) at js/src/shell/js.cpp:728
#12 0x000000000043745d in ProcessArgs (op=0x7fffffffdb10, cx=0x7ffff6907400) at js/src/shell/js.cpp:6170
#13 Shell (envp=<optimized out>, op=0x7fffffffdb10, cx=0x7ffff6907400) at js/src/shell/js.cpp:6482
#14 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at js/src/shell/js.cpp:6843
rax	0x60000004d	25769803853
rbx	0x7ffff6907400	140737330050048
rcx	0x7fffffffca80	140737488341632
rdx	0x7fffffffca60	140737488341600
rsi	0x7fffffffca40	140737488341568
rdi	0x7ffff6907400	140737330050048
rbp	0x7fffffffd390	140737488343952
rsp	0x7fffffffca30	140737488341552
r8	0x7ffff52250b8	140737306054840
r9	0x7ffff5286b01	140737306454785
r10	0x7fffffffd380	140737488343936
r11	0x1c	28
r12	0x7ffff52250b8	140737306054840
r13	0x7fffffffd3d0	140737488344016
r14	0x7fffffffd5d0	140737488344528
r15	0x4000000	67108864
rip	0x7e32a6 <js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>)+230>
=> 0x7e32a6 <js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>)+230>:	mov    (%rax),%rax
   0x7e32a9 <js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>)+233>:	mov    0xe0(%rax),%rax


Marking this bug as a fuzzblocker because it looks like security-sensitive but probably isn't due to the debugger being involved.

Comment 1

[Christian Holler (:decoder)]

Needinfo from efaust because the test uses ES6 Classes.

Comment 2

[Fuzzing Team]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 85cf2e720a84).
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/250cd0bf3ce0
user:        Eric Faust
date:        Fri Oct 09 09:33:57 2015 -0700
summary:     Bug 1105463 - Implement default constructors for ES6 class definitions. (r=jorendorff)

This iteration took 216.695 seconds to run.

Comment 3

[Fuzzing Team]

JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/52d7c9292ecf
user:        Jan de Mooij
date:        Sat Nov 21 14:33:13 2015 +0100
summary:     Bug 1132183 - Make |this| a real binding, remove lazy this computation. r=efaust,shu

This iteration took 251.415 seconds to run.

Comment 4

[Eric Faust [:efaust]]

This looks similar to the bug I just put a patch up for in bug 1232685. let's see if it looks related....

Comment 5

[Eric Faust [:efaust]]

Yeah, this is this same bug. It stopped reproducing because the assert went away, but the general class of failures is handled in bug 1232685.