1245518 - Crash [@ js::ModuleEnvironmentObject::getOwnPropertyDescriptor] with ES6 Modules and Debugger

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 5f9ba76eb3b1 (build with --enable-optimize --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --disable-debug, run with --fuzzing-safe --thread-count=2 --baseline-eager):

evalInFrame = function(global) {
  dbgGlobal = newGlobal();
  dbg = new dbgGlobal.Debugger();
  return function(upCount, code) {
    dbg.addDebuggee(global);
    frame = dbg.getNewestFrame().older;
    frame.eval(code);
  }
}(this);
m = parseModule(`
  function g() this.hours = 0;
  evalInFrame.call(0, 0, "g()")
`);
m.declarationInstantiation();
m.evaluation();



Backtrace:

Program received signal SIGSEGV, Segmentation fault.
js::ModuleEnvironmentObject::getOwnPropertyDescriptor (cx=0x7ffff6907800, obj=..., id=..., desc=...) at js/src/vm/ScopeObject.cpp:626
#0  js::ModuleEnvironmentObject::getOwnPropertyDescriptor (cx=0x7ffff6907800, obj=..., id=..., desc=...) at js/src/vm/ScopeObject.cpp:626
#1  0x0000000000753ab4 in js::GetOwnPropertyDescriptor (cx=cx@entry=0x7ffff6907800, obj=..., obj@entry=..., id=..., id@entry=..., desc=desc@entry=...) at js/src/jsobj.cpp:2567
#2  0x0000000000861e1f in js::SetPropertyByDefining (cx=cx@entry=0x7ffff6907800, id=id@entry=..., v=..., v@entry=..., receiverValue=..., receiverValue@entry=..., result=...) at js/src/vm/NativeObject.cpp:2091
#3  0x0000000000862198 in SetNonexistentProperty (cx=cx@entry=0x7ffff6907800, id=id@entry=..., v=v@entry=..., receiver=receiver@entry=..., qualified=qualified@entry=js::Qualified, result=...) at js/src/vm/NativeObject.cpp:2185
#4  0x0000000000877934 in js::NativeSetProperty (cx=cx@entry=0x7ffff6907800, obj=obj@entry=..., id=id@entry=..., value=..., value@entry=..., receiver=..., receiver@entry=..., qualified=qualified@entry=js::Qualified, result=...) at js/src/vm/NativeObject.cpp:2337
#5  0x00000000008a8711 in js::ModuleEnvironmentObject::setProperty (cx=0x7ffff6907800, obj=..., id=..., v=..., receiver=..., result=...) at js/src/vm/ScopeObject.cpp:618
#6  0x00000000007516a5 in JSObject::nonNativeSetProperty (cx=cx@entry=0x7ffff6907800, obj=obj@entry=..., id=id@entry=..., v=..., v@entry=..., receiver=receiver@entry=..., result=...) at js/src/jsobj.cpp:1046
#7  0x00000000008c70e4 in SetProperty (result=..., receiver=..., v=..., id=..., obj=..., cx=0x7ffff6907800) at js/src/vm/NativeObject.h:1487
#8  (anonymous namespace)::DebugScopeProxy::set (this=<optimized out>, cx=0x7ffff6907800, proxy=..., id=..., v=..., receiver=..., result=...) at js/src/vm/ScopeObject.cpp:2197
#9  0x00000000007a60f5 in js::Proxy::set (cx=0x7ffff6907800, proxy=..., id=..., v=..., receiver_=..., result=...) at js/src/proxy/Proxy.cpp:324
#10 0x00000000007516a5 in JSObject::nonNativeSetProperty (cx=0x7ffff6907800, obj=..., id=..., v=..., receiver=..., result=...) at js/src/jsobj.cpp:1046
#11 0x00000000005232bd in js::jit::DoSetPropFallback (cx=0x7ffff6907800, frame=0x7fffffff9388, stub_=0x7ffff69a6058, lhs=..., rhs=..., res=...) at js/src/jit/BaselineIC.cpp:4706
#12 0x00007ffff7ff0ea4 in ?? ()
[...]
#28 0x0000000000000000 in ?? ()
rax	0x8a3150	9056592
rbx	0x7ffff6907800	140737330051072
rcx	0x7fffffff8bb8	140737488325560
rdx	0x7fffffff9150	140737488326992
rsi	0x7fffffff8b50	140737488325456
rdi	0x7ffff6907800	140737330051072
rbp	0x7ffff6907800	140737330051072
rsp	0x7fffffff8a70	140737488325232
r8	0x7fffffff9150	140737488326992
r9	0x7fffffff9250	140737488327248
r10	0x12	18
r11	0x9033f230	2419323440
r12	0x7fffffff8b50	140737488325456
r13	0x7fffffff8bb8	140737488325560
r14	0x7fffffff8b40	140737488325440
r15	0x7fffffff8ba0	140737488325536
rip	0x8a3154 <js::ModuleEnvironmentObject::getOwnPropertyDescriptor(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::PropertyDescriptor>)+4>
=> 0x8a3154 <js::ModuleEnvironmentObject::getOwnPropertyDescriptor(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::PropertyDescriptor>)+4>:	movl   $0x272,0x0
   0x8a315f <js::ModuleEnvironmentObject::getOwnPropertyDescriptor(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::PropertyDescriptor>)+15>:	callq  0x449fa0 <abort()>

Comment 1

[Fuzzing Team]

JSBugMon: Bisection requested, result:
=== Treeherder Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20150923073515" and the hash "f4233421a0091c7ff9da20e917e026bf60f93c8f".
The "bad" changeset has the timestamp "20150923075616" and the hash "db4c17553be905e5d4e3106718f61f7421b91994".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=f4233421a0091c7ff9da20e917e026bf60f93c8f&tochange=db4c17553be905e5d4e3106718f61f7421b91994

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Going to assume that this is related to bug 930414 as per comment 1.

Comment 3

[Jon Coppeard (:jonco)]

Attachment: bug1245518-module-env-crash

I guess I do need to implement that hook after all.

I split out NativeGetOwnPropertyDescriptor() from GetOwnPropertyDescriptor() along the same lines as e.g. DefineProperty() which checks for one of these hooks before calling NativeDefineProperty().

Comment 4

[Shu-yu Guo [:shu]]

Comment on attachment 8715726 [details] [diff] [review]
bug1245518-module-env-crash

Review of attachment 8715726 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/vm/NativeObject.cpp
@@ +1719,5 @@
> +    desc.object().set(obj);
> +    desc.assertComplete();
> +    return true;
> +}
> +

Add another newline here. Convention of this file.

::: js/src/vm/NativeObject.h
@@ -1394,5 @@
>  
>  extern bool
>  NativeDeleteProperty(JSContext* cx, HandleNativeObject obj, HandleId id, ObjectOpResult& result);
>  
> -

Nit: extra newline is intentional, don't remove

Comment 5

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c633b6d3613b

Comment 6

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/c633b6d3613b