1385843 - Crash [@ JSFunction::isDerivedClassConstructor] or Assertion failure: fun, at vm/Interpreter.cpp:5203 with Debugger

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 26516ba27081 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-stdcxx-compat --disable-profiling --disable-debug --enable-optimize, run with --fuzzing-safe):

var g = newGlobal();
g.parent = this;
g.eval("(" + function() {
    var dbg = new Debugger(parent);
    dbg.onExceptionUnwind = function(frame) {
        frame.eval("this");
    };
} + ")()");
new class extends class {} {
    constructor() {}
}();



Backtrace:

 received signal SIGSEGV, Segmentation fault.
JSFunction::isDerivedClassConstructor (this=this@entry=0x0) at js/src/jsfun.cpp:1334
#0  JSFunction::isDerivedClassConstructor (this=this@entry=0x0) at js/src/jsfun.cpp:1334
#1  0x00000000004fb05c in js::ThrowUninitializedThis (cx=0x7ffff6924000, frame=...) at js/src/vm/Interpreter.cpp:5206
#2  0x000000000050a8ce in Interpret (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:2755
#3  0x000000000050aca6 in js::RunScript (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:409
#4  0x000000000050cec8 in js::ExecuteKernel (cx=cx@entry=0x7ffff6924000, script=..., script@entry=..., envChainArg=..., newTargetValue=..., evalInFrame=..., result=result@entry=0x7fffffff93f0) at js/src/vm/Interpreter.cpp:698
#5  0x000000000094dbec in EvaluateInEnv (pc=0x0, rval=..., lineno=1, filename=0xe304ad "debugger eval code", chars=..., frame=..., env=..., cx=0x7ffff6924000) at js/src/vm/Debugger.cpp:8218
#6  DebuggerGenericEval (cx=cx@entry=0x7ffff6924000, chars=..., bindings=..., bindings@entry=..., options=..., status=@0x7fffffff9bdc: JSTRAP_ERROR, value=..., dbg=0x7ffff6938000, envArg=..., iter=0x7fffffff9730) at js/src/vm/Debugger.cpp:8305
#7  0x000000000094e7aa in js::DebuggerFrame::eval (cx=cx@entry=0x7ffff6924000, frame=..., frame@entry=..., chars=..., bindings=bindings@entry=..., options=..., status=@0x7fffffff9bdc: JSTRAP_ERROR, value=...) at js/src/vm/Debugger.cpp:8329
#8  0x000000000094ea23 in js::DebuggerFrame::evalMethod (cx=0x7ffff6924000, argc=1, vp=0x7ffff43f6288) at js/src/vm/Debugger.cpp:8986
#9  0x000000000050afce in js::CallJSNative (args=..., native=0x94e7c0 <js::DebuggerFrame::evalMethod(JSContext*, unsigned int, JS::Value*)>, cx=0x7ffff6924000) at js/src/jscntxtinlines.h:293
#10 js::InternalCallOrConstruct (cx=0x7ffff6924000, args=..., construct=<optimized out>) at js/src/vm/Interpreter.cpp:469
#11 0x00000000004fd9f8 in js::CallFromStack (args=..., cx=<optimized out>) at js/src/vm/Interpreter.cpp:520
#12 Interpret (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:3064
#13 0x000000000050aca6 in js::RunScript (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:409
#14 0x000000000050b239 in js::InternalCallOrConstruct (cx=cx@entry=0x7ffff6924000, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:487
#15 0x000000000050bc42 in InternalCall (args=..., cx=0x7ffff6924000) at js/src/vm/Interpreter.cpp:514
#16 js::Call (cx=cx@entry=0x7ffff6924000, fval=..., fval@entry=..., thisv=..., thisv@entry=..., args=..., rval=..., rval@entry=...) at js/src/vm/Interpreter.cpp:533
#17 0x0000000000956d25 in js::Call (rval=..., arg1=..., arg0=..., thisObj=<optimized out>, fval=..., cx=0x7ffff6924000) at js/src/vm/Interpreter.h:133
#18 js::Debugger::fireExceptionUnwind (this=this@entry=0x7ffff6938000, cx=cx@entry=0x7ffff6924000, vp=..., vp@entry=...) at js/src/vm/Debugger.cpp:1812
#19 0x00000000009570ab in js::Debugger::<lambda(js::Debugger*)>::operator() (dbg=0x7ffff6938000, __closure=<synthetic pointer>) at js/src/vm/Debugger.cpp:1085
#20 js::Debugger::dispatchHook<js::Debugger::slowPathOnExceptionUnwind(JSContext*, js::AbstractFramePtr)::<lambda(js::Debugger*)>, js::Debugger::slowPathOnExceptionUnwind(JSContext*, js::AbstractFramePtr)::<lambda(js::Debugger*)> > (fireHook=..., cx=0x7ffff6924000, hookIsEnabled=...) at js/src/vm/Debugger.cpp:1925
#21 js::Debugger::slowPathOnExceptionUnwind (cx=0x7ffff6924000, frame=...) at js/src/vm/Debugger.cpp:1086
#22 0x00000000004fdfa7 in js::Debugger::onExceptionUnwind (frame=..., cx=<optimized out>) at js/src/vm/Debugger-inl.h:66
#23 HandleError (regs=..., cx=<optimized out>) at js/src/vm/Interpreter.cpp:1349
#24 Interpret (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:4293
#25 0x000000000050aca6 in js::RunScript (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:409
#26 0x000000000050cec8 in js::ExecuteKernel (cx=cx@entry=0x7ffff6924000, script=..., script@entry=..., envChainArg=..., newTargetValue=..., evalInFrame=..., result=result@entry=0x7fffffffb540) at js/src/vm/Interpreter.cpp:698
#27 0x000000000094dbec in EvaluateInEnv (pc=0x0, rval=..., lineno=1, filename=0xe304ad "debugger eval code", chars=..., frame=..., env=..., cx=0x7ffff6924000) at js/src/vm/Debugger.cpp:8218
#28 DebuggerGenericEval (cx=cx@entry=0x7ffff6924000, chars=..., bindings=..., bindings@entry=..., options=..., status=@0x7fffffffbd2c: JSTRAP_ERROR, value=..., dbg=0x7ffff6938000, envArg=..., iter=0x7fffffffb880) at js/src/vm/Debugger.cpp:8305
#29 0x000000000094e7aa in js::DebuggerFrame::eval (cx=cx@entry=0x7ffff6924000, frame=..., frame@entry=..., chars=..., bindings=bindings@entry=..., options=..., status=@0x7fffffffbd2c: JSTRAP_ERROR, value=...) at js/src/vm/Debugger.cpp:8329
#30 0x000000000094ea23 in js::DebuggerFrame::evalMethod (cx=0x7ffff6924000, argc=1, vp=0x7ffff43f6190) at js/src/vm/Debugger.cpp:8986
#31 0x000000000050afce in js::CallJSNative (args=..., native=0x94e7c0 <js::DebuggerFrame::evalMethod(JSContext*, unsigned int, JS::Value*)>, cx=0x7ffff6924000) at js/src/jscntxtinlines.h:293
#32 js::InternalCallOrConstruct (cx=0x7ffff6924000, args=..., construct=<optimized out>) at js/src/vm/Interpreter.cpp:469
#33 0x00000000004fd9f8 in js::CallFromStack (args=..., cx=<optimized out>) at js/src/vm/Interpreter.cpp:520
#34 Interpret (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:3064
#35 0x000000000050aca6 in js::RunScript (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:409
#36 0x000000000050b239 in js::InternalCallOrConstruct (cx=cx@entry=0x7ffff6924000, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:487
#37 0x000000000050bc42 in InternalCall (args=..., cx=0x7ffff6924000) at js/src/vm/Interpreter.cpp:514
#38 js::Call (cx=cx@entry=0x7ffff6924000, fval=..., fval@entry=..., thisv=..., thisv@entry=..., args=..., rval=..., rval@entry=...) at js/src/vm/Interpreter.cpp:533
#39 0x0000000000956d25 in js::Call (rval=..., arg1=..., arg0=..., thisObj=<optimized out>, fval=..., cx=0x7ffff6924000) at js/src/vm/Interpreter.h:133
#40 js::Debugger::fireExceptionUnwind (this=this@entry=0x7ffff6938000, cx=cx@entry=0x7ffff6924000, vp=..., vp@entry=...) at js/src/vm/Debugger.cpp:1812
#41 0x00000000009570ab in js::Debugger::<lambda(js::Debugger*)>::operator() (dbg=0x7ffff6938000, __closure=<synthetic pointer>) at js/src/vm/Debugger.cpp:1085
#42 js::Debugger::dispatchHook<js::Debugger::slowPathOnExceptionUnwind(JSContext*, js::AbstractFramePtr)::<lambda(js::Debugger*)>, js::Debugger::slowPathOnExceptionUnwind(JSContext*, js::AbstractFramePtr)::<lambda(js::Debugger*)> > (fireHook=..., cx=0x7ffff6924000, hookIsEnabled=...) at js/src/vm/Debugger.cpp:1925
#43 js::Debugger::slowPathOnExceptionUnwind (cx=0x7ffff6924000, frame=...) at js/src/vm/Debugger.cpp:1086
#44 0x00000000004fdfa7 in js::Debugger::onExceptionUnwind (frame=..., cx=<optimized out>) at js/src/vm/Debugger-inl.h:66
#45 HandleError (regs=..., cx=<optimized out>) at js/src/vm/Interpreter.cpp:1349
#46 Interpret (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:4293
[...]
#56 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at js/src/shell/js.cpp:8559
rax	0x0	0
rbx	0x7ffff6924000	140737330167808
rcx	0x0	0
rdx	0x7ffff6924000	140737330167808
rsi	0x7ffff430aca0	140737290218656
rdi	0x0	0
rbp	0x7fffffff92c0	140737488327360
rsp	0x7fffffff8b68	140737488325480
r8	0x3b	59
r9	0x7ffff420d000	140737289179136
r10	0x1d	29
r11	0x0	0
r12	0x7ffff6924020	140737330167840
r13	0x7fffffff8fc0	140737488326592
r14	0x1ad4720	28133152
r15	0x7ffff6924000	140737330167808
rip	0x820fb0 <JSFunction::isDerivedClassConstructor()>
=> 0x820fb0 <JSFunction::isDerivedClassConstructor()>:	movzwl 0x22(%rdi),%eax
   0x820fb4 <JSFunction::isDerivedClassConstructor()+4>:	test   $0x2,%ah

Comment 1

[Fuzzing Team]

JSBugMon: Bisection requested, result:
Due to skipped revisions, the first bad revision could be any of:
changeset:   https://hg.mozilla.org/mozilla-central/rev/cb6fc6d38f8d
user:        Shu-yu Guo
date:        Thu Aug 25 01:28:47 2016 -0700
summary:     Bug 1263355 - Rewrite the frontend: bindings. (r=jorendorff,Waldo)

changeset:   https://hg.mozilla.org/mozilla-central/rev/18bec78f348e
user:        Shu-yu Guo
date:        Thu Aug 25 01:28:47 2016 -0700
summary:     Bug 1263355 - Report memory metrics for Scopes. (r=njn)

This iteration took 0.818 seconds to run.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Not sure who to needinfo? here, falling back to :jorendorff and :jandem.

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Patch

After shu left, not sure who's a good reviewer for this.

The bug is in ThrowUninitializedThis. For debugger eval frames we look at the evalInFramePrev frame's scope (this is the frame in which the debugger is evaluating an expression).

This works fine, except when we have a nested eval-in-frame. The fix is just to loop over evalInFramePrev until we get to a non-debugger-eval frame.

Comment 4

[Ted Campbell [:tcampbell]]

Comment on attachment 8904564 [details] [diff] [review]
Patch

Review of attachment 8904564 [details] [diff] [review]:
-----------------------------------------------------------------

Seems reasonable. We should double-check that https://searchfox.org/mozilla-central/rev/4d8e389498a08668cce9ebf6232cc96be178c3e4/js/src/vm/Stack.cpp#802 doesn't have same problem though.

Comment 5

[Jason Orendorff [:jorendorff]]

I bet this fixes bug 1385844 as well.

Comment 6

[Jan de Mooij [:jandem]]

Oops, I'll get this landed.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/6a54320bbbc0
Handle nested eval-in-frame better in ThrowUninitializedThis. r=tcampbell

Comment 8

[Jan de Mooij [:jandem]]

(In reply to Ted Campbell [:tcampbell] from comment #4)
> Seems reasonable. We should double-check that
> https://searchfox.org/mozilla-central/rev/
> 4d8e389498a08668cce9ebf6232cc96be178c3e4/js/src/vm/Stack.cpp#802 doesn't
> have same problem though.

The code there is okay AFAICS.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/6a54320bbbc0