1470890 - MOZ_RELEASE_ASSERT in deserializing object ids in JS IPC under fuzzing

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Alex Gaynor [:Alex_Gaynor]]

+++ This bug was initially created as a clone of Bug #1470181 +++

This is not a security issue, but it is a blocker to the efficiency of fuzzing:

Assertion failure: id.isSome(), at /builds/worker/workspace/build/src/js/ipc/WrapperOwner.cpp:1236

(Full stack not available because reasons)

Comment 1

[Phabricator Automation]

Attachment: Bug 1470890 - handle deserialization failure gracefully in JS IPC; r?evilpie

This primarily affects the efficiency of fuzzing.

Comment 2

[Phabricator Automation]

Comment on attachment 8987493 [details]
Bug 1470890 - handle deserialization failure gracefully in JS IPC; r?evilpie

Tom Schuster [:evilpie] has approved the revision.

https://phabricator.services.mozilla.com/D1797

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/f4aac816ce53
handle deserialization failure gracefully in JS IPC; r=evilpie

Comment 4

[Tiberius Oros[:tiberius_oros]]

https://hg.mozilla.org/mozilla-central/rev/f4aac816ce53

Comment 5

[Pascal Chevrel:pascalc]

Alex, is that something you intend to uplift to beta or can we let it ride the trains and update the tracking flags accordingly. Thanks

Comment 6

[Alex Gaynor [:Alex_Gaynor]]

I don't believe there's any need to uplift this; my expectation is that this would only ever be hit under the fuzzer.

Comment 7

[Pascal Chevrel:pascalc]

Thank you alex, setting to wontfix for firefox62 then!