1494146 - Assertion failure: !realm->creationOptions().invisibleToDebugger(), at js/src/vm/Debugger.cpp:12644

Status: RESOLVED DUPLICATE of bug 1482215

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 2e3e89c9c68c (build with --enable-debug, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

// Adapted from randomly chosen test: js/src/jit-test/tests/debug/prologueFailure-01.js
f = newGlobal();
f.parent = this;
f.eval("Debugger(parent).onExceptionUnwind=function(){}");
// jsfunfuzz-generated
g = newGlobal({
    sameCompartmentAs: [],
    invisibleToDebugger: true
});
g.offThreadCompileScript();

Backtrace:

#0  0x00005628007f9257 in CheckDebuggeeThingRealm (realm=<optimized out>, invisibleOk=false) at js/src/vm/Debugger.cpp:12644
#1  js::CheckDebuggeeThing (obj=<optimized out>, invisibleOk=false) at js/src/vm/Debugger.cpp:12663
#2  js::DebuggerWeakMap<JSObject*, false>::relookupOrAdd<JS::Handle<JSObject*>, JS::Rooted<js::DebuggerObject*> > (this=0x7fe851564b68, p=..., k=..., v=...) at js/src/vm/Debugger.h:171
#3  0x0000562800781088 in js::DependentAddPtr<js::DebuggerWeakMap<JSObject*, false> >::add<JS::Handle<JSObject*>, JS::Rooted<js::DebuggerObject*> > (this=0x0, cx=<optimized out>, table=..., key=..., value=...) at js/src/gc/HashUtil.h:40
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/d473e8b25db6
user:        Jan de Mooij
date:        Mon Jul 02 18:34:37 2018 +0200
summary:     Bug 1472130 part 2 - Allow creating same-compartment realms in the shell with --fuzzing-safe. r=luke

Jan, is bug 1472130 / are same-compartment realms likely regressors?

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Recent updates to jsfunfuzz found this:

https://github.com/MozillaSecurity/funfuzz/pull/211

Comment 4

[Jan de Mooij [:jandem]]

Jim, didn't you have a patch to rejigger invisibleToDebugger?

Comment 5

[Marion Daly [:mdaly]]

Steve: Can we get a triage on this?

Comment 6

[Steven DeTar [:sdetar]]

I think Jan was waiting on answer to his question from Jimb. i.e. Comment 4.   Jimb is already ni'd on the bug.

Comment 7

[Jan de Mooij [:jandem]]

Also note that this requires same-compartment realms and that's not (yet) enabled in the browser.

Comment 8

[Jim Blandy :jimb]

With bug 1482215 landed, the test case just throws an error, rather than crashing.