1509420 - Assertion failure: this->is<T>(), at js/src/vm/JSObject.h:529 with bindToAsyncStack

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision eeddcefcdad8 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --disable-profiling --enable-debug --enable-optimize, run with --fuzzing-safe --cpu-count=2 --ion-offthread-compile=off):

var g = newGlobal();
g.evaluate("function h() { f(); }");
for ([f, n] of [
  [g.f, 20]
  , [g.h, 5]
]) try {} catch (e) {}
function bindAndExpect(options, expected) {
  return bindToAsyncStack(f, options);
}
bindAndExpect({},)()


Backtrace:

received signal SIGSEGV, Segmentation fault.
JSObject::as<JSFunction> (this=<optimized out>) at js/src/vm/JSObject.h:529
#0  JSObject::as<JSFunction> (this=<optimized out>) at js/src/vm/JSObject.h:529
#1  BoundToAsyncStack (cx=<optimized out>, cx@entry=0x7ffff5f18000, argc=<optimized out>, vp=<optimized out>) at js/src/shell/js.cpp:1145
#2  0x00005555558c7271 in CallJSNative (cx=0x7ffff5f18000, native=0x5555558207f0 <BoundToAsyncStack(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/vm/Interpreter.cpp:468
[...]
#16 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at js/src/shell/js.cpp:11420
rax	0x555557b4f480	93825032057984
rbx	0x7fffffffcc00	140737488342016
rcx	0x7ffff6c1c2dd	140737333281501
rdx	0x0	0
rsi	0x555556a50850	93825014237264
rdi	0x7ffff6eea540	140737336223040
rbp	0x7fffffffc8d0	140737488341200
rsp	0x7fffffffc730	140737488340784
r8	0x7ffff6eeb770	140737336227696
r9	0x7ffff7fe6cc0	140737354034368
r10	0x58	88
r11	0x7ffff6b927a0	140737332717472
r12	0x7ffff5f18000	140737319632896
r13	0x7fffffffc8f0	140737488341232
r14	0x7ffff5f81800	140737320065024
r15	0x7ffff5f81800	140737320065024
rip	0x555555820cf9 <BoundToAsyncStack(JSContext*, unsigned int, JS::Value*)+1289>
=> 0x555555820cf9 <BoundToAsyncStack(JSContext*, unsigned int, JS::Value*)+1289>:	movl   $0x0,0x0
   0x555555820d04 <BoundToAsyncStack(JSContext*, unsigned int, JS::Value*)+1300>:	ud2

Comment 1

[Fuzzing Team]

JSBugMon: Bisection requested, failed due to error (try manually).

Comment 2

[Jan de Mooij [:jandem]]

Probably a regression from bug 1438121 where this shell function was added.

Comment 3

[Jim Blandy :jimb]

I can reproduce this.

Comment 4

[Jim Blandy :jimb]

Reduced test case:

var g = newGlobal();
g.evaluate("function h() { f(); }");
bindToAsyncStack(g.h, {})();

A CCW of a function is callable, but not a JSFunction.

Comment 5

[Jim Blandy :jimb]

Attachment: Bug 1509420: Handle CCWs of functions properly in bindToAsyncStack shell function. r?jorendorff

In js.cpp, BindToAsyncStack used JSObject::isCallable to check the type of its
argument, and then BoundToAsyncStack (the native for the function returned)
assumed that it could call JSObject::as<JSFunction> on that value.

However, there are many things that are isCallable but not is<JSFunction>, two
examples being CCWs and function proxies.

Comment 6

[Jim Blandy :jimb]

Try push:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=060d819e1b9381f51684c9570a964d07af1b5e8a

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/606d75702c5c
Handle CCWs of functions properly in bindToAsyncStack shell function. r=jorendorff

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/606d75702c5c