Assertion failure: deleted, at js/src/shell/js.cpp:1100 with Promise

RESOLVED FIXED in Firefox 66

Status

()

defect
--
critical
RESOLVED FIXED
4 months ago
4 months ago

People

(Reporter: gkw, Assigned: arai)

Tracking

(Blocks 2 bugs, 4 keywords)

Trunk
mozilla66
x86_64
Linux
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox-esr60 unaffected, firefox64 unaffected, firefox65 unaffected, firefox66 fixed)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(2 attachments)

Reporter

Description

4 months ago

The following testcase crashes on mozilla-central revision 6317367156dd (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

// jsfunfuzz-generated
z = newGlobal();
// Adapted from randomly chosen test: js/src/tests/test262/language/expressions/async-generator/named-yield-star-getiter-sync-returns-undefined-throw.js
evalcx("(async function() { l })()", z);
// jsfunfuzz-generated
Promise.prototype.then = z.Promise.prototype.then;
// Adapted from randomly chosen test: js/src/tests/test262/language/statements/async-generator/yield-star-next-not-callable-object-throw.js
async function* f() { n };
f().next().then();

Backtrace:

#0 TrackUnhandledRejections (cx=<optimized out>, state=JS::PromiseRejectionHandlingState::Handled, promise=...) at js/src/shell/js.cpp:1100
#1 ForwardingPromiseRejectionTrackerCallback (cx=0x7f636c718000, promise=..., state=JS::PromiseRejectionHandlingState::Handled, data=<optimized out>) at js/src/shell/js.cpp:1112
#2 0x000055944a096919 in PerformPromiseThenWithReaction (cx=0x7f636c718000, promise=..., reaction=...) at js/src/builtin/Promise.cpp:4274
#3 0x000055944a07bed3 in PerformPromiseThen (cx=0x7f636c718000, promise=..., onFulfilled_=..., onRejected_=..., resultCapability=...) at js/src/builtin/Promise.cpp:4212
#4 0x000055944a07dc68 in js::OriginalPromiseThen (cx=0x7f636c718000, promiseObj=..., onFulfilled=..., onRejected=..., dependent=..., createDependent=js::CreateDependentPromise::Always) at js/src/builtin/Promise.cpp:3393
#5 0x000055944a0825a4 in Promise_then_impl (cx=0x7f636c718000, promiseVal=..., onFulfilled=..., onRejected=..., rval=..., rvalUsed=<optimized out>) at js/src/builtin/Promise.cpp:4157
/snip

For detailed crash information, see attachment.

The assertion failure name is scary ("deleted") so setting s-s as a start.

Reporter

Comment 2

4 months ago

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/c9f108854caa
user: Tooru Fujisawa
date: Tue Jan 08 02:34:57 2019 +0000
summary: Bug 1517868 - Report unhandled rejections in JS shell. r=jorendorff

Arai-san, is bug 1517868 a likely regressor?

Blocks: 1517868
Flags: needinfo?(arai.unmht)
Assignee

Comment 3

4 months ago

thanks.

this is shell-only and also not a security issue.
just that the JS shell doesn't track promise rejection properly.
(it doesn't wrap promise object on correct condition)

feel free to open.

I'll post patch shortly.

Flags: needinfo?(arai.unmht)
Reporter

Comment 5

4 months ago

Opening up as per comment 3.

Group: javascript-core-security
Attachment #9035902 - Attachment description: Bug 1519322 - Wrap unhandled/handled promise properly in JS shell promise rejection tracker. r?jorendorff → Bug 1519322 - Wrap unhandled/handled promise properly in JS shell promise rejection tracker. r=jorendorff

Comment 6

4 months ago
Pushed by arai_a@mac.com:
https://hg.mozilla.org/integration/autoland/rev/0279e3d8b2f1
Wrap unhandled/handled promise properly in JS shell promise rejection tracker. r=jorendorff

Comment 7

4 months ago
bugherder
Status: NEW → RESOLVED
Last Resolved: 4 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla66
Assignee: nobody → arai.unmht
You need to log in before you can comment on or make changes to this bug.