1524707 - Assertion failure: getSlotRef(EVAL).isUndefined(), at js/src/vm/GlobalObject.h:144

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 024bef408a88 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

Object.setPrototypeOf(evalcx("lazy"), {});

Backtrace:

#0 js::GlobalObject::setOriginalEval (this=0x13525a18b060, evalobj=<optimized out>) at js/src/vm/GlobalObject.h:144
#1 FinishObjectClassInit (cx=0x7fe5d2017000, ctor=..., proto=...) at js/src/builtin/Object.cpp:2154
#2 0x000055723c2e5cb4 in js::GlobalObject::resolveConstructor (cx=0x7fe5d2017000, global=..., key=JSProto_Object, mode=<optimized out>) at js/src/vm/GlobalObject.cpp:281
#3 0x000055723c359521 in js::GlobalObject::ensureConstructor (cx=<optimized out>, key=JSProto_Object, global=...) at js/src/vm/GlobalObject.h:169
#4 js::SetPrototype (cx=0x7fe5d2017000, obj=..., proto=..., result=...) at js/src/vm/JSObject.cpp:2803
#5 0x000055723c33eec2 in js::SetPrototype (cx=0x7fe5d2017000, obj=..., proto=...) at js/src/vm/JSObject.cpp:2846
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/6ec84030fb70
user: Jan de Mooij
date: Tue Jan 15 20:03:43 2019 +0000
summary: Bug 1520093 - Make evalcx work with same-compartment realms. r=jorendorff

Jan, is bug 1520093 a likely regressor?

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Bug 1524707 - Ensure we're in the global's realm in GlobalObject::resolveConstructor. r?jorendorff!

In js::SetPrototype we call GlobalObject::ensureConstructor. I think this is
only a problem for evalcx because other globals have an immutable prototype
chain.

Comment 4

[Fuzzing Team]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0eb6b611ee2b
Ensure we're in the global's realm in GlobalObject::resolveConstructor. r=jorendorff

Comment 6

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/0eb6b611ee2b

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Is there a user impact which justifies backport consideration here?

Comment 8

[Jan de Mooij [:jandem]]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #7)

Is there a user impact which justifies backport consideration here?

Probably not; this particular instance is definitely shell-only. However it's hard to say for sure and the fix is very safe, so I'll request uplift just in case.

Comment 9

[Jan de Mooij [:jandem]]

Comment on attachment 9041184 [details]
Bug 1524707 - Ensure we're in the global's realm in GlobalObject::resolveConstructor. r?jorendorff!

Beta/Release Uplift Approval Request

Feature/Bug causing the regression

same-compartment-realms

User impact if declined

Maybe correctness issues. It's hard to say whether the browser is actually affected.

Is this code covered by automated tests?

Yes

Has the fix been verified in Nightly?

Yes

Needs manual test from QE?

No

If yes, steps to reproduce

List of other uplifts needed

None

Risk to taking this patch

Low

Why is the change risky/not risky? (and alternatives if risky)

Very safe/small fix.

String changes made/needed

None

Comment 10

[Liz Henry (:lizzard) (relman/hg->git project)]

Comment on attachment 9041184 [details]
Bug 1524707 - Ensure we're in the global's realm in GlobalObject::resolveConstructor. r?jorendorff!

Fix for potential crash found by fuzzing.
Let's uplift for beta 8.

Comment 11

[Dorel Luca [:dluca]]

https://hg.mozilla.org/releases/mozilla-beta/rev/3e57fe219beb