1530672 - Crash in [@ js::UncheckedUnwrapWithoutExpose]

Status: RESOLVED DUPLICATE of bug 1530364

(Core :: JavaScript Engine, defect)

Description

[Marcia Knous [:marcia]]

This bug is for crash report bp-b8fdb95d-61e4-412a-8511-b82aa0190226.

Seen while looking at nightly crash stats: https://bit.ly/2GMNphD, and picked up in the crash spike report. Crashes started spiking slightly on 67 nightly using Build 20190223041557. There are crashes on 65.0.1, but the nightly volume is the same as release volume.

Windows and Android are affected, and the crash reason for Windows crashes is all the same: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 xul.dll js::UncheckedUnwrapWithoutExpose js/src/proxy/Wrapper.cpp:323
1 xul.dll bool js::WeakMap<js::HeapPtr<JSObject*>, js::HeapPtr<JSObject*> >::keyNeedsMark js/src/gc/WeakMap-inl.h:184
2 xul.dll bool js::WeakMap<js::HeapPtr<JSObject*>, js::HeapPtr<JSObject*> >::markIteratively js/src/gc/WeakMap-inl.h:153
3 xul.dll xpc::TraceXPCGlobal js/xpconnect/src/nsXPConnect.cpp:421
4 xul.dll js::GCMarker::processMarkStackTop js/src/gc/Marking.cpp:1796
5 xul.dll js::GCMarker::markUntilBudgetExhausted js/src/gc/Marking.cpp:1598
6 xul.dll js::gc::GCRuntime::incrementalSlice js/src/gc/GC.cpp:6977
7 xul.dll js::gc::GCRuntime::gcCycle js/src/gc/GC.cpp:7373
8 xul.dll js::gc::GCRuntime::collect js/src/gc/GC.cpp:7543
9 xul.dll JS::IncrementalGCSlice js/src/gc/GC.cpp:8491

Comment 1

[Jon Coppeard (:jonco)]

Looks like a null pointer deref while trying to get the delegate. Do we allow weakmap keys to be null? It seems we assume they are not but I can't see anything stopping you from adding one. Filed bug 1531035 to address this.

Comment 2

[Randell Jesup [:jesup] (needinfo me)]

Lots of these crashes are wildptrs, and at least one is a clear UAF in 65: https://crash-stats.mozilla.com/report/index/fffc06b4-11dc-4f26-b837-5a16b0190210
Low volume overall; small bump in 67

Comment 4

[Liz Henry (:lizzard)]

Looks like this was fixed in 67 beta.

Comment 5

[Calixte Denizet (:calixte)]

This crash signature reappeared recently in nightly 69 and it could be related to bug 1167452 fix.
:sfink, could you have a look please?

Comment 6

[Calixte Denizet (:calixte)]

My bad, I missed that the bug is closed.