1534902 - Assertion failure: !JS_IsDeadWrapper(origTarget) (We don't want a dead proxy in the wrapper map), at js/src/proxy/CrossCompartmentWrapper.cpp:549

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 9067457d7dcf (build with --enable-debug, run with --fuzzing-safe --no-threads --no-baseline --no-ion --more-compartments):

// Adapted from randomly chosen test: js/src/jit-test/tests/realms/nuking.js
evalcx("var x = newGlobal({ sameCompartmentAs: newGlobal({ newCompartment: true }) });" +
       'x.evaluate("(" + function () { nukeAllCCWs(); } + ")()"); x;',
    newGlobal()
);
// jsfunfuzz-generated
recomputeWrappers();

Backtrace:

#0 js::RemapWrapper (cx=0x7f0d3ea17000, wobjArg=<optimized out>, newTargetArg=<optimized out>) at js/src/proxy/CrossCompartmentWrapper.cpp:548
#1 0x00005611229e4d41 in js::RecomputeWrappers (cx=0x7f0d3ea17000, sourceFilter=..., targetFilter=warning: RTTI symbol not found for class 'RecomputeWrappers(JSContext*, unsigned int, JS::Value*)::SingleOrAllCompartments'
...) at js/src/proxy/CrossCompartmentWrapper.cpp:676
#2 0x0000561122335478 in RecomputeWrappers (cx=0x7f0d3ea17000, argc=<optimized out>, vp=<optimized out>) at js/src/shell/js.cpp:6286
#3 0x00005611223d4285 in CallJSNative (cx=0x7f0d3ea17000, native=0x5611223352d0 <RecomputeWrappers(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/vm/Interpreter.cpp:442
/snip

For detailed crash information, see attachment.

Setting s-s as a start as this involves compartments.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/343c194c1a08
user: Jan de Mooij
date: Wed Sep 19 11:42:45 2018 +0200
summary: Bug 1492406 - Add a recomputeWrappers function to the JS shell for js::RecomputeWrappers. r=jonco

Jan, is bug 1492406 a likely regressor?

Comment 3

[Andrew McCreight [:mccr8]]

Is ObjectValue() on a dead wrapper going to be anything questionable?

Comment 4

[Fuzzing Team]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 5

[Daniel Veditz [:dveditz]]

Is this something web content could even do? New compartment (iframe?) and then nuke wrappers?

Comment 6

[Jan de Mooij [:jandem]]

This should be safe and it actually can't happen in the browser, because XPConnect's PreWrap callback refuses to create a CCW for dead wrappers:

https://searchfox.org/mozilla-central/rev/3d469329a42644b41e66944d8da22d78d8c0f5ec/js/xpconnect/wrappers/WrapperFactory.cpp#181-183

Moving that check into the JS engine fixes this and it has been on my list for a while to get consistent behavior everywhere.

Comment 7

[Jan de Mooij [:jandem]]

Attachment: Bug 1534902 - Move more of XPConnect's PreWrap code into the JS engine. r?kmag!

This ensures the JS shell and browser behave the same way and it's nice for fuzzing.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/116b9cd070f2
Move more of XPConnect's PreWrap code into the JS engine. r=kmag

Comment 9

[Oana Pop-Rus]

https://hg.mozilla.org/mozilla-central/rev/116b9cd070f2