1559062 - LeakSanitizer: [@ js::DebuggerFrame::onStepSetter] with Debugger

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 4a63f0a3a1f2 (build with --enable-address-sanitizer, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

// Adapted from randomly chosen test: js/src/jit-test/tests/debug/testEarlyReturnOnCall.js
var g = newGlobal({
    newCompartment: true
});
g.eval("function f(){}");
var dbg = new Debugger(g);
dbg.onEnterFrame = function(frame) {
    frame.onStep = function() {}
}
g.f();

Backtrace:

Direct leak of 16 byte(s) in 1 object(s) allocated from:
#0 0x55602eb89397 in __interceptor_malloc (/home/ubuntu/shell-cache/js-64-asan-linux-x86_64-4a63f0a3a1f2/js-64-asan-linux-x86_64-4a63f0a3a1f2+0x1461397)
#1 0x55602f0fdcbb in js_arena_malloc(unsigned long, unsigned long) /home/ubuntu/shell-cache/js-64-asan-linux-x86_64-4a63f0a3a1f2/objdir-js/dist/include/js/Utility.h:368:10
#2 0x55602f0fdcbb in unsigned char* js_pod_arena_malloc<unsigned char>(unsigned long, unsigned long) /home/ubuntu/shell-cache/js-64-asan-linux-x86_64-4a63f0a3a1f2/objdir-js/dist/include/js/Utility.h:573
#3 0x55602f0fdcbb in unsigned char* js::MallocProvider<JSContext>::maybe_pod_malloc<unsigned char>(unsigned long, unsigned long) js/src/vm/MallocProvider.h:53
#4 0x55602f0fdcbb in unsigned char* js::MallocProvider<JSContext>::pod_malloc<unsigned char>(unsigned long, unsigned long) js/src/vm/MallocProvider.h:90
#5 0x55602f0fdcbb in js::ScriptedOnStepHandler* js::MallocProvider<JSContext>::new_<js::ScriptedOnStepHandler, JSObject*>(JSObject*&&) js/src/vm/MallocProvider.h:196
#6 0x55602f0fdcbb in js::DebuggerFrame::onStepSetter(JSContext*, unsigned int, JS::Value*) js/src/vm/Debugger.cpp:10164
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/411716c0fa8e
user: Jim Blandy
date: Mon Jun 10 20:17:00 2019 +0000
summary: Bug 1551176: Drop a generator script's stepper count when its Debugger.Frame is GC'd. r=jorendorff

Jim, is bug 1551176 a likely regressor?

Comment 3

[Jim Blandy :jimb]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #2)

Jim, is bug 1551176 a likely regressor?

Yes. Obvious fix, taking.

Comment 4

[Jim Blandy :jimb]

Attachment: Bug 1559062: Don't leak onStep handlers. r?jorendorff

When I wrote my prior patch, I forgot that a DebuggerFrame object's
ONSTEP_HANDLER_SLOT holds, not a JavaScript object, but a private value pointing
to an OnStepHandler, which must be explicitly freed.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/89a432e0cf0b
Don't leak onStep handlers. r=jorendorff

Comment 6

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/89a432e0cf0b