1564012 - Assertion failure: comp == compartment || (srcKind == JS::TraceKind::Object && InCrossCompartmentMap(static_cast<JSObject*>(src), thing)), at js/src/gc/GC.cpp:4257

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1, critical)

Description

[Gary Kwong [:gkw] [:nth10sd]]

The following testcase crashes on mozilla-central revision 483d687212fb (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

// jsfunfuzz-generated
fullcompartmentchecks(true);
// Adapted from randomly chosen test: js/src/jit-test/tests/debug/Frame-identity-05.js
var g = newGlobal({
    newCompartment: true
});
g.eval("function*f(){debugger;yield}");
var dbg = new Debugger(g);
dbg.onDebuggerStatement = function(frame) {};
g.f().next();

Backtrace:

#0  CompartmentCheckTracer::onChild (this=<optimized out>, thing=...) at js/src/gc/GC.cpp:4255
#1  0x000055dc035cf285 in JS::CallbackTracer::onScriptEdge (this=<optimized out>, scriptp=<optimized out>) at /home/ubuntu/shell-cache/js-dbg-64-dm-linux-x86_64-483d687212fb/objdir-js/dist/include/js/TracingAPI.h:164
#2  0x000055dc03a90ab0 in JS::CallbackTracer::dispatchToOnEdge (this=0x7ffe1d515628, scriptp=0x7fb8a0b1b1f8) at /home/ubuntu/shell-cache/js-dbg-64-dm-linux-x86_64-483d687212fb/objdir-js/dist/include/js/TracingAPI.h:261
#3  DoCallback<JSScript> (trc=0x7ffe1d515628, thingp=0x7fb8a0b1b1f8, name=0x55dc01f391b7 "Debugger.Frame generator script") at js/src/gc/Tracer.cpp:45
#4  0x000055dc03430633 in js::Class::doTrace (this=<optimized out>, trc=<optimized out>, obj=<optimized out>) at /home/ubuntu/shell-cache/js-dbg-64-dm-linux-x86_64-483d687212fb/objdir-js/dist/include/js/Class.h:872
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd]]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd]]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/1dd4e16a1a96
user: Jim Blandy
date: Sat Jul 06 00:01:24 2019 +0000
summary: Bug 1560754: Remove DebuggeeFrameGeneratorScript. r=jorendorff

Jim, is bug 1560754 a likely regressor?

Comment 3

[Gary Kwong [:gkw] [:nth10sd]]

autobisectjs shows this is probably related to the following changeset:

The first good revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/597a43be8c60
user: Jon Coppeard
date: Thu Aug 01 16:09:40 2019 +0000
summary: Bug 1564178 - Don't create cross compartment wrappers for debugger wrapper objects r=jimb

Jim/Jon, is bug 1564178 a likely fix?

Comment 4

[Jon Coppeard (:jonco)]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #3)
Yes it is. I'll add the test.

Comment 5

[Jon Coppeard (:jonco)]

Attachment: Bug 1564012 - Add fuzz test for cross compartment pointers from debugger frame generator info to scripts r=jimb?

Comment 6

[Fuzzing Team]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision a28a338396c3).

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8a54e897db7c
Add fuzz test for cross compartment pointers from debugger frame generator info to scripts r=jimb?

Comment 8

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/8a54e897db7c