1636306 - OOM during delazification can clobber TI groups

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P2)

Description

[Ted Campbell [:tcampbell]]

The code in [1] is fired when the parent of a script is first compiled. If we OOM during this, the delazification is unwound but the group remains initialized. This is a design issue and triggers asserts. Unclear if this is a real security issue in practice..

[1] https://searchfox.org/mozilla-central/rev/dc4560dcaafd79375b9411fdbbaaebb0a59a93ac/js/src/frontend/BytecodeEmitter.cpp#5723

Comment 1

[Ted Campbell [:tcampbell]]

oomTest(() => { eval(`
    function getCallee() { return getCallee.caller; }

    // Use trickery to get a reference to a run-once function. We avoid
    // expanding the lazy inner functions in this first invocation.
    let fn = function(x) {
        if (x) {
            // Singletons inside lazy
            let _ = function() {
                function x00() {}
                function x01() {}
                function x02() {}
                function x03() {}
                function x04() {}
                function x05() {}
                function x06() {}
                function x07() {}
                function x08() {}
                function x09() {}
            }();
        }

        return getCallee();
    }(false);

    // Run fn but expand inner-lazy this time. Run in a loop to expand 
    for (var i = 0; i < 2; i += 1) {
        try { fn(true); }
        catch (e) { }
    }
`)});

This triggers the following debug assert:
Assertion failure: !obj->isSingleton(), at /home/tcampbell/projects/gecko.dev/js/src/vm/ObjectGroup-inl.h:108

Comment 2

[Ted Campbell [:tcampbell]]

The function objects never escape to script if their parent failed to delazify. As a result I think this issue is benign. I'll add a check for an existing (non-default) function group to setTypeForScriptedFunction.

Comment 3

[Ted Campbell [:tcampbell]]

Attachment: Bug 1636306 - Allow existing group in setTypeForScriptedFunction. r?jandem

Comment 4

[Ted Campbell [:tcampbell]]

These functions with clobbered groups cannot escape to script before the outer delazification completes successfully. The result is that know meaningful info can be lost, so this is just a debug-assert. The patch still makes sense to apply because otherwise this is a big footgun.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1a1f0d1c867d
Allow existing group in setTypeForScriptedFunction. r=jandem

Comment 6

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/1a1f0d1c867d