1651345 - GC issue in jsshell with `addMarkObservers`

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect, P1)

Description

[Carl Smith]

This sample triggers a gc issue, accessing already free-poisoned memory, which seems to result from a call to the addMarkObservers builtin. This is triggered during fuzzing even with the --fuzzing-safe flag enabled.

function main() {
const v3 = {get:Object};
const v5 = Object.defineProperty(Object,0,v3);
addMarkObservers(Object, -1)
gc();
}
main();

It fails on the following assertion:

Assertion failure: flags() == 0, at /home/builder/firefox/js/src/gc/Cell.h:737

This is very likely no security issue as it requires access to the addMarkObservers builtin but I am filing this as a security issue just in case it can be triggered through a different method.

Comment 1

[Steven DeTar [:sdetar]]

Jon, since this seems to be a GC issue I moving to the GC category, could you take a look at this?

Comment 2

[Jon Coppeard (:jonco)]

This is shell-only problem in addMarkObservers.

Comment 3

[Jon Coppeard (:jonco)]

Attachment: Bug 1651345 - Make addMarkObservers evict the nursery for every nursery-allocated argument it finds r?sfink

The problem is that it's not enough to evit the nursery once at the start of addMarkObservers since JS_GetElement can end up running a getter that creates new objects.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2cded7ee7fb2
Make addMarkObservers evict the nursery for every nursery-allocated argument it finds r=sfink

Comment 5

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/2cded7ee7fb2