1699622 - Assertion failure: targetProto->isUsedAsPrototype(), at gc/GC.cpp:8052

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

offThreadCompileModule("");
finishOffThreadModule();

Assertion failure: targetProto->isUsedAsPrototype(), at /home/skygentoo/trees/mozilla-central/js/src/gc/GC.cpp:8052

Thread 1 "js-dbg-64-linux" received signal SIGSEGV, Segmentation fault.
js::gc::GCRuntime::mergeRealms (this=<optimized out>, this@entry=0x7ffff6a48770, source=source@entry=0x7ffff57d1400, target=<optimized out>, target@entry=0x7ffff544d000) at /home/skygentoo/trees/mozilla-central/js/src/gc/GC.cpp:8052
warning: Source file is more recent than executable.
b8052	        MOZ_ASSERT(targetProto->isUsedAsPrototype());
(gdb) bt
#0  js::gc::GCRuntime::mergeRealms (this=<optimized out>, this@entry=0x7ffff6a48770, source=source@entry=0x7ffff57d1400, target=<optimized out>, target@entry=0x7ffff544d000) at /home/skygentoo/trees/mozilla-central/js/src/gc/GC.cpp:8052
#1  0x000055555737d348 in js::gc::MergeRealms (source=0x7ffff57d1400, target=target@entry=0x7ffff544d000) at /home/skygentoo/trees/mozilla-central/js/src/gc/GC.cpp:8001
#2  0x0000555556d891e7 in js::GlobalHelperThreadState::mergeParseTaskRealm (this=<optimized out>, cx=cx@entry=0x7ffff6a26000, parseTask=0x7ffff57cfc00, dest=0x7ffff544d000) at /home/skygentoo/trees/mozilla-central/js/src/vm/HelperThreads.cpp:2311
#3  0x0000555556d88a70 in js::GlobalHelperThreadState::finishParseTaskCommon (this=<optimized out>, cx=cx@entry=0x7ffff6a26000, kind=kind@entry=js::ParseTaskKind::Module, token=<optimized out>) at /home/skygentoo/trees/mozilla-central/js/src/vm/HelperThreads.cpp:1960
#4  0x0000555556d898f3 in js::GlobalHelperThreadState::finishSingleParseTask (this=0x0, cx=0x7ffff6a26000, kind=kind@entry=js::ParseTaskKind::Module, token=0x0, startEncoding=startEncoding@entry=js::StartEncoding::No) at /home/skygentoo/trees/mozilla-central/js/src/vm/HelperThreads.cpp:2071
#5  0x0000555556d8a614 in js::GlobalHelperThreadState::finishModuleParseTask (this=0x7ffff7c3f9a0 <_IO_stdfile_2_lock>, cx=0x0, token=0x555557fe7de0 <gMozCrashReason>) at /home/skygentoo/trees/mozilla-central/js/src/vm/HelperThreads.cpp:2220
#6  0x0000555556a29565 in FinishOffThreadModule (cx=cx@entry=0x7ffff6a26000, argc=<optimized out>, vp=<optimized out>) at /home/skygentoo/trees/mozilla-central/js/src/shell/js.cpp:6322
#7  0x0000555556b0c7d1 in CallJSNative (cx=cx@entry=0x7ffff6a26000, native=0x555556a29450 <FinishOffThreadModule(JSContext*, unsigned int, JS::Value*)>, reason=<optimized out>, reason@entry=js::CallReason::Call, args=...) at /home/skygentoo/trees/mozilla-central/js/src/vm/Interpreter.cpp:435
#8  0x0000555556aff49a in js::InternalCallOrConstruct (cx=cx@entry=0x7ffff6a26000, args=..., construct=construct@entry=js::NO_CONSTRUCT, reason=reason@entry=js::CallReason::Call) at /home/skygentoo/trees/mozilla-central/js/src/vm/Interpreter.cpp:520
#9  0x0000555556b001bb in InternalCall (cx=0x7ffff6a26000, args=..., reason=reason@entry=js::CallReason::Call) at /home/skygentoo/trees/mozilla-central/js/src/vm/Interpreter.cpp:580
#10 0x0000555556b000a9 in js::CallFromStack (cx=0x7ffff7c3f9a0 <_IO_stdfile_2_lock>, args=...) at /home/skygentoo/trees/mozilla-central/js/src/vm/Interpreter.cpp:584
#11 0x00005555574dc6c3 in js::jit::DoCallFallback (cx=0x7ffff7c3f9a0 <_IO_stdfile_2_lock>, frame=<optimized out>, stub=<optimized out>, argc=<optimized out>, vp=0x7fffffffba00, res=...) at /home/skygentoo/trees/mozilla-central/js/src/jit/BaselineIC.cpp:1841
#12 0x000020979429f443 in ?? ()
#13 0x96101dd1c7d70d00 in ?? ()
#14 0x00007fffffffb9b0 in ?? ()
#15 0xfff9800000000000 in ?? ()
#16 0x0000555557f9f4d0 in js::jit::vmFunctions ()
#17 0x00002097942c4776 in ?? ()
#18 0x0000000000004022 in ?? ()
#19 0x00007fffffffba30 in ?? ()
#20 0x00007ffff540d0b0 in ?? ()
#21 0x0000000000000000 in ?? ()
(gdb)

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/5081e5168c62
user:        Jan de Mooij
date:        Tue Mar 09 14:28:23 2021 +0000
summary:     Bug 1696861 part 3 - Stop eagerly marking prototypes as delegate. r=tcampbell

Run with --fuzzing-safe --ion-offthread-compile=off --ion-eager --off-thread-parse-global, compile with AR=ar sh ./configure --enable-debug --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests, tested on m-c rev a96c49a026f6.

Not sure if this is s-s, I'd leave it to Jan/Ted.

Comment 1

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1696861

Comment 2

[Jan de Mooij [:jandem]]

I can't open this up because it's in core-security instead of the JS security group, but this is harmless. Ted confirmed --off-thread-parse-global is required for this and that flag is only exposed in the shell.

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Bug 1699622 - Set IsUsedAsPrototype flag on module prototypes for off-thread parsing if needed. r?tcampbell!

This only affects the JS shell with the --off-thread-parse-global flag.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0bc442c1d8b9
Set IsUsedAsPrototype flag on module prototypes for off-thread parsing if needed. r=tcampbell

Comment 5

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/0bc442c1d8b9

Comment 6

[Daniel Veditz [:dveditz]]

(In reply to Jan de Mooij [:jandem] from comment #3)

This only affects the JS shell with the --off-thread-parse-global flag.

That's a decent reason for un-hiding the bug, but why does that option exist? Is it for a future feature we're working on? A mode that regular Firefox can get into in certain circumstances? If so would this have been an eventual Firefox security bug if not fixed? (asking wrt bounty eligibility)

Comment 7

[Ted Campbell [:tcampbell]]

It is a former feature we are getting away from. There are a handful of cases where the browser can use that mode but none of them support ES-Modules (the other requirement in the testcase) and never will. It is possible that a bug found using this flag could turn into a real security bug, but that is not the case for this test case since it uses Modules.

I expect in the next two months we will remove the last vestiges entirely.

(So while this bug was a surprise to us, it doesn't have a pathway to exploitation. Fixing it was primarily to keep fuzzing clean.)

Comment 8

[Daniel Veditz [:dveditz]]

Thanks for the explanation!