1727281 - Assertion failure: !isIndex(), at /js/src/vm/StringType.h:2004

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20210824-7857f4c37a92 (debug build, run with --fuzzing-safe --ion-offthread-compile=off):

a = {
  0: class { #$() {} }
}

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x0000555556c24bcb in JSAtom::asPropertyName() ()
#1  0x0000555556c0647b in Interpret(JSContext*, js::RunState&) ()
#2  0x0000555556c03b31 in js::RunScript(JSContext*, js::RunState&) ()
[...]
#10 0x0000555556a706ae in main ()
rax	0x55555576fc97	93824994442391
rbx	0x3311cf04640	3509473789504
rcx	0x555558128820	93825038190624
rdx	0x0	0
rsi	0x7ffff7105770	140737338431344
rdi	0x7ffff7104540	140737338426688
rbp	0x7fffffffc0c0	140737488339136
rsp	0x7fffffffc0a0	140737488339104
r8	0x7ffff7105770	140737338431344
r9	0x7ffff7f98840	140737353713728
r10	0x0	0
r11	0x0	0
r12	0xffff800000000000	-140737488355328
r13	0xfffaffffffffffff	-1407374883553281
r14	0x100000f58	4294971224
r15	0x55555809d990	93825037621648
rip	0x555556c24bcb <JSAtom::asPropertyName()+267>
=> 0x555556c24bcb <_ZN6JSAtom14asPropertyNameEv+267>:	movl   $0x7d4,0x0
   0x555556c24bd6 <_ZN6JSAtom14asPropertyNameEv+278>:	callq  0x555556b06a2a <abort>

Marking this s-s because it looks like some kind of potential type confusion, looking at the code/assert.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Matthew Gaudet (he/him) [:mgaudet]]

Did a bisect:

The first bad revision is:
changeset:   678261:5e6d1848ce62
user:        André Bargull <[e-mail]>
date:        Tue Aug 10 10:05:03 2021 +0000
summary:     Bug 1723155 - Part 8: Add NewPrivateName opcode. r=mgaudet

Comment 4

[Matthew Gaudet (he/him) [:mgaudet]]

Anba: Want to take a quick look? Otherwise, I'll come back to this tomorrow.

Comment 5

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20210824094724-7857f4c37a92.
The bug appears to have been introduced in the following build range:

Start: cbcbf9b36569130af1e5e90b02fe3a0f5bd50c96 (20210810100203)
End: 0ab8644c9e7103e10a910b08fde5c41c014bb3d0 (20210810100905)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=cbcbf9b36569130af1e5e90b02fe3a0f5bd50c96&tochange=0ab8644c9e7103e10a910b08fde5c41c014bb3d0

Comment 6

[André Bargull [:anba]]

Attachment: Bug 1727281: Relax PropertyName to JSAtom. r=mgaudet!

Comment 7

[André Bargull [:anba]]

Attachment: Bug 1727281: Add test case. r=mgaudet!

Add a regression test case.

Depends on D123510

Comment 8

[André Bargull [:anba]]

Actually it's fine to open this bug, because it can't be exploited in any way:
The JSAtom incorrectly treated as a PropertyName is only passed to js::NewPrivateName(), which in turn passes it to JS::Symbol::new_(). But because JS::Symbol::new_() accepts HandleString (aka JSString), the incorrect PropertyName type is discarded, so it's not possible to cause any harm.

Comment 9

[Jan de Mooij [:jandem]]

Opening per comment 8.

Comment 10

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1723155

Comment 11

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/cf784a5bb18a
https://hg.mozilla.org/mozilla-central/rev/ee7987018e81

Comment 12

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20210825214919-6c984a259bdc.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.