1797682 - Crash [@ ToStringOp(JSContext*, JS::Handle<JSObject*>, bool)] or Assertion failure: nameVal.isString(), at builtin/WrappedFunctionObject.cpp:222 with ShadowRealm

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20221026-460e8620ad58 (opt build, run with --fuzzing-safe --ion-offthread-compile=off --enable-shadow-realms test.js):

a = new ShadowRealm();
b = a.evaluate("function f() {} f");
Object.defineProperty(b, "name", {
    value: 0
}).toString();

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x56800fe7 in ToStringOp(JSContext*, JS::Handle<JSObject*>, bool) [clone .llvm.6262291245551907720] ()
#1  0x56cf1e47 in js::fun_toString(JSContext*, unsigned int, JS::Value*) ()
#2  0x56c90226 in Interpret(JSContext*, js::RunState&) ()
[...]
#8  0x56fe3c4e in Process(JSContext*, char const*, bool, FileKind) ()
#9  0x56fbc78d in main ()
eax	0x0	0
ebx	0x58680000	1483210752
ecx	0xf6912200	-158260736
edx	0x20	32
esi	0x0	0
edi	0xfffc97a0	-223328
ebp	0xfffc9818	4294744088
esp	0xfffc9750	4294743888
eip	0x56800fe7 <ToStringOp(JSContext*, JS::Handle<JSObject*>, bool) [clone .llvm.6262291245551907720]+295>
=> 0x56800fe7 <_ZL10ToStringOpP9JSContextN2JS6HandleIP8JSObjectEEb.llvm.6262291245551907720+295>:	mov    (%eax),%edx
   0x56800fe9 <_ZL10ToStringOpP9JSContextN2JS6HandleIP8JSObjectEEb.llvm.6262291245551907720+297>:	test   $0x10,%dl

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Jan de Mooij [:jandem]]

ShadowRealm so NI Matthew.

Comment 4

[André Bargull [:anba]]

Bug 1797750 should fix this issue, too.

Later: Verified this is no longer reproducible with the patches from bug 1797750 applied.

Comment 5

[Andrew McCreight [:mccr8]]

Sounds like possible type confusion.

Comment 6

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20221027215515-2dddf127c6ab.
The bug appears to have been introduced in the following build range:

Start: d1d1d489003c63f62db8eb3d4dc2af7d27862fbe (20221003212025)
End: 73c16d284362ba24606a516cd454dd3fe395b9b6 (20221004213513)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=d1d1d489003c63f62db8eb3d4dc2af7d27862fbe&tochange=73c16d284362ba24606a516cd454dd3fe395b9b6

Comment 7

[Matthew Gaudet (he/him) [:mgaudet]]

Patches on Bug 1797750 have been reviewed, and will fix this.

Note: This code has never shipped and is only available with a non-default pref set.

Comment 8

[Matthew Gaudet (he/him) [:mgaudet]]

This appears to be fixed with Bug 1797750. This fuzz test case is covered by the testing added in https://phabricator.services.mozilla.com/D160511

Comment 9

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20221101093931-d0fd41bff926.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

Based on comment #6, this bug contains a bisection range found by bugmon. However, the Regressed by field is still not filled.

:mgaudet, if possible, could you fill the Regressed by field and investigate this regression?

For more information, please visit auto_nag documentation.