1814880 - Assertion failure: !chain[i]->is<GlobalObject>() && !chain[i]->is<NonSyntacticVariablesObject>(), at vm/EnvironmentObject.cpp:3328

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[lukas.bernhard]

Steps to reproduce:

On git commit a7156afbfa575f12f60b1c8bf099d547c29bcadf the attached sample triggers an assertion violation:
Assertion failure: !chain[i]->is<GlobalObject>() && !chain[i]->is<NonSyntacticVariablesObject>(), at js/src/vm/EnvironmentObject.cpp:3328
Older commits such as c7854bdaa6bfa104bb6e94a5b84ecd3d32551425 from Dec 29 2021 are affected as well.
Precautiously marking this as s-s; I didn't investigate further.

commandline:
obj-x86_64-pc-linux-gnu/dist/bin/js --fuzzing-safe crash.js

crash.js:

const v1 = new Uint8ClampedArray();
Uint32Array.envChainObject = this.evalReturningScope(v1);
this.evaluate("toLowerCase", Uint32Array);

#0  0x00005555577d2bfa in js::CreateObjectsForEnvironmentChain (cx=0x7ffff7433f00, chain=...,
    terminatingEnv=..., envObj=...) at js/src/vm/EnvironmentObject.cpp:3327
#1  0x00005555577d28c2 in js::CreateNonSyntacticEnvironmentChain (cx=0x7ffff7433f00, envChain=...,
    env=...) at js/src/vm/EnvironmentObject.cpp:880
#2  0x00005555577978d2 in ExecuteScript (cx=0x7ffff7433f00, envChain=..., script=..., rval=...)
    at js/src/vm/CompilationAndEvaluation.cpp:479
#3  0x00005555577977de in JS_ExecuteScript (cx=0x7ffff7433f00, envChain=..., scriptArg=..., rval=...)
    at js/src/vm/CompilationAndEvaluation.cpp:503
#4  0x0000555557368550 in Evaluate (cx=0x7ffff7433f00, argc=2, vp=0x7ffff4cfc090)
    at js/src/shell/js.cpp:2459
#5  0x000055555755d58e in CallJSNative (cx=0x7ffff7433f00,
    native=0x555557366900 <Evaluate(JSContext*, unsigned int, JS::Value*)>, reason=js::CallReason::Call,
    args=...) at js/src/vm/Interpreter.cpp:459
#6  0x000055555755cdcd in js::InternalCallOrConstruct (cx=0x7ffff7433f00, args=...,
    construct=js::NO_CONSTRUCT, reason=js::CallReason::Call)
    at js/src/vm/Interpreter.cpp:547
#7  0x000055555755e161 in InternalCall (cx=0x7ffff7433f00, args=..., reason=js::CallReason::Call)
    at js/src/vm/Interpreter.cpp:614
#8  0x000055555755df25 in js::CallFromStack (cx=0x7ffff7433f00, args=..., reason=js::CallReason::Call)
    at js/src/vm/Interpreter.cpp:619
#9  0x000055555754ec54 in Interpret (cx=0x7ffff7433f00, state=...)
    at js/src/vm/Interpreter.cpp:3362
#10 0x0000555557540d30 in js::RunScript (cx=0x7ffff7433f00, state=...)
    at js/src/vm/Interpreter.cpp:431
#11 0x000055555755fd1c in js::ExecuteKernel (cx=0x7ffff7433f00, script=..., envChainArg=...,
    evalInFrame=..., result=...) at js/src/vm/Interpreter.cpp:812
#12 0x00005555575605c5 in js::Execute (cx=0x7ffff7433f00, script=..., envChain=..., rval=...)
    at js/src/vm/Interpreter.cpp:844
#13 0x00005555577975b6 in ExecuteScript (cx=0x7ffff7433f00, envChain=..., script=..., rval=...)
    at js/src/vm/CompilationAndEvaluation.cpp:473

Comment 1

[Nicolas B. Pierron [:nbp]]

The only references to envChainObject seems to be in the JS shell, as a property expected on the option object given as argument.
So this is most likely not affecting Firefox.

Arai, maybe you would know what needs to be checked about the envChainObject that is not checked early on in the Evaluate function?

Comment 2

[Matthew Gaudet (he/him) [:mgaudet]]

Likely we just want to add an extra guard to here stopping NonSyntacticVariablesObjects from being passed too.

Comment 3

[Tooru Fujisawa [:arai]]

Attachment: Bug 1814880 - Disallow all unqualified variables objects in envChainObject option in evaluate function. r?mgaudet!

Comment 4

[Daniel Veditz [:dveditz]]

If this doesn't affect Firefox is there another reason to keep the bug hidden?

Comment 5

[Tooru Fujisawa [:arai]]

No reason to keep this hidden.
This can be opened up.

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Landed: https://hg.mozilla.org/integration/autoland/rev/3dd4a5d6bef63c1ebc00ad93a9d43c864e07d673

Backed out for failing modified js/src/jit-test/tests/environments/evaluate_envChainObject.js: https://hg.mozilla.org/integration/autoland/rev/ab1ca2678cfe79a8080924c835e86a4d94e604ab

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&group_state=expanded&selectedTaskRun=F28LzBaXQl-2--2O9uVUqg.0&resultStatus=testfailed%2Cbusted%2Cexception&searchStr=sm&revision=3dd4a5d6bef63c1ebc00ad93a9d43c864e07d673
Failure log: https://treeherder.mozilla.org/logviewer?job_id=405095365&repo=autoland

/builds/worker/checkouts/gecko/js/src/jit-test/lib/../../tests/non262/shell.js:149:13 Error: Assertion failed: expected exception Error, no exception thrown
TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/environments/evaluate_envChainObject.js | /builds/worker/checkouts/gecko/js/src/jit-test/lib/../../tests/non262/shell.js:149:13 Error: Assertion failed: expected exception Error, no exception thrown (code 3, args "--no-blinterp --no-baseline --no-ion --more-compartments") [0.1 s]
INFO stderr 2> /builds/worker/checkouts/gecko/js/src/jit-test/lib/../../tests/non262/shell.js:149:13 Error: Assertion failed: expected exception Error, no exception thrown
/builds/worker/checkouts/gecko/js/src/jit-test/lib/../../tests/non262/shell.js:149:13 Error: Assertion failed: expected exception Error, no exception thrown
TEST-UNEXPECTED-FAIL | js/src/jit-test/tests/environments/evaluate_envChainObject.js | /builds/worker/checkouts/gecko/js/src/jit-test/lib/../../tests/non262/shell.js:149:13 Error: Assertion failed: expected exception Error, no exception thrown (code 3, args "--ion-eager --ion-offthread-compile=off --more-compartments") [0.1 s]
INFO stderr 2> /builds/worker/checkouts/gecko/js/src/jit-test/lib/../../tests/non262/shell.js:149:13 Error: Assertion failed: expected exception Error, no exception thrown

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/827af82bc925
Disallow all unqualified variables objects in envChainObject option in evaluate function. r=mgaudet

Comment 8

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/827af82bc925