1817227 - Assertion failure: false (MOZ_ASSERT_UNREACHABLE: internal value types shouldn't leak into places wanting source representations), at vm/ToSource.cpp:243

Status: RESOLVED DUPLICATE of bug 1816311

(Core :: JavaScript Engine, defect, P2)

Description

[lukas.bernhard]

Steps to reproduce:

On git commit df2a7bff8fa01ebc6292e68ce7e3c7b7cf8fc33c the attached sample crashes with an assertion violation when invoked as obj-x86_64-pc-linux-gnu/dist/bin/js --fuzzing-safe crash.js

function f0() {
    const v6 = ` 
        function f8(a9) {
            return v6;
        }
        Uint16Array.then = f8;
        const v10 = \`
            function f11() {
                with (this.newGlobal(undefined).Debugger().getNewestFrame()) { }
                return [];
            }
            const v20 = [];
            const v22 = {"toString":-1,"a":-1,...this};
            v22.wrapWithProto(v22, v22).findPath(v20, v20).toSource();
        \`;
        eval(v10);
    `;
    const v30 = []; 
    v30.sameZoneAs = v30;
    const v34 = this.newGlobal(v30).Debugger([]).getNewestFrame().eval(v6);
}
f0();

#0  0x0000555557ce3af0 in js::ValueToSource (cx=0x7ffff742f100, v=...) at js/src/vm/ToSource.cpp:241
#1  0x000055555767da7e in js::ObjectToSource(JSContext*, JS::Handle<JSObject*>)::$_3::operator()(JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, PropertyKind) const (this=0x7fffffff19f0, id=..., va
l=..., kind=PropertyKind::Normal) at js/src/builtin/Object.cpp:361
#2  0x000055555767d278 in js::ObjectToSource (cx=0x7ffff742f100, obj=...) at js/src/builtin/Object.cpp:522
#3  0x0000555557ce3a78 in js::ValueToSource (cx=0x7ffff742f100, v=...) at js/src/vm/ToSource.cpp:235
#4  0x000055555767da7e in js::ObjectToSource(JSContext*, JS::Handle<JSObject*>)::$_3::operator()(JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, PropertyKind) const (this=0x7fffffff21c0, id=..., va
l=..., kind=PropertyKind::Normal) at js/src/builtin/Object.cpp:361
#5  0x000055555767d278 in js::ObjectToSource (cx=0x7ffff742f100, obj=...) at js/src/builtin/Object.cpp:522
#6  0x00005555576cf680 in obj_toSource (cx=0x7ffff742f100, argc=0, vp=0x7fffffff28c8) at js/src/builtin/Object.cpp:177
#7  0x00005555575696ee in CallJSNative (cx=0x7ffff742f100, native=0x5555576cf4a0 <obj_toSource(JSContext*, unsigned int, JS::Value*)>, 
    reason=js::CallReason::Call, args=...) at js/src/vm/Interpreter.cpp:459
#8  0x0000555557568f2d in js::InternalCallOrConstruct (cx=0x7ffff742f100, args=..., construct=js::NO_CONSTRUCT, reason=js::CallReason::Call)
    at js/src/vm/Interpreter.cpp:547
#9  0x000055555756a2c1 in InternalCall (cx=0x7ffff742f100, args=..., reason=js::CallReason::Call)
    at js/src/vm/Interpreter.cpp:614
#10 0x000055555756a505 in js::Call (cx=0x7ffff742f100, fval=..., thisv=..., args=..., rval=..., reason=js::CallReason::Call)
    at js/src/vm/Interpreter.cpp:646
#11 0x0000555557834b2e in js::Call (cx=0x7ffff742f100, fval=..., thisObj=0x226475701870, rval=...)
    at js/src/vm/Interpreter.h:109
#12 0x0000555557ce3500 in js::ValueToSource (cx=0x7ffff742f100, v=...) at js/src/vm/ToSource.cpp:189
#13 0x00005555575b6103 in js::ArrayToSource (cx=0x7ffff742f100, obj=...) at js/src/builtin/Array.cpp:1095
#14 0x00005555575f53ef in array_toSource (cx=0x7ffff742f100, argc=0, vp=0x7ffff4cf6270) at js/src/builtin/Array.cpp:1135
#15 0x00005555575696ee in CallJSNative (cx=0x7ffff742f100, native=0x5555575f5250 <array_toSource(JSContext*, unsigned int, JS::Value*)>, 
    reason=js::CallReason::Call, args=...) at js/src/vm/Interpreter.cpp:459
#16 0x0000555557568f2d in js::InternalCallOrConstruct (cx=0x7ffff742f100, args=..., construct=js::NO_CONSTRUCT, reason=js::CallReason::Call)
    at js/src/vm/Interpreter.cpp:547
#17 0x000055555756a2c1 in InternalCall (cx=0x7ffff742f100, args=..., reason=js::CallReason::Call)
    at js/src/vm/Interpreter.cpp:614
#18 0x000055555756a085 in js::CallFromStack (cx=0x7ffff742f100, args=..., reason=js::CallReason::Call)
    at js/src/vm/Interpreter.cpp:619
#19 0x000055555755adb4 in Interpret (cx=0x7ffff742f100, state=...) at js/src/vm/Interpreter.cpp:3362
#20 0x000055555754ce90 in js::RunScript (cx=0x7ffff742f100, state=...) at js/src/vm/Interpreter.cpp:431
#21 0x000055555756be7c in js::ExecuteKernel (cx=0x7ffff742f100, script=..., envChainArg=..., evalInFrame=..., result=...)
    at js/src/vm/Interpreter.cpp:812
#22 0x00005555575d8785 in EvalKernel (cx=0x7ffff742f100, v=..., evalType=DIRECT_EVAL, caller=..., env=..., pc=0x7ffff7498095 "w\001", vp=...)
    at js/src/builtin/Eval.cpp:353
#23 0x00005555575d8b9d in js::DirectEval (cx=0x7ffff742f100, v=..., vp=...) at js/src/builtin/Eval.cpp:380
#24 0x0000555557559f96 in Interpret (cx=0x7ffff742f100, state=...) at js/src/vm/Interpreter.cpp:3247
#25 0x000055555754ce90 in js::RunScript (cx=0x7ffff742f100, state=...) at js/src/vm/Interpreter.cpp:431

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I can no longer reproduce this with (almost-latest) m-c rev aded201f11ec.

The first good revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/de743860eb4e
user:        Jan de Mooij
date:        Fri Feb 17 14:58:35 2023 +0000
summary:     Bug 1816311 - Don't expose objects through findPath with --fuzzing-safe. r=jonco

Jan, perhaps this bug is no longer an issue, since the testcase here involves findPath?

Comment 2

[Jan de Mooij [:jandem]]

(In reply to Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now) from comment #1)

I can no longer reproduce this with (almost-latest) m-c rev aded201f11ec.
<snip>
Jan, perhaps this bug is no longer an issue, since the testcase here involves findPath?

Yes that's very likely. I see this was filed the day before the fix for bug 1816311 landed.