1819894 - Assertion failure: isObject() at include/js/Value.h coming from js::jit::CallIRGenerator::tryAttachCallScripted

Status: RESOLVED DUPLICATE of bug 1819486

(Core :: JavaScript Engine, task)

Description

[Samuel Groß]

The following JavaScript code causes an assertion failure in Spidermonkey debug builds from current HEAD:

for (let v0 = 0; v0 < 100; v0++) {
    function f1(a2) {
        return f1;
    }
    class C3 extends f1 {
    }
    const v4 = C3.bind();
    try {
        v4(v0, v0, v4, C3);
    } catch(e6) {
    }
    const v7 = new v4();
}

Here is the (relevant part of the) backtrace from gdb:

#0  0x0000555557387364 in JS::Value::toObject (this=0x7fffffff9690) at obj-debug/dist/include/js/Value.h:939
#1  0x00005555573864ad in js::WrappedPtrOperations<JS::Value, JS::Handle<JS::Value>, void>::toObject (this=0x7fffffff9918) at obj-debug/dist/include/js/Value.h:1348
#2  0x00005555586ccf77 in js::jit::CallIRGenerator::getThisShapeForScripted (this=0x7fffffff9738, calleeFunc=..., result=...) at js/src/jit/CacheIR.cpp:10528
#3  0x00005555586cd4fa in js::jit::CallIRGenerator::tryAttachCallScripted (this=0x7fffffff9738, calleeFunc=...) at js/src/jit/CacheIR.cpp:10585
#4  0x00005555586cf102 in js::jit::CallIRGenerator::tryAttachStub (this=0x7fffffff9738) at js/src/jit/CacheIR.cpp:10912
#5  0x0000555558394dfb in js::jit::DoSpreadCallFallback (cx=0x7ffff772f100, frame=0x7fffffff9a18, stub=0x7ffff56205c8, vp=0x7fffffff99a8, res=...) at js/src/jit/BaselineIC.cpp:1636
#6  0x00001f567be6e640 in ?? ()
#7  0x0000138f98d028d8 in ?? ()
#8  0x00007fffffff9968 in ?? ()
#9  0x0000138f98d02938 in ?? ()
#10 0xfff9800000000000 in ?? ()
#11 0x0000555559455040 in js::jit::vmFunctions ()
#12 0x00007fffffff99d0 in ?? ()

I'm not sure if this assertion failure has any security implications, so I'm filing this as a security issue as a precaution.

Comment 1

[Jan de Mooij [:jandem]]

Thanks for the report. This is a recent regression from my bind rewrite.