1826230 - JS::ErrorReportBuilder asserts on ErrorObject with cause property

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Bryan Thrall [:bthrall]]

The JS shell uses JS::ErrorReportBuilder so the following script will trigger the assertion:

const error = Error(this, { cause: "initial cause" });
Object.defineProperty(error, "cause", { get: () => "cause property" });
throw error;

which produces the following stack trace in GDB:

#0 js::ToStringSlow<(js::AllowGC)1>(JSContext*, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType)
(cx=<optimized out>, cx@entry=0x7ffff7630100, arg=arg@entry=$JS::Value(unrecognized!))
at /home/bryan/src/mozilla-unified/js/src/vm/StringType.cpp:2246
#1 0x00005555573bb8f2 in js::ToString<(js::AllowGC)1>(JSContext*, JS::Handle<JS::Value>)
(cx=0x7ffff7630100, v=$JS::Value(unrecognized!))
at /home/bryan/src/mozilla-unified/js/src/vm/StringType.h:1691
#2 JS::ErrorReportBuilder::init(JSContext*, JS::ExceptionStack const&, JS::ErrorReportBuilder::SniffingBehavior)
(this=0x7fffffffd740, cx=<optimized out>, exnStack=..., sniffingBehavior=JS::ErrorReportBuilder::WithSideEffects) at /home/bryan/src/mozilla-unified/js/src/jsexn.cpp:513

The cause appears to be that Object.defineProperty() stores the getter flagged as PrivateGCThing in the ErrorObject's slot, but ErrorReportBuilder is not expecting that type

Comment 1

[André Bargull [:anba]]

Attachment: Bug 1826230: Don't return the GetterSetter Private-GC thing from ErrorObject::getCause. r=bthrall!

When the cause property has been redefined to an accessor property, the
CAUSE_SLOT reserved slot contains a Private-GC thing storing the GetterSetter
object. Make sure we don't try to return the Private-GC thing from the
ErrorObject::getCause() method.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c87ce308f6ee
Don't return the GetterSetter Private-GC thing from ErrorObject::getCause. r=spidermonkey-reviewers,mgaudet

Comment 4

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/c87ce308f6ee