1846128 - Assertion failure: isBoolean()

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[:ddme]

Attachment: poc.js

this bug not stable, need run multi time, I will try to upload backtrace

download the newest Firefox and build with

ac_add_options --enable-application=js
ac_add_options --enable-optimize
ac_add_options --enable-debug
ac_add_options --disable-shared-js
ac_add_options --enable-js-fuzzilli
ac_add_options --enable-fuzzing
ac_add_options --enable-gczeal

and run with

--baseline-warmup-threshold=10 --ion-warmup-threshold=100 --ion-check-range-analysis --ion-extra-checks --disable-oom-functions --reprl --small-function-length=128 --inlining-entry-threshold=1024 --gc-zeal=16 --ion-scalar-replacement=on --ion-pruning=on --ion-range-analysis=on --ion-inlining=on --ion-gvn=on --ion-osr=on --ion-edgecase-analysis=on --nursery-size=8 --nursery-strings=off --nursery-bigints=on --spectre-mitigations=off --ion-optimize-shapeguards=on --ion-licm=on --ion-instruction-reordering=on --cache-ir-stubs=on --no-ssse3 --enable-watchtower --ion-sink=off

Assertion failure: isBoolean(), at /home/builder/firefox/obj-fuzzbuild/dist/include/js/Value.h:997

Comment 1

[:ddme]

remove --reprl from flag, thanks : )

Comment 2

[:ddme]

Hi all, today I new more than three bug. If I make some mistake like these type memory corruption cann't be security bug, please close it, thank you

Comment 3

[:ddme]

commit ddff4872b8220fae71155e39fd30ac3b760a4741 (grafted, HEAD -> master, origin/master, origin/HEAD)
Author: Jason Prickett <[e-mail]>
Date: Sat Jul 29 03:42:06 2023 +0000

Comment 4

[:ddme]

(In reply to ret2ddme from comment #3)

commit ddff4872b8220fae71155e39fd30ac3b760a4741 (grafted, HEAD -> master, origin/master, origin/HEAD)
Author: Jason Prickett <[e-mail]>
Date: Sat Jul 29 03:42:06 2023 +0000

this is my local version

Comment 5

[Iain Ireland [:iain]]

Thanks for the report.

I ran this 100+ times locally on a build of the latest mozilla-central with the specified flags without seeing a crash. Can you confirm that the flags and the testcase you've posted are correct? What OS/architecture are you using? What is the crash rate for you locally?

Comment 6

[:ddme]

I can only reproduce it with fuzzilli, and I can not reproduce it by manual run, I will try to upload the backtrace

Comment 7

[Jan de Mooij [:jandem]]

Does it reproduce if you pass --fuzzing-safe to the JS shell?

Comment 8

[:ddme]

for (const v3 of Object.getOwnPropertyNames(this)) {
    this.assertRecoveredOnBailout(v3, v3);
}

this is stable version POC
but with --fuzzing-safe, it can not be reproduce

Comment 9

[Jan de Mooij [:jandem]]

Thanks! That explains it because we inline assertRecoveredOnBailout here with this code:

  // (Fuzzing unsafe) testing function which must be called with a constant
  // boolean as its second argument.
  bool mustBeRecovered = args_[1].toBoolean();

So we assume the second argument to this function is a boolean and else we fail this assertion.