1879166 - Assertion failure: !cx->isExceptionPending(), at vm/Interpreter.cpp:483

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

let x = [];
x.keepFailing = [];
oomTest(function () {
  new Date(x).toString();
}, x);

(gdb) bt
#0  CallJSNative (cx=cx@entry=0x7ffff6b2e100, native=native@entry=0x55555790f240 <date_toString(JSContext*, unsigned int, JS::Value*)>, reason=reason@entry=js::CallReason::Call, args=...)
    at /home/skymainubu/trees/mozilla-central/js/src/vm/Interpreter.cpp:483
#1  0x000055555726dbdb in js::InternalCallOrConstruct (cx=0x7ffff6b2e100, args=..., construct=construct@entry=js::NO_CONSTRUCT, reason=js::CallReason::Call)
    at /home/skymainubu/trees/mozilla-central/js/src/vm/Interpreter.cpp:574
#2  0x000055555726eb4d in InternalCall (cx=0x7ffff7beea60 <_IO_stdfile_2_lock>, cx@entry=0x7ffff6b2e100, args=..., reason=1489431728, reason@entry=js::CallReason::Call)
    at /home/skymainubu/trees/mozilla-central/js/src/vm/Interpreter.cpp:641
#3  0x000055555726eab7 in js::CallFromStack (cx=0x7ffff7beea60 <_IO_stdfile_2_lock>, cx@entry=0x7ffff6b2e100, args=..., reason=4156479267, reason@entry=js::CallReason::Call)
    at /home/skymainubu/trees/mozilla-central/js/src/vm/Interpreter.cpp:646
#4  0x0000555557e5c47c in js::jit::DoCallFallback (cx=0x7ffff6b2e100, frame=0x7fffffffc0c8, stub=0x7ffff6928290, argc=0, vp=0x7fffffffc088, res=...)
    at /home/skymainubu/trees/mozilla-central/js/src/jit/BaselineIC.cpp:1659
#5  0x00001ca0f8ca8a5f in ?? ()
#6  0xfff9800000000000 in ?? ()
#7  0x0000000000000067 in ?? ()
#8  0x00007fffffffc0a0 in ?? ()
#9  0x00001ca0f8ccd6e4 in ?? ()
#10 0x0000000000000002 in ?? ()
#11 0x00007fffffffc0c8 in ?? ()
#12 0x00007ffff6928290 in ?? ()
#13 0x0000000000000000 in ?? ()
(gdb)

Run with --fuzzing-safe --no-threads --no-baseline --no-ion, compile with AR=ar sh ../configure --enable-debug --enable-debug-symbols --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests, tested on m-c rev 612d82d4c66a.

Setting s-s to be safe.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/8e6c7b85d0db
user:        Tom Schuster
date:        Fri Sep 08 19:24:44 2023 +0000
summary:     Bug 1846224 - Add a JavaScript per-realm locale override. r=jandem

Tom, is bug 1846224 a likely regressor?

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1846224

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

:tschuster, since you are the author of the regressor, bug 1846224, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 4

[Tom Schuster]

The problem is that JSRuntime::getDefaultLocale can fail due to OOM and set an exception, but later in FormatDateHelper we just returned early for invalid dates, so we don't realize we should throw.

I am not sure if this is really a security issue.

Comment 5

[Tom Schuster]

Attachment: Bug 1879166 - Don't ignore exception from Runtime::getLocale. r?jandem

JSRuntime::getDefaultLocale should only return nullptr when throwing on
OOM. Otherwise the locale "und" is used.

Comment 6

[Jan de Mooij [:jandem]]

(In reply to Tom Schuster (MoCo) from comment #4)

The problem is that JSRuntime::getDefaultLocale can fail due to OOM and set an exception, but later in FormatDateHelper we just returned early for invalid dates, so we don't realize we should throw.

I am not sure if this is really a security issue.

Yeah this isn't a security bug.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8334f344bff3
Don't ignore exception from Runtime::getLocale. r=jandem

Comment 8

[Norisz Fay [:noriszfay]]

Backed out for causing SM bustages on date-getLocale-oom

Backout link

Push with failures

Failure log // Failure log 2

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f797af17797a
Don't ignore exception from Runtime::getLocale. r=jandem

Comment 10

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/f797af17797a