1880870 - Assertion failure: false (EraseCallback(nurseryCollectionCallbacks.ref(), callback, data)), at gc/GC.cpp:1557

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

var x = [];
function f() {
  Object.entries(x);
  Object.defineProperty(x, "", { enumerable: true, get: f });
}
oomTest(f);

(gdb) bt
#0  js::gc::GCRuntime::removeNurseryCollectionCallback (this=<optimized out>, callback=0x555557ccf870 <js::AutoSelectGCHeap::NurseryCollectionCallback(JSContext*, JS::GCNurseryProgress, JS::GCReason, void*)>, data=0x7fffffff16c0) at /home/yksubu/trees/mozilla-central/js/src/gc/GC.cpp:1556
#1  0x00005555573681f5 in TryEnumerableOwnPropertiesNative<(EnumerableOwnPropertiesKind)2> (cx=0x7ffff662d100, obj=..., rval=..., optimized=<optimized out>) at /home/yksubu/trees/mozilla-central/js/src/builtin/Object.cpp:1895
#2  EnumerableOwnProperties<(EnumerableOwnPropertiesKind)2> (cx=0x7ffff662d100, args=...) at /home/yksubu/trees/mozilla-central/js/src/builtin/Object.cpp:2019
#3  obj_entries (cx=0x7ffff662d100, argc=<optimized out>, vp=<optimized out>) at /home/yksubu/trees/mozilla-central/js/src/builtin/Object.cpp:2183
#4  0x00002c968b6e46e3 in ?? ()
#5  0x00007ffff669857d in ?? ()
#6  0x00007fffffff1a30 in ?? ()
#7  0x0000000000000000 in ?? ()
(gdb)

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/5c1bdf739b56
user:        Jon Coppeard
date:        Sat Dec 02 08:47:13 2023 +0000
summary:     Bug 1867453 - Fix quadratic behaviour enumerating own properties r=sfink

Run with --fuzzing-safe --no-threads --no-baseline --no-ion, compile with AR=ar sh ../configure --enable-debug --enable-debug-symbols --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests, tested on m-c rev 5c6884a349b6.

Setting s-s to be safe. Jon, is bug 1867453 a likely regressor?

Comment 1

[Jon Coppeard (:jonco)]

Not security-sensitive. The assertion that fails is checking that we remove a nursery collection callback, and this happens because we failed to add it due to OOM. This would not cause a problem in release builds.

Comment 2

[Jon Coppeard (:jonco)]

Attachment: Bug 1880870 - Don't attempt to remove AutoSelectGCHeap's callback if we failed to add it r?sfink

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1867453

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5309478aa9cb
Don't attempt to remove AutoSelectGCHeap's callback if we failed to add it r=sfink

Comment 5

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/5309478aa9cb