1890499 - Crash [@ js::gc::RegisterWeakCache(JS::Zone*, js::gc::WeakCacheBase*)]

Status: RESOLVED DUPLICATE of bug 1890200

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20240408-1b56c653a5ee (opt build, run with --fuzzing-safe --ion-offthread-compile=off --more-compartments test.js):

a = new Proxy({}, {
    get(b, c) {
        if (c == "sameZoneAs") return newGlobal()
        gc()
    }
})
newGlobal(a)

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x57c65aaa in js::gc::RegisterWeakCache(JS::Zone*, js::gc::WeakCacheBase*) ()
#1  0x5814d42a in JS::Realm::Realm(JS::Compartment*, JS::RealmOptions const&) ()
#2  0x57c3de27 in js::NewRealm(JSContext*, JSPrincipals*, JS::RealmOptions const&) ()
#3  0x57c90ea7 in js::GlobalObject::new_(JSContext*, JSClass const*, JSPrincipals*, JS::OnNewGlobalHookOption, JS::RealmOptions const&) ()
#4  0x57f741db in NewGlobalObject(JSContext*, JS::RealmOptions&, JSPrincipals*, ShellGlobalKind, bool) ()
#5  0x57f80baa in NewGlobal(JSContext*, unsigned int, JS::Value*) ()
#6  0x57ce276a in js::Interpret(JSContext*, js::RunState&) ()
#7  0x57cd5ecf in js::RunScript(JSContext*, js::RunState&) ()
[...]
#13 0x57ba3789 in main ()
eax	0xf2d13c44	-221168572
ebx	0x58b6ce34	1488375348
ecx	0xf6930000	-158138368
edx	0xe5e5e5e5	-437918235
esi	0xf2d13c00	-221168640
edi	0xf6930000	-158138368
ebp	0xffdaa458	4292519000
esp	0xffdaa450	4292518992
eip	0x57c65aaa <js::gc::RegisterWeakCache(JS::Zone*, js::gc::WeakCacheBase*)+58>
=> 0x57c65aaa <_ZN2js2gc17RegisterWeakCacheEPN2JS4ZoneEPNS0_13WeakCacheBaseE+58>:	mov    %eax,(%edx)
   0x57c65aac <_ZN2js2gc17RegisterWeakCacheEPN2JS4ZoneEPNS0_13WeakCacheBaseE+60>:	mov    %eax,0x59c(%ecx)

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Jan de Mooij [:jandem]]

This might be the same as bug 1890200. The revision in comment 0 doesn't include this patch, but the fuzzer's test looks suspiciously similar to the test I landed there :)

Comment 4

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20240408161942-1b56c653a5ee) but not with tip (mozilla-central 20240409093900-643848d855eb.)

The bug appears to have been fixed in the following build range:

Start: 121f10f1e058827d1f5c92abff573692b920f4fe (20240408140718)
End: 392910178dc25079e2c2fe4c87303d7e21428409 (20240408145625)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=121f10f1e058827d1f5c92abff573692b920f4fe&tochange=392910178dc25079e2c2fe4c87303d7e21428409

decoder, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.