1904642 - Assertion failure: cx->realm() == state.script()->realm(), at js/src/vm/Interpreter.cpp:422

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Nils Bars]

Attachment: bug.js

Steps to reproduce:

Checkout commit 9fcc11127fbfbdc88cbf37489dac90542e141c77 and invoke the js shell as follows:

js --fuzzing-safe <test-case>

Actual results:

Assertion failure: cx->realm() == state.script()->realm(), at js/src/vm/Interpreter.cpp:422

Comment 1

[Jan de Mooij [:jandem]]

Reduced test below. It looks like we create a module object with a script from a different realm and this confuses ModuleObject::execute when it tries to execute it.

Jon, can this case happen in the browser or are we just missing a check for this in the shell's testing function?

var mod = parseModule("a");
d = newGlobal().registerModule("c", mod);
moduleLink(d);
moduleEvaluate(d);

Comment 2

[Jon Coppeard (:jonco)]

The problem is in the shell function registerModule(). This can't happen in the browser.

Comment 3

[Jon Coppeard (:jonco)]

Attachment: Bug 1904642 - Check module realm in shell registerModule function r?jandem

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3e39867430df
Check module realm in shell registerModule function r=jandem

Comment 5

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/3e39867430df