1934369 - Assertion failure: [barrier verifier] Unmarked edge: JS Object 822bf8403f8 'object slot' edge to JS Object 822bf840500, at gc/Verifier.cpp:381

Status: RESOLVED DUPLICATE of bug 1934423

(Core :: JavaScript Engine, defect, P1)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20241129-ed73389dc144 (debug build, run with --fuzzing-safe --cpu-count=2 --ion-offthread-compile=off --enable-explicit-resource-management --baseline-warmup-threshold=1):

gczeal(4)
async function* gen() {
  await using a97 = {
    [Symbol.asyncDispose]: () => values.push("a")
  };
  yield await Promise.resolve(3);
}
let it = gen();
values = [];
async function testAsyncGeneratorPreservesReturnValueWithFinallyWhenTillCompletion() {
  let it = gen();
  values.push((await it.next()).value);
  values.push((await it.next()).value);
}
testAsyncGeneratorPreservesReturnValueWithFinallyWhenTillCompletion();

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x00005555579b14de in js::gc::GCRuntime::endVerifyPreBarriers() ()
#1  0x00005555579b16b8 in js::gc::GCRuntime::maybeVerifyPreBarriers(bool) ()
#2  0x0000555556fcfdf8 in js::Interpret(JSContext*, js::RunState&) ()
#3  0x0000555556fc7e06 in js::RunScript(JSContext*, js::RunState&) ()
#4  0x0000555556fc895c in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) ()
#5  0x0000555557aa6d57 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) ()
#6  0x000039dcae4bde0f in ?? ()
[...]
#15 0x0000000000000000 in ?? ()
rax	0x55555577d0a7	93824994496679
rbx	0x7fffffffb280	140737488335488
rcx	0x5555588ab1e0	93825046065632
rdx	0x1	1
rsi	0x0	0
rdi	0x7ffff7bef7d0	140737349875664
rbp	0x7fffffffb6b0	140737488336560
rsp	0x7fffffffb200	140737488335360
r8	0x0	0
r9	0x3	3
r10	0x0	0
r11	0x0	0
r12	0x5555557ff1a0	93824995029408
r13	0x7fffef721270	140737210618480
r14	0x5555558eb386	93824995996550
r15	0x822bf8403f8	8945335010296
rip	0x5555579b14de <js::gc::GCRuntime::endVerifyPreBarriers()+2638>
=> 0x5555579b14de <_ZN2js2gc9GCRuntime20endVerifyPreBarriersEv+2638>:	movl   $0x17e,0x0
   0x5555579b14e9 <_ZN2js2gc9GCRuntime20endVerifyPreBarriersEv+2649>:	callq  0x555556ec97b0 <abort>

Not sure if this would have a security impact, marking s-s until triaged. Feature is still disabled by default.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20241201095257-4df19decbcec.
The bug appears to have been introduced in the following build range:

Start: c1acf137ed794e8b553c1f40512d21090d1a9b7c (20241114072145)
End: e299ddd844812c1cd97440fd74eb94e0736fbbe9 (20241114100954)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=c1acf137ed794e8b553c1f40512d21090d1a9b7c&tochange=e299ddd844812c1cd97440fd74eb94e0736fbbe9

Comment 4

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1927195

:debadree333, since you are the author of the regressor, bug 1927195, could you take a look?

For more information, please visit BugBot documentation.

Comment 5

[Jan de Mooij [:jandem]]

This might be related to bug 1934423. There we're adding a missing pre-barrier and this assertion is a failure from the pre-barrier verifier.

Comment 6

[Debadree Chatterjee]

Indeed this is fixed by the patch in bug 1934423. I verified! should i mark this as duplicate? or add the test case mentioned in this bug in another patch?

Comment 7

[Tooru Fujisawa [:arai]]

If these testcases hit the same issue in the same way, there's no need to add this bug's test,
and we can mark this a duplicate.

Comment 8

[Debadree Chatterjee]

Hmm i am not able to confirm that they hit it in the same exact way but the underlying issue is the same it seems! at the very least in this case the assertion is hit from a different path

Comment 9

[Tooru Fujisawa [:arai]]

Okay, let's mark this duplicate.

Comment 10

[Bugmon [:jkratzer for issues]]

No valid actions for resolution (DUPLICATE).
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.