1941891 - Frequent unreliable use-after-poison reports

Status: RESOLVED DUPLICATE of bug 1941876

(Core :: JavaScript: GC, defect, P1)

Description

[Tyson Smith [:tsmith] (PTO -> Sept/8)]

Attachment: hbo-01.txt

The browser fuzzers started frequent reporting unreproducible use-after-poison issues with m-c 20250108-810abd1d3a1b.

I've been waiting for the reducer to provide a good test case but no luck. I've also tried to get a rr trace for a Pernosco session but couldn't reproduce the issue.

In addition to the use-after-poisons I've also seen assertions and a heap-buffer-overflow.

All reports I've checked have javascript.options.mem.gc_zeal.mode a value of 19, 21, 22 or 23 so far.

Comment 1

[Tyson Smith [:tsmith] (PTO -> Sept/8)]

Attachment: uap-01.txt

Comment 2

[Tyson Smith [:tsmith] (PTO -> Sept/8)]

Attachment: uap-02.txt

Comment 3

[Tyson Smith [:tsmith] (PTO -> Sept/8)]

Attachment: uap-03.txt

Comment 4

[Tyson Smith [:tsmith] (PTO -> Sept/8)]

Attachment: uap-04.txt

Comment 5

[Tyson Smith [:tsmith] (PTO -> Sept/8)]

Attachment: assert-01.txt

Comment 6

[Andrew McCreight [:mccr8]]

The assertion has also shown up in automation.

Comment 7

[Daniel Veditz [:dveditz]]

mccr8 strongly suspects bug 1934856 based on symptoms and timing.

Comment 8

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1934856

:jonco, since you are the author of the regressor, bug 1934856, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 9

[Jon Coppeard (:jonco) (PTO until 14th September)]

It's just possible this is the same issue as bug 1941876 as that can cause UAF, although the stacks are different so it's not that likely.

Any way of reproducing this would be great.

Comment 10

[Steven DeTar [:sdetar]]

After talking to others, I am making this S3. If this becomes sec-high then we move it back to S2.

Comment 11

[Tyson Smith [:tsmith] (PTO -> Sept/8)]

The fuzzers have stopped reporting this issue. The last report was from m-c 20250118-1c4cbc5b7ae6.

Comment 12

[Andrew McCreight [:mccr8]]

Thanks for checking. That more or less aligns with comment 9, so I'll dupe it over.