1969353 - Assertion failure: !hasBuiltinProto(kind), at vm/GlobalObject.h:296

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug stack

for (var i of []) {}
oomTest(
  function () {
    eval("(async function*(){})");
  },
  { keepFailing: true },
);

(gdb) bt
#0  0x00005555573e8525 in MOZ_CrashSequence (aAddress=0x0, aLine=296)
    at /home/msf1/shell-cache/js-dbg-64-linux-x86_64-3f2fd0c018c9/objdir-js/dist/include/mozilla/Assertions.h:248
#1  js::GlobalObject::initBuiltinProto (this=0x74b1dc40030, kind=<optimized out>, proto=0x74b1dc43388)
    at /home/msf1/trees/mozilla-central/js/src/vm/GlobalObject.h:296
#2  0x00005555574328ee in js::GlobalObject::setAsyncGeneratorPrototype (this=0x7ffff7805700 <_IO_stdfile_2_lock>, obj=0x7ffff7804563 <_IO_2_1_stderr_+131>)
    at /home/msf1/trees/mozilla-central/js/src/vm/GlobalObject.h:872
#3  AsyncGeneratorFunctionClassFinish (cx=0x7ffff5e3a200, asyncGenFunction=..., asyncGenerator=...)
    at /home/msf1/trees/mozilla-central/js/src/vm/AsyncIteration.cpp:1130
#4  0x00005555574f9dc5 in js::GlobalObject::resolveConstructor (cx=0x7ffff5e3a200, global=..., key=JSProto_AsyncGeneratorFunction, mode=<optimized out>)
    at /home/msf1/trees/mozilla-central/js/src/vm/GlobalObject.cpp:415
#5  0x000055555758a724 in js::GlobalObject::ensureConstructor (cx=0x7ffff5e3a200, global=..., key=JSProto_AsyncGeneratorFunction)
    at /home/msf1/trees/mozilla-central/js/src/vm/GlobalObject.h:358
/snip

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/a974d7ebb75d
user:        Matthew Gaudet
date:        Mon Nov 25 18:49:32 2024 +0000
summary:     Bug 1928852 - Guard against double initialization of protos r=jandem

Run with --fuzzing-safe --no-threads --no-baseline --no-ion, compile with AR=ar sh ../configure --enable-debug --enable-debug-symbols --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests, tested on m-c rev 3f2fd0c018c9.

Matt, is bug 1928852 a likely regressor?

Comment 1

[Matthew Gaudet (he/him) [:mgaudet]]

Basically bug is as follows:

1. We successfully run the finishInitHook, which run AsyncGeneratorFunctionClassFinish, which sets the AsyncGeneratorPrototype.
2. We however do not succeed in resolving the constructor because we fail to set the UsedAsPrototype flag (unable edit hash table because of oom).
3. Then we try again because we're in an oomTest, and so we end up re-creating the async generator prototype.

We sort of foresaw this possibility when we landed https://phabricator.services.mozilla.com/D228736 (comment points at it)

I guess it's time to remove this. Patch inbound.

Comment 2

[Matthew Gaudet (he/him) [:mgaudet]]

Not security sensitive as it's just double initialization we'd rather not have but is sort of unavoidable while we do small-oom recovery.

Comment 3

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: Bug 1969353 - Allow double initialization of builtin protos as a side effect of small OOM recovery r?jandem

Comment 4

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1928852

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/dd04ed62b76c
https://hg.mozilla.org/integration/autoland/rev/43ee34b22c20
Allow double initialization of builtin protos as a side effect of small OOM recovery r=jandem

Comment 6

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/43ee34b22c20