1978873 - Assertion failure: isDouble(), at dist/include/js/Value.h:997

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20250723-92d83833f828 (debug build, run with --fuzzing-safe --ion-offthread-compile=off):

gczeal(15)
enableShellAllocationMetadataBuilder()
gczeal(7, 1)
a = parseModule(``)
moduleLink(a)

Backtrace:

received signal SIGSEGV, Segmentation fault.
0x00005555572f53aa in js::GraphLoadingStateRecordObject::trace(JSTracer*, JSObject*) ()
#0  0x00005555572f53aa in js::GraphLoadingStateRecordObject::trace(JSTracer*, JSObject*) ()
#1  0x0000555557270a53 in JSObject::traceChildren(JSTracer*) ()
#2  0x0000555557a2c56b in JS::TraceChildren(JSTracer*, JS::GCCellPtr) ()
#3  0x0000555557a33d18 in HeapCheckTracerBase::traceHeap(js::gc::AutoHeapSession&) ()
#4  0x0000555557a3468c in js::gc::CheckHeapAfterGC(JSRuntime*) ()
#5  0x000055555796f7a8 in js::gc::GCRuntime::minorGC(JS::GCReason, js::gcstats::PhaseKind) ()
#6  0x0000555556feb15b in void* js::gc::CellAllocator::AllocNurseryOrTenuredCell<(JS::TraceKind)0, (js::AllowGC)1>(JSContext*, js::gc::AllocKind, unsigned long, js::gc::Heap, js::gc::AllocSite*) ()
#7  0x0000555556feaf47 in js::NativeObject* js::gc::CellAllocator::NewObject<js::NativeObject, (js::AllowGC)1>(JSContext*, js::gc::AllocKind, js::gc::Heap, JSClass const*, js::gc::AllocSite*) ()
#8  0x0000555556fea05d in js::NativeObject::create(JSContext*, js::gc::AllocKind, js::gc::Heap, JS::Handle<js::SharedShape*>, js::gc::AllocSite*) ()
#9  0x0000555556fe9bbd in js::PlainObject::createWithShape(JSContext*, JS::Handle<js::SharedShape*>, js::gc::AllocKind, js::NewObjectKind) ()
#10 0x00005555573663bf in js::NewPlainObject(JSContext*, js::NewObjectKind) ()
#11 0x0000555557549cae in ShellAllocationMetadataBuilder::build(JSContext*, JS::Handle<JSObject*>, js::AutoEnterOOMUnsafeRegion&) const ()
#12 0x000055555738ad71 in JS::Realm::setNewObjectMetadata(JSContext*, JS::Handle<JSObject*>) ()
#13 0x0000555556fea7d4 in js::NativeObject* js::SetNewObjectMetadata<js::NativeObject>(JSContext*, js::NativeObject*) ()
#14 0x000055555725af30 in NewObject(JSContext*, JSClass const*, JS::Handle<js::TaggedProto>, js::gc::AllocKind, js::NewObjectKind, js::EnumFlags<js::ObjectFlag>, js::gc::AllocSite*) ()
#15 0x000055555725ad35 in js::NewObjectWithGivenTaggedProto(JSContext*, JSClass const*, JS::Handle<js::TaggedProto>, js::gc::AllocKind, js::NewObjectKind, js::EnumFlags<js::ObjectFlag>) ()
#16 0x00005555573479ed in js::GraphLoadingStateRecordObject* js::detail::NewObjectWithGivenTaggedProtoForKind<js::GraphLoadingStateRecordObject, (js::NewObjectKind)0>(JSContext*, JS::Handle<js::TaggedProto>) ()
#17 0x00005555572f542d in js::GraphLoadingStateRecordObject::create(JSContext*, bool, unsigned int, std::function<bool (JSContext*, JS::Handle<JS::Value>)>&&, std::function<bool (JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>)>&&, JS::Handle<JS::Value>) ()
#18 0x00005555572c7a38 in js::LoadRequestedModules(JSContext*, JS::Handle<js::ModuleObject*>, JS::Handle<JS::Value>, std::function<bool (JSContext*, JS::Handle<JS::Value>)>&&, std::function<bool (JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>)>&&) ()
#19 0x00005555572c78e4 in JS::LoadRequestedModules(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, std::function<bool (JSContext*, JS::Handle<JS::Value>)>&&, std::function<bool (JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>)>&&) ()
#20 0x0000555556ef36e6 in ModuleLink(JSContext*, unsigned int, JS::Value*) ()
#21 0x000055555703d0d5 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) ()
[...]
#32 0x0000555556ebad76 in main ()
rax	0x0	0
rbx	0x7fffffffc580	140737488340352
rcx	0x3e5	997
rdx	0x1	1
rsi	0x0	0
rdi	0x7ffff75fb7d0	140737343633360
rbp	0x7fffffffc4a0	140737488340128
rsp	0x7fffffffc490	140737488340112
r8	0x0	0
r9	0x3	3
r10	0x0	0
r11	0x0	0
r12	0x5555589640a0	93825046823072
r13	0x8	8
r14	0x3a6562e640e0	64207125364960
r15	0x3a6562e627e0	64207125358560
rip	0x5555572f53aa <js::GraphLoadingStateRecordObject::trace(JSTracer*, JSObject*)+186>
=> 0x5555572f53aa <_ZN2js29GraphLoadingStateRecordObject5traceEP8JSTracerP8JSObject+186>:	mov    %rcx,(%rax)
   0x5555572f53ad <_ZN2js29GraphLoadingStateRecordObject5traceEP8JSTracerP8JSObject+189>:	callq  0x555556f56940 <abort>

Happening fairly frequently, marking as fuzzblocker.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20250723155040-c6c802b9d454.
The bug appears to have been introduced in the following build range:

Start: fee138a89199f7e6da817b60969277ddf468d473 (20250722182919)
End: ce0ee8e87702d0c470573542f420bc5b5c97878d (20250722184114)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=fee138a89199f7e6da817b60969277ddf468d473&tochange=ce0ee8e87702d0c470573542f420bc5b5c97878d

Comment 4

[Jan de Mooij [:jandem]]

Yoshi, this might be a regression from the module loader refactoring.

Comment 5

[Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi]]

Attachment: (secure)

Comment 6

[Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi]]

Attachment: (secure)

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1820594

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/4804ff605dc6
https://hg.mozilla.org/integration/autoland/rev/8de147c87912
Check the value of the StateSlot first. r=jonco
https://github.com/mozilla-firefox/firefox/commit/0511de4815f7
https://hg.mozilla.org/integration/autoland/rev/ab358c490493
Test. r=jonco
https://github.com/mozilla-firefox/firefox/commit/943c36aa2ffe
https://hg.mozilla.org/integration/autoland/rev/fa0563bd77ba
apply code formatting via Lando

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/8de147c87912
https://hg.mozilla.org/mozilla-central/rev/ab358c490493
https://hg.mozilla.org/mozilla-central/rev/fa0563bd77ba

Comment 10

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20250724212906-2c28b9cc7958.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.