1983221 - Assertion failure: generator->isQueueLengthOne(), at vm/AsyncIteration.cpp:1042

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug stack

var x = newGlobal({ newCompartment: true });
x.eval("async function *f(){}");
var y = Debugger();
y.addDebuggee(x);
y.onEnterFrame = function(a) {
  a.onPop = function(b) {
    b.return.unsafeDereference().throw();
    return b;
  };
};
x.f().return();

(gdb) bt
#0  0x00005555573d72e4 in MOZ_CrashSequence (aAddress=0x0, aLine=1042) at /home/msf2/shell-cache/js-dbg-64-linux-x86_64-5cc1a7909a4e-582522/objdir-js/dist/include/mozilla/Assertions.h:248
#1  js::AsyncGeneratorReturn (cx=cx@entry=0x7ffff5e3c200, argc=<optimized out>, vp=<optimized out>) at /home/msf2/trees/firefox/js/src/vm/AsyncIteration.cpp:1042
#2  0x00005555572f1be5 in CallJSNative (cx=cx@entry=0x7ffff5e3c200, native=0x5555573d7060 <js::AsyncGeneratorReturn(JSContext*, unsigned int, JS::Value*)>, reason=<optimized out>,
    args=...) at /home/msf2/trees/firefox/js/src/vm/Interpreter.cpp:501
#3  0x00005555572cdfa6 in js::InternalCallOrConstruct (cx=0x7ffff5e3c200, args=..., construct=construct@entry=js::NO_CONSTRUCT, reason=js::CallReason::Call)
    at /home/msf2/trees/firefox/js/src/vm/Interpreter.cpp:597
#4  0x00005555572ced08 in InternalCall (cx=<optimized out>, args=..., reason=1042, reason@entry=js::CallReason::Call) at /home/msf2/trees/firefox/js/src/vm/Interpreter.cpp:664
#5  0x00005555572cef24 in js::Call (cx=cx@entry=0x7ffff5e3c200, fval=fval@entry=..., thisv=..., args=..., rval=..., reason=reason@entry=js::CallReason::Call)
    at /home/msf2/trees/firefox/js/src/vm/Interpreter.cpp:696
/snip

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/ce5019292a43
user:        Tooru Fujisawa
date:        Thu Jul 24 05:06:31 2025 +0000
summary:     Bug 1978510 - Part 16: Update the [[AsyncGeneratorState]] variants. r=mgaudet

Run with --fuzzing-safe --no-threads --no-baseline --no-ion, compile with AR=ar sh ~/trees/firefox/js/src/configure --enable-debug --enable-debug-symbols --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests, tested on gh rev 5cc1a7909a4e.

Arai-san, is bug 1978510 a likely regressor?

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1978510

Comment 2

[Tooru Fujisawa [:arai]]

Thanks!
Yeah, the change there introduced another invalid state which can happen with debugger interaction, and which should be filtered out by AsyncGeneratorMethodSanityCheck.

Comment 3

[Tooru Fujisawa [:arai]]

Attachment: Bug 1983221 - Mark async generator with completed and with-requests as invalid. r?mgaudet!

Comment 4

[Tooru Fujisawa [:arai]]

This issue happens only with Debugger API, which is not available to web content.
The DevTools Debugger can trigger similar situation.

Then, even if the situation happens, it just result in the order of the request being skipped/swapped,
as the logic there expects the request just queued is the first request dequeued, but that becomes the 2nd one.
It results in somewhat unexpected result, but it doesn't result in crash, and also this is unspec-ed behavior.
Thus, this is not exploitable.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1978510

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/54c08a4ee268
https://hg.mozilla.org/integration/autoland/rev/777d9e861b57
Mark async generator with completed and with-requests as invalid. r=bthrall

Comment 7

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/777d9e861b57