2013086 - Assertion failure: script->filename(), at firefox/js/src/builtin/ModuleObject.cpp:1084

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Alessio Ghidini]

Attachment: repro.js

Steps to reproduce:

Build a debug JS shell, i used git commit 19e291c2ab258392ea2d2c1aa8120f18f08d3bed, and run the attached sample with ./js --fuzzing-safe repro.js

const g = newGlobal({newCompartment: true});
const dbg = new Debugger();
dbg.addDebuggee(g);

g.evaluate("var x = 1;", {fileName: null});

dbg.findSources()[0].reparse(true);

Actual results:

$ obj-fuzzbuild/dist/bin/js --fuzzing-safe repro.js 
[COV] no shared memory bitmap available, skipping
[COV] edge counters initialized. Shared memory: (null) with 499973 edges
[26224] Assertion failure: script->filename(), at /home/user/firefox/js/src/builtin/ModuleObject.cpp:1084
#01: ???[obj-fuzzbuild/dist/bin/js +0x1fae882]
#02: ???[obj-fuzzbuild/dist/bin/js +0x246c861]
#03: ???[obj-fuzzbuild/dist/bin/js +0x246a842]
#04: ???[obj-fuzzbuild/dist/bin/js +0x246997c]
#05: ???[obj-fuzzbuild/dist/bin/js +0x23f9069]
#06: ???[obj-fuzzbuild/dist/bin/js +0x23f724e]
#07: ???[obj-fuzzbuild/dist/bin/js +0x23c7a68]
#08: JS::CompileModule(JSContext*, JS::ReadOnlyCompileOptions const&, JS::SourceText<char16_t>&)[obj-fuzzbuild/dist/bin/js +0x3775a11]
#09: ???[obj-fuzzbuild/dist/bin/js +0x230e43d]
#10: ???[obj-fuzzbuild/dist/bin/js +0x2312377]
#11: ???[obj-fuzzbuild/dist/bin/js +0x31d945f]
#12: ???[obj-fuzzbuild/dist/bin/js +0x31d8c43]
#13: ???[obj-fuzzbuild/dist/bin/js +0x31edeb2]
#14: ???[obj-fuzzbuild/dist/bin/js +0x31d7d73]
#15: ???[obj-fuzzbuild/dist/bin/js +0x31dbf6a]
#16: ???[obj-fuzzbuild/dist/bin/js +0x31dc5dd]
#17: ???[obj-fuzzbuild/dist/bin/js +0x3591b5a]
#18: JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>)[obj-fuzzbuild/dist/bin/js +0x3591db0]
#19: ???[obj-fuzzbuild/dist/bin/js +0x1dd66fe]
#20: ???[obj-fuzzbuild/dist/bin/js +0x1dd5c3b]
#21: ???[obj-fuzzbuild/dist/bin/js +0x1d8ec74]
#22: ???[obj-fuzzbuild/dist/bin/js +0x1d855e7]
#23: ???[/lib/x86_64-linux-gnu/libc.so.6 +0x2a1ca]
#24: __libc_start_main[/lib/x86_64-linux-gnu/libc.so.6 +0x2a28b]
#25: ???[obj-fuzzbuild/dist/bin/js +0x1d4d2c9]
#26: ??? (???:???)
UndefinedBehaviorSanitizer:DEADLYSIGNAL
==26224==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x634fbd36d89a bp 0x7fffdfe2eab0 sp 0x7fffdfe2ea80 T26224)
==26224==The signal is caused by a WRITE memory access.
==26224==Hint: address points to the zero page.
    #0 0x634fbd36d89a in MOZ_CrashSequence(void*, long) /home/user/firefox/obj-fuzzbuild/dist/include/mozilla/Assertions.h:237:3
    #1 0x634fbd36d89a in js::ModuleObject::initScriptSlots(JS::Handle<JSScript*>) /home/user/firefox/js/src/builtin/ModuleObject.cpp:1084:3
    #2 0x634fbd82b860 in InstantiateTopLevel(JSContext*, js::frontend::CompilationInput&, js::frontend::CompilationStencil const&, js::frontend::CompilationGCOutput&) /home/user/firefox/js/src/frontend/Stencil.cpp:2420:13
    #3 0x634fbd829841 in js::frontend::CompilationStencil::instantiateStencilAfterPreparation(JSContext*, js::frontend::CompilationInput&, js::frontend::CompilationStencil const&, js::frontend::CompilationGCOutput&) /home/user/firefox/js/src/frontend/Stencil.cpp:2850:8
    #4 0x634fbd82897b in js::frontend::CompilationStencil::instantiateStencils(JSContext*, js::frontend::CompilationInput&, js::frontend::CompilationStencil const&, js::frontend::CompilationGCOutput&) /home/user/firefox/js/src/frontend/Stencil.cpp:2757:8
    #5 0x634fbd7b8068 in bool InstantiateStencilsImpl<js::frontend::CompilationStencil const>(JSContext*, js::frontend::CompilationInput&, js::frontend::CompilationStencil const&, js::frontend::CompilationGCOutput&) /home/user/firefox/js/src/frontend/BytecodeCompiler.cpp:486:10
    #6 0x634fbd7b624d in js::frontend::InstantiateStencils(JSContext*, js::frontend::CompilationInput&, js::frontend::CompilationStencil const&, js::frontend::CompilationGCOutput&) /home/user/firefox/js/src/frontend/BytecodeCompiler.cpp:506:10
    #7 0x634fbd7b624d in bool ParseModuleToStencilAndMaybeInstantiate<char16_t>(JSContext*, js::FrontendContext*, js::LifoAlloc&, js::frontend::CompilationInput&, js::frontend::ScopeBindingCache*, JS::SourceText<char16_t>&, mozilla::Variant<RefPtr<js::frontend::CompilationStencil>, js::frontend::CompilationGCOutput*>&) /home/user/firefox/js/src/frontend/BytecodeCompiler.cpp:1204:10
    #8 0x634fbd786a67 in js::ModuleObject* CompileModuleImpl<char16_t>(JSContext*, js::FrontendContext*, JS::ReadOnlyCompileOptions const&, JS::SourceText<char16_t>&) /home/user/firefox/js/src/frontend/BytecodeCompiler.cpp:1316:8
    #9 0x634fbd786a67 in js::frontend::CompileModule(JSContext*, js::FrontendContext*, JS::ReadOnlyCompileOptions const&, JS::SourceText<char16_t>&) /home/user/firefox/js/src/frontend/BytecodeCompiler.cpp:1329:10
    #10 0x634fbeb34a10 in JSObject* CompileModuleHelper<char16_t>(JSContext*, JS::ReadOnlyCompileOptions const&, JS::SourceText<char16_t>&) /home/user/firefox/js/src/vm/Modules.cpp:217:11
    #11 0x634fbeb34a10 in JS::CompileModule(JSContext*, JS::ReadOnlyCompileOptions const&, JS::SourceText<char16_t>&) /home/user/firefox/js/src/vm/Modules.cpp:225:10
    #12 0x634fbd6cd43c in JSScript* ReparseSource<char16_t>(JSContext*, JS::Handle<js::ScriptSourceObject*>, bool) /home/user/firefox/js/src/debugger/Source.cpp:647:24
    #13 0x634fbd6cd43c in js::DebuggerSource::CallData::reparse() /home/user/firefox/js/src/debugger/Source.cpp:675:14
    #14 0x634fbd6d1376 in bool js::DebuggerSource::CallData::ToNative<&js::DebuggerSource::CallData::reparse()>(JSContext*, unsigned int, JS::Value*) /home/user/firefox/js/src/debugger/Source.cpp:199:10
    #15 0x634fbe59845e in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /home/user/firefox/js/src/vm/Interpreter.cpp:490:13
    #16 0x634fbe597c42 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /home/user/firefox/js/src/vm/Interpreter.cpp:586:12
    #17 0x634fbe5aceb1 in js::CallFromStack(JSContext*, JS::CallArgs const&, js::CallReason) /home/user/firefox/js/src/vm/Interpreter.cpp:658:10
    #18 0x634fbe5aceb1 in js::Interpret(JSContext*, js::RunState&) /home/user/firefox/js/src/vm/Interpreter.cpp:3272:16
    #19 0x634fbe596d72 in js::RunScript(JSContext*, js::RunState&) /home/user/firefox/js/src/vm/Interpreter.cpp:460:13
    #20 0x634fbe59af69 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, js::AbstractFramePtr, JS::MutableHandle<JS::Value>) /home/user/firefox/js/src/vm/Interpreter.cpp:850:10
    #21 0x634fbe59b5dc in js::Execute(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) /home/user/firefox/js/src/vm/Interpreter.cpp:880:10
    #22 0x634fbe950b59 in ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) /home/user/firefox/js/src/vm/CompilationAndEvaluation.cpp:548:10
    #23 0x634fbe950daf in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) /home/user/firefox/js/src/vm/CompilationAndEvaluation.cpp:572:10
    #24 0x634fbd1956fd in RunFile(JSContext*, char const*, _IO_FILE*, CompileUtf8, bool, bool) /home/user/firefox/js/src/shell/js.cpp:1387:10
    #25 0x634fbd194c3a in Process(JSContext*, char const*, bool, FileKind) /home/user/firefox/js/src/shell/js.cpp
    #26 0x634fbd14dc73 in ProcessArgs(JSContext*, js::cli::OptionParser*) /home/user/firefox/js/src/shell/js.cpp:12209:10
    #27 0x634fbd14dc73 in Shell(JSContext*, js::cli::OptionParser*) /home/user/firefox/js/src/shell/js.cpp:12462:12
    #28 0x634fbd1445e6 in main /home/user/firefox/js/src/shell/js.cpp:12868:12
    #29 0x7164bec2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #30 0x7164bec2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #31 0x634fbd10c2c8 in _start (/home/user/firefox/obj-fuzzbuild/dist/bin/js+0x1d4d2c8) (BuildId: 5736b8aa283d3e384f29fc7f898bfcc4)

==26224==Register values:
rax = 0x0000000000000000  rbx = 0x00007fffdfe2eae8  rcx = 0x000000000000043c  rdx = 0x00007164bee04563  
rdi = 0x00007164bee05700  rsi = 0x0000000000000000  rbp = 0x00007fffdfe2eab0  rsp = 0x00007fffdfe2ea80  
 r8 = 0x0000000000000000   r9 = 0x0000000000000003  r10 = 0x0000000000000002  r11 = 0x0000000000000293  
r12 = 0x00007fffdfe2eae8  r13 = 0x00007fffdfe2eac0  r14 = 0x000029a74ae8a040  r15 = 0x00007fffdfe2ead0  
UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV /home/user/firefox/obj-fuzzbuild/dist/include/mozilla/Assertions.h:237:3 in MOZ_CrashSequence(void*, long)
==26224==ABORTING

Expected results:

Assertion should not be triggered

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'DevTools::Debugger' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Nicolas Chevobbe [:nchevobbe]]

Bryan, you might know what's happening since you recently worked on ReparseSource ?

Comment 3

[Bryan Thrall [:bthrall]]

It appears that there some extra requirements that reparse(true) should check before it compiles the script as a module. I'll take a look.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1605686

Comment 5

[Bryan Thrall [:bthrall]]

Attachment: Bug 2013086 - When reparsing as a module, check for filename r=arai!

Modules require a filename, see here:

https://searchfox.org/firefox-main/rev/0fce12de99c5e7d74536d8f93cf9778ce6199a1f/js/src/builtin/ModuleObject.cpp#1084

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/ddd9f59c8cc6
https://hg.mozilla.org/integration/autoland/rev/b37e7e80add4
When reparsing as a module, check for filename r=arai

Comment 7

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/b37e7e80add4