2044833 - Assertion failure: wrapper->is<WrapperObject>(), at js/src/proxy/Wrapper.cpp:287

Status: RESOLVED DUPLICATE of bug 2039836

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20260527-7a75e5d0dc02 (debug build, run with --fuzzing-safe --ion-offthread-compile=off --more-compartments test.js):

nukeAllCCWs()
newGlobal({
    transplantWindowProxy: this
})

Backtrace:

received signal SIGSEGV, Segmentation fault.
0x000061ef2a27fb24 in js::Wrapper::wrappedObject(JSObject*) ()
#0  0x000061ef2a27fb24 in js::Wrapper::wrappedObject(JSObject*) ()
#1  0x000061ef2946f31e in JS_TransplantObject(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>) ()
#2  0x000061ef293708f7 in NewGlobalObject(JSContext*, JS::RealmOptions&, JSPrincipals*, ShellGlobalKind, bool, JS::Handle<JSObject*>) ()
#3  0x000061ef29387729 in NewGlobal(JSContext*, unsigned int, JS::Value*) ()
#4  0x000061ef2a296455 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) ()
[...]
#16 0x000061ef29348a6e in main ()
rax	0x0	0
rbx	0x7f67e6c42200	140084229972480
rcx	0x11f	287
rdx	0x7f67eff09723	140084383880995
rsi	0x0	0
rdi	0x7f67eff0aa60	140084383885920
rbp	0x7fff34ee1a60	140734081407584
rsp	0x7fff34ee1a10	140734081407504
r8	0x69	105
r9	0x0	0
r10	0x0	0
r11	0x18	24
r12	0x7f67e5a0d000	140084210880512
r13	0x7fff34ee1ac0	140734081407680
r14	0x13921aa00958	21518232848728
r15	0x61ef27e8abb3	107679794637747
rip	0x61ef2a27fb24 <js::Wrapper::wrappedObject(JSObject*)+964>
=> 0x61ef2a27fb24 <_ZN2js7Wrapper13wrappedObjectEP8JSObject+964>:	mov    %rcx,(%rax)
   0x61ef2a27fb27 <_ZN2js7Wrapper13wrappedObjectEP8JSObject+967>:	call   0x61ef293ebe60 <abort>

I assume this is some kind of testing-only issue but it's frequent and blocking fuzzing.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20260527085321-7a75e5d0dc02) but not with tip (mozilla-central 20260603204655-14f381ab3699.)

The bug appears to have been fixed in the following build range:

Start: 7a75e5d0dc02cefe2d13353043bd67fb5432df44 (20260527085321)
End: 4ea9b253f7f49c31cb644509cbc6f566f9ee7fdf (20260527095816)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=7a75e5d0dc02cefe2d13353043bd67fb5432df44&tochange=4ea9b253f7f49c31cb644509cbc6f566f9ee7fdf

decoder, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 4

[Jan de Mooij [:jandem]]

Fix bisection range is wrong but this is bug 2039836.