2045349 - Release assert !isSome(), at dist/include/mozilla/Maybe.h:1067

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect, P3)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug stack

function f() {
  createShapeSnapshot({
    get a() {},
  })[0] = [];
}
function g() {}
g.toSource = f;
var x = {};
Object.defineProperty(x, "", {
  enumerable: f,
  get: g,
});
x.toSource();
x.toSource();

(gdb) bt
#0  0x00005555579a0a2d in MOZ_CrashSequence (aAddress=0x0, aLine=1067) at /home/ascendubu/shell-cache/js-dbg-64-linux-x86_64-5f6d282f6c9b-630878/objd/dist/include/mozilla/Assertions.h:261
#1  mozilla::Maybe<bool>::emplace<bool> (this=<optimized out>, aArgs=<optimized out>) at /home/ascendubu/shell-cache/js-dbg-64-linux-x86_64-5f6d282f6c9b-630878/objd/dist/include/mozilla/Maybe.h:1067
#2  js::gc::TenuringTracer::AutoSetSourceHeap::AutoSetSourceHeap (this=this@entry=0x7fffffffc680, trc=..., cell=cell@entry=0x3b5a34e00c10) at ./../../../../../../trees/firefox/js/src/gc/Tenuring.cpp:367
#3  0x000055555797d616 in js::gc::TenuringTracer::promoteGetterSetter (this=0x7fffffffcd50, src=0x3b5a34e00c10) at ./../../../../../../trees/firefox/js/src/gc/Tenuring.cpp:1373
#4  0x000055555797d42f in js::gc::TenuringTracer::promoteOrForward (this=0x7ffff7805700 <_IO_stdfile_2_lock>, this@entry=0x7fffffffcd50, gs=0x0, gs@entry=0x3b5a34e00c10) at ./../../../../../../trees/firefox/js/src/gc/Tenuring.cpp:235
#5  0x000055555797d3ef in js::gc::TenuringTracer::onGetterSetterEdge (this=0x7fffffffcd50, gsp=0x7fffffffc700, name=<optimized out>) at ./../../../../../../trees/firefox/js/src/gc/Tenuring.cpp:219
/snip

Bug 2042855 is a likely regressor, I'll bisect more in a bit.

Run with --fuzzing-safe --no-threads --ion-eager, compile with AR=ar sh ~/trees/firefox/js/src/configure --enable-debug --enable-debug-symbols --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests, tested on gh rev 5f6d282f6c9b4146bfe5f54b3d906c4e9ffd33cb.

Jon, is bug 2042855 a likely regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Opt ASan stack

Compile with AR=ar sh ~/trees/firefox/js/src/configure --enable-fuzzing --without-sysroot --enable-address-sanitizer --disable-jemalloc --disable-stdcxx-compat --enable-undefined-sanitizer --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests and also run with --fuzzing-safe --no-threads --ion-eager on gh rev 5f6d282f6c9b4146bfe5f54b3d906c4e9ffd33cb.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

e96a9e97a084-629262
e96a9e97a084515b9ba943abf73bd2a0ad9f7937 is the first interesting commit
commit e96a9e97a084515b9ba943abf73bd2a0ad9f7937
Author: Jon Coppeard
Date:   Fri May 29 06:38:37 2026 +0000

    Bug 2042855 - Part 5: Change buffer allocator trace APIs to not take owner r=sfink

    Now that we don't need to owner's zone for tracing it's only used for the
    source cell's heap location when we are tenuring. We can pass that information
    in the tenuring tracer and remove the owner paramter.

    Differential Revision: https://phabricator.services.mozilla.com/D302823

Guessing gh rev https://github.com/mozilla-firefox/firefox/commit/e96a9e97a084515b9ba943abf73bd2a0ad9f7937 is a possible regressor.

Comment 3

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 2042855

Comment 4

[Andrew McCreight [:mccr8]]

This is a release assert so I'm not sure it can be a sec issue, but I'll leave it hidden until it is investigated a bit.

Comment 5

[Jon Coppeard (:jonco)]

Investigated. This is safe crash not a security issue. The problem is that AutoSetSourceHeap doesn't nest.

Comment 6

[Jon Coppeard (:jonco)]

Attachment: Bug 2045349 - Make AutoSetSourceHeap nest r?sfink

The problem here is that we can try to use this in a nested fashion when
tenuring. The example tenures an object with a class hook that traces a
getter/setter. We use it ones to call the class hook (for edges from the
object) but then we promote the object's getter setter immediately and use it
again with the original one still on the stack.

The fix is to make this nest by storing the previous value.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/72b7de5fa939
https://hg.mozilla.org/integration/autoland/rev/0c10d4208680
Make AutoSetSourceHeap nest r=sfink

Comment 8

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/0c10d4208680