2057455 - Assertion failure: CurrentThreadIsGCMarking() || CurrentThreadCanAccessZone(zone) @ gc/Cell.h:475

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect, P3)

Description

[x0e]

Steps to reproduce:

engine version         : 9f2e8c25f0b40fdce8d2f2ca40281e8711815a6d
engine version date    : 2026-07-23T15:46:19Z
build date             : 2026-07-24T10:32:44

Shell args:

--fuzzing-safe <input.js>

Test input:

evalInWorker(`a = Symbol.match\n    addMarkObservers([a])\n    getMarks()`)

Backtrace:

executionHash is 0x1 with 0 inputs
[2970706] Assertion failure: CurrentThreadIsGCMarking() || CurrentThreadCanAccessZone(zone), at spidermonkey/js/src/gc/Cell.h:475
#01: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x1d2df3c]
#02: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x1cebcf1]
#03: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x2d77b45]
#04: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x2d53006]
#05: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x2d62e71]
#06: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x2d52a57]
#07: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x2d5269b]
#08: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x2d554e1]
#09: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x2d5593f]
#10: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x3009b02]
#11: JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>)[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x3009915]
#12: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x1cf23fd]
#13: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x1d1ba3a]
#14: ???[/lib/x86_64-linux-gnu/libc.so.6 +0xa3d64]
#15: ???[/lib/x86_64-linux-gnu/libc.so.6 +0x1373fc]
#16: ??? (???:???)
UndefinedBehaviorSanitizer:DEADLYSIGNAL
==2970706==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x5f25d97d8f54 bp 0x7c0f3fd121e0 sp 0x7c0f3fd121d0 T2970716)
==2970706==The signal is caused by a WRITE memory access.
==2970706==Hint: address points to the zero page.
    #0 0x5f25d97d8f54 in MOZ_CrashSequence(void*, long) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/include/mozilla/Assertions.h:261:3
    #1 0x5f25d97d8f54 in js::gc::TenuredCell::zone() const targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/shell/spidermonkey/js/src/gc/Cell.h:475:3
    #2 0x5f25d97d8f54 in js::gc::Cell::zone() const targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/shell/spidermonkey/js/src/gc/Cell.h:382:24
    #3 0x5f25d9796cf0 in ObserveMarkColor(JS::Value const&) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/shell/./../../../../../../.worktree-repro/js/src/shell/js.cpp:8941:22
    #4 0x5f25d9796cf0 in GetMarks(JSContext*, unsigned int, JS::Value*) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/shell/./../../../../../../.worktree-repro/js/src/shell/js.cpp:8976:25
    #5 0x5f25da822b44 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/vm/spidermonkey/js/src/vm/Interpreter.cpp:498:13
    #6 0x5f25da7fe005 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/vm/spidermonkey/js/src/vm/Interpreter.cpp:594:12
    #7 0x5f25da80de70 in js::CallFromStack(JSContext*, JS::CallArgs const&, js::CallReason) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/vm/spidermonkey/js/src/vm/Interpreter.cpp:666:10
    #8 0x5f25da80de70 in js::Interpret(JSContext*, js::RunState&) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/vm/spidermonkey/js/src/vm/Interpreter.cpp:3280:16
    #9 0x5f25da7fda56 in MaybeEnterInterpreterTrampoline(JSContext*, js::RunState&) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/vm/spidermonkey/js/src/vm/Interpreter.cpp:392:10
    #10 0x5f25da7fd69a in js::RunScript(JSContext*, js::RunState&) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/vm/spidermonkey/js/src/vm/Interpreter.cpp:468:13
    #11 0x5f25da8004e0 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, js::AbstractFramePtr, JS::MutableHandle<JS::Value>) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/vm/spidermonkey/js/src/vm/Interpreter.cpp:858:10
    #12 0x5f25da80093e in js::Execute(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/vm/spidermonkey/js/src/vm/Interpreter.cpp:888:10
    #13 0x5f25daab4b01 in ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/vm/./../../../../../../.worktree-repro/js/src/vm/CompilationAndEvaluation.cpp:544:10
    #14 0x5f25daab4914 in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/vm/./../../../../../../.worktree-repro/js/src/vm/CompilationAndEvaluation.cpp:561:10
    #15 0x5f25d979d3fc in WorkerMain(std::unique_ptr<WorkerInput, JS::DeletePolicy<WorkerInput>>) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/shell/./../../../../../../.worktree-repro/js/src/shell/js.cpp:4776:7
    #16 0x5f25d97c6a39 in void js::detail::ThreadTrampoline<void (&)(std::unique_ptr<WorkerInput, JS::DeletePolicy<WorkerInput>>), std::unique_ptr<WorkerInput, JS::DeletePolicy<WorkerInput>>>::callMain<0ul>(std::integer_sequence<unsigned long, 0ul>) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/shell/spidermonkey/js/src/threading/Thread.h:223:5
    #17 0x5f25d97c6a39 in js::detail::ThreadTrampoline<void (&)(std::unique_ptr<WorkerInput, JS::DeletePolicy<WorkerInput>>), std::unique_ptr<WorkerInput, JS::DeletePolicy<WorkerInput>>>::Start(void*) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/shell/spidermonkey/js/src/threading/Thread.h:212:11
    #18 0x7c0f407a5d63 in start_thread nptl/pthread_create.c:448:8
    #19 0x7c0f408393fb in __GI___clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

==2970706==Register values:
rax = 0x0000000000000000  rbx = 0x00007c0f3f431000  rcx = 0x00000000000001db  rdx = 0x0000000000000000  
rdi = 0x00007c0f40938780  rsi = 0x0000000000000000  rbp = 0x00007c0f3fd121e0  rsp = 0x00007c0f3fd121d0  
 r8 = 0x0000000000000000   r9 = 0x0000000000000000  r10 = 0x0000000000000000  r11 = 0x00007c0f3fd136c0  
r12 = 0x0000000000000001  r13 = 0x000003687d134040  r14 = 0x0000000000000001  r15 = 0x00007c0f3e2aa700  
UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/include/mozilla/Assertions.h:261:3 in MOZ_CrashSequence(void*, long)
==2970706==ABORTING

Comment 1

[Tyson Smith [:tsmith]]

The rating assigned by our bug rating tool (currently under development) is:

Rating: N/A

Explanation: Fuzzer-found crash reproducible only in the SpiderMonkey JS shell. The reproducer relies entirely on shell-only test-harness functions defined in js/src/shell/js.cpp: evalInWorker, addMarkObservers, and getMarks/ObserveMarkColor. The assertion (CurrentThreadIsGCMarking() || CurrentThreadCanAccessZone(zone), Cell.h:475) and subsequent null-page deref occur inside the shell's GC mark-observer debugging feature when a cross-thread/cross-zone cell (Symbol.match) is queried from a worker. This code path and these functions do not exist in Firefox and are not reachable from web content (no WebIDL/pref/content API), so there is no attack vector against browser users. Bad-state assertion in test-only code, not an exploitable engine defect.

Comment 2

[Jon Coppeard (:jonco)]

Shell only, and it's an over eager assertion. This is not security sensitive.

Comment 3

[Jon Coppeard (:jonco)]

Attachment: Bug 2057455 - Allow observing mark state of shared atoms in shell testing functions r?#spidermonkey-reviewers

The cell here can be a shared atom so we need to skip the assertion in zone()
that checks whether the zone is one we have access to. The shared atoms zone
doesn't get GCed until shutdown so we're OK to check its GC state here.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/9f667bd74498
https://hg.mozilla.org/integration/autoland/rev/f9bc36b06763
Allow observing mark state of shared atoms in shell testing functions r=spidermonkey-reviewers,jandem

Comment 5

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/f9bc36b06763