2057458 - Assertion failure: obj->asTenured().arena()->onDelayedMarkingList() @ gc/GC.cpp:3756

Reporter

Description

•

3 months ago

Steps to reproduce:

engine version         : 9f2e8c25f0b40fdce8d2f2ca40281e8711815a6d
engine version date    : 2026-07-23T15:46:19Z
build date             : 2026-07-24T10:32:44

Shell args:

--fuzzing-safe --ion-check-range-analysis --ion-extra-checks --disable-oom-functions --asmjs --fast-warmup <input.js>

Test input:

function a() {}
function b() { this.c = a }
d = new b
e = enqueueMark
try {
  e(d)
} catch {
}
setMarkStackLimit(16)
gc()

Backtrace:

Warning: Ignoring unknown shell flag: --asmjs
[2965930] Assertion failure: obj->asTenured().arena()->onDelayedMarkingList(), at .worktree-repro/js/src/gc/GC.cpp:3756
#01: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x236e58a]
#02: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x236d22b]
#03: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x236cf2b]
#04: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x2373cfa]
#05: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x2377902]
#06: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x2379275]
#07: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x235edef]
#08: JS::NonIncrementalGC(JSContext*, JS::GCOptions, JS::GCReason)[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x237f5dc]
#09: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x1fb0c9d]
#10: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x2d77b45]
#11: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x2d53006]
#12: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x2d62e71]
#13: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x2d52a57]
#14: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x2d5269b]
#15: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x2d554e1]
#16: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x2d5593f]
#17: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x3009b02]
#18: JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>)[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x3009ce9]
#19: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x1d04c0e]
#20: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x1d03f09]
#21: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x1cbc4ea]
#22: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x1cb43e0]
#23: ???[/lib/x86_64-linux-gnu/libc.so.6 +0x2a575]
#24: __libc_start_main[/lib/x86_64-linux-gnu/libc.so.6 +0x2a628]
#25: ???[targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js +0x1c7a169]
#26: ??? (???:???)
UndefinedBehaviorSanitizer:DEADLYSIGNAL
==2965930==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x611ab0de65a2 bp 0x7ffcd7b32760 sp 0x7ffcd7b326c0 T2965930)
==2965930==The signal is caused by a WRITE memory access.
==2965930==Hint: address points to the zero page.
    #0 0x611ab0de65a2 in MOZ_CrashSequence(void*, long) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/include/mozilla/Assertions.h:261:3
    #1 0x611ab0de65a2 in js::gc::GCRuntime::processTestMarkQueue() targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/gc/./../../../../../../.worktree-repro/js/src/gc/GC.cpp:3756:9
    #2 0x611ab0de522a in js::gc::GCRuntime::markSynchronously(JS::SliceBudget&, js::gc::GCRuntime::ParallelMarking, js::gc::ShouldReportMarkTime) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/gc/./../../../../../../.worktree-repro/js/src/gc/GC.cpp:3611:7
    #3 0x611ab0de4f2a in js::gc::GCRuntime::markPhase(JS::SliceBudget&) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/gc/./../../../../../../.worktree-repro/js/src/gc/GC.cpp:3578:3
    #4 0x611ab0debcf9 in js::gc::GCRuntime::incrementalSlice(JS::SliceBudget&, JS::GCReason, bool) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/gc/./../../../../../../.worktree-repro/js/src/gc/GC.cpp:4461:11
    #5 0x611ab0def901 in js::gc::GCRuntime::gcCycle(bool, JS::SliceBudget const&, JS::GCReason) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/gc/./../../../../../../.worktree-repro/js/src/gc/GC.cpp:5076:3
    #6 0x611ab0df1274 in js::gc::GCRuntime::collect(bool, JS::SliceBudget const&, JS::GCReason) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/gc/./../../../../../../.worktree-repro/js/src/gc/GC.cpp:5260:9
    #7 0x611ab0dd6dee in js::gc::GCRuntime::gc(JS::GCOptions, JS::GCReason) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/gc/./../../../../../../.worktree-repro/js/src/gc/GC.cpp:5340:3
    #8 0x611ab0df75db in JS::NonIncrementalGC(JSContext*, JS::GCOptions, JS::GCReason) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/gc/./../../../../../../.worktree-repro/js/src/gc/GCAPI.cpp:299:21
    #9 0x611ab0a28c9c in GC(JSContext*, unsigned int, JS::Value*) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/builtin/./../../../../../../.worktree-repro/js/src/builtin/TestingFunctions.cpp:813:3
    #10 0x611ab17efb44 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/vm/spidermonkey/js/src/vm/Interpreter.cpp:498:13
    #11 0x611ab17cb005 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/vm/spidermonkey/js/src/vm/Interpreter.cpp:594:12
    #12 0x611ab17dae70 in js::CallFromStack(JSContext*, JS::CallArgs const&, js::CallReason) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/vm/spidermonkey/js/src/vm/Interpreter.cpp:666:10
    #13 0x611ab17dae70 in js::Interpret(JSContext*, js::RunState&) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/vm/spidermonkey/js/src/vm/Interpreter.cpp:3280:16
    #14 0x611ab17caa56 in MaybeEnterInterpreterTrampoline(JSContext*, js::RunState&) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/vm/spidermonkey/js/src/vm/Interpreter.cpp:392:10
    #15 0x611ab17ca69a in js::RunScript(JSContext*, js::RunState&) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/vm/spidermonkey/js/src/vm/Interpreter.cpp:468:13
    #16 0x611ab17cd4e0 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, js::AbstractFramePtr, JS::MutableHandle<JS::Value>) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/vm/spidermonkey/js/src/vm/Interpreter.cpp:858:10
    #17 0x611ab17cd93e in js::Execute(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/vm/spidermonkey/js/src/vm/Interpreter.cpp:888:10
    #18 0x611ab1a81b01 in ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/vm/./../../../../../../.worktree-repro/js/src/vm/CompilationAndEvaluation.cpp:544:10
    #19 0x611ab1a81ce8 in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/vm/./../../../../../../.worktree-repro/js/src/vm/CompilationAndEvaluation.cpp:568:10
    #20 0x611ab077cc0d in RunFile(JSContext*, char const*, _IO_FILE*, CompileUtf8, bool, bool) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/shell/./../../../../../../.worktree-repro/js/src/shell/js.cpp:1429:10
    #21 0x611ab077bf08 in Process(JSContext*, char const*, bool, FileKind) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/shell/./../../../../../../.worktree-repro/js/src/shell/js.cpp
    #22 0x611ab07344e9 in ProcessArgs(JSContext*, js::cli::OptionParser*) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/shell/./../../../../../../.worktree-repro/js/src/shell/js.cpp:12197:10
    #23 0x611ab07344e9 in Shell(JSContext*, js::cli::OptionParser*) targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/shell/./../../../../../../.worktree-repro/js/src/shell/js.cpp:12476:12
    #24 0x611ab072c3df in main targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/js/src/shell/./../../../../../../.worktree-repro/js/src/shell/js.cpp:12909:12
    #25 0x7b62cfe69574 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #26 0x7b62cfe69627 in __libc_start_main csu/../csu/libc-start.c:360:3
    #27 0x611ab06f2168 in _start (targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/bin/js+0x1c7a168) (BuildId: 0b63a60c4f7a9405fc4bcaed4bebea83)

==2965930==Register values:
rax = 0x0000000000000000  rbx = 0x00007b62cec387b8  rcx = 0x0000000000000eac  rdx = 0x0000000000000000  
rdi = 0x00007b62d0075780  rsi = 0x0000000000000000  rbp = 0x00007ffcd7b32760  rsp = 0x00007ffcd7b326c0  
 r8 = 0x0000000000000000   r9 = 0x0000000000000000  r10 = 0x0000000000000000  r11 = 0x00007b62cfe3a880  
r12 = 0xaaaaaaaaaaaaaaaa  r13 = 0x00007b62cec5abe0  r14 = 0x0000285398f1f000  r15 = 0x0000285398f1f040  
UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV targets/spidermonkey/artifacts/builds/reproducebuild-9f2e8c25f0b4/dist/include/mozilla/Assertions.h:261:3 in MOZ_CrashSequence(void*, long)
==2965930==ABORTING

Tom Schuster [:tschuster]

Updated

•

3 months ago

Group: core-security → javascript-core-security

Keywords: reporter-external

Tyson Smith [:tsmith]

Comment 1

•

3 months ago

The de-dupe tool thinks this is an incomplete fix of bug 2048473.

This is the same underlying issue: the fix for bug 2048473 was incomplete and the identical incorrect assertion still fires. Although bug 2048473 is FIXED, the "fixed-before-filing" heuristic exists to avoid pairing different root causes that happen to share a line — here the assertion string, function, stack, and root cause are all identical, and the fix demonstrably did not remove the assertion.

Andrew McCreight [:mccr8]

Updated

•

3 months ago

Flags: needinfo?(sphink)

Tyson Smith [:tsmith]

Updated

•

3 months ago

Duplicate of this bug: 2058396

Gustavo Tonietto (he/him) [:gtonietto] [:tonietto]

Updated

•

3 months ago

Blocks: GC, sm-security

Severity: -- → S3

Priority: -- → P3

Jan de Mooij [:jandem]

Updated

•

3 months ago

Duplicate of this bug: 2058599

Daniel Veditz [:dveditz]

Updated

•

3 months ago

Comment 4

•

3 months ago

Spurious test-only assertion.

I have a markOneObjectForTest() function that unfortunately cannot ensure that it only marks a single object. Here, it marks the object, but then needs to traverse it (since otherwise nothing else ever will, given that it's already marked). Traversal eagerly marks fixed slots.

I replaced the assertion with a comment, and I'm opening up this bug.

Group: javascript-core-security

Flags: needinfo?(sphink)

Steve Fink [:sfink] [:s:]

Assignee

Comment 5

•

3 months ago

Attached file Bug 2057458 - Remove assertion that depends on marking only a single object for testing r=#spidermonkey-reviewers — Details

Phabricator Automation

Updated

•

3 months ago

Assignee: nobody → sphink

Status: NEW → ASSIGNED

Pulsebot

Comment 6

•

3 months ago

Pushed by sfink@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/73dc906c1a0b https://hg.mozilla.org/integration/autoland/rev/fc5dbd1fd92a Remove assertion that depends on marking only a single object for testing r=spidermonkey-reviewers,jonco

Pulsebot

Comment 7

•

3 months ago

Pushed by rperta@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/69d609307119 https://hg.mozilla.org/integration/autoland/rev/ee1afe23c1e5 Revert "Bug 2057458 - Remove assertion that depends on marking only a single object for testing r=spidermonkey-reviewers,jonco" for causing build bustages at bug2057458.js

rperta

Comment 8

•

3 months ago

Backed out for causing build bustages at bug2057458.js
Backout link
Push with failures
Failure log(s)

Flags: needinfo?(sphink)

Steve Fink [:sfink] [:s:]

Assignee

Comment 9

•

3 months ago

Hm, I wonder if we could add a landing check for using DEBUG-only testing functions without any guards.

...though I guess we have lots of ways to write those guards...

Flags: needinfo?(sphink)

Pulsebot

Comment 10

•

3 months ago

Pushed by sfink@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/43acc0f70c6a https://hg.mozilla.org/integration/autoland/rev/b4302e87f496 Remove assertion that depends on marking only a single object for testing r=spidermonkey-reviewers,jonco

pstanciu

Comment 11

•

3 months ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/fc5dbd1fd92a

Status: ASSIGNED → RESOLVED

Closed: 3 months ago

status-firefox155: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → 155 Branch

Pulsebot

Comment 12

•

3 months ago

Pushed by rperta@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/40b9956d8380 https://hg.mozilla.org/integration/autoland/rev/536d6f4f97e1 Revert "Bug 2057458 - Remove assertion that depends on marking only a single object for testing r=spidermonkey-reviewers,jonco" for causing spidermonkey build bustages

rperta

Updated

•

3 months ago

Status: RESOLVED → REOPENED

status-firefox155: fixed → ---

Resolution: FIXED → ---

Target Milestone: 155 Branch → ---

Pulsebot

Comment 13

•

3 months ago

Pushed by pstanciu@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/fcddc9cb649c https://hg.mozilla.org/mozilla-central/rev/bb3ac5a217ff Revert "Bug 2057458 - Remove assertion that depends on marking only a single object for testing r=spidermonkey-reviewers,jonco" for causing build bustages at bug2057458.js

Pulsebot

Comment 14

•

3 months ago

Pushed by sfink@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/d9c12776afaf https://hg.mozilla.org/integration/autoland/rev/a0b0004d0c47 Remove assertion that depends on marking only a single object for testing r=spidermonkey-reviewers,jonco

Pulsebot

Comment 15

•

3 months ago

Pushed by csabou@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/d640577f2f27 https://hg.mozilla.org/integration/autoland/rev/c9071d5ebeab Revert "Bug 2057458 - Remove assertion that depends on marking only a single object for testing r=spidermonkey-reviewers,jonco" for causing failures on bug2057458.js IGNORE BAD COMMIT MESSAGES

Cosmin Sabou [:CosminS]

Comment 16

•

3 months ago

Backed out for causing failures on bug2057458.js

Push with failures

Failure log

Backout link

Flags: needinfo?(sphink)

Steve Fink [:sfink] [:s:]

Assignee

Comment 17

•

2 months ago

Die, zombie bug, die!!!

I got caught out by gczeal. It can start a new GC before setMarkStackLimit() is called, and that causes an error.

This time, I'm doing a try push for this silly test.

Pulsebot

Comment 18

•

2 months ago

Pushed by sfink@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/23949aa42363 https://hg.mozilla.org/integration/autoland/rev/28ecdf292567 Remove assertion that depends on marking only a single object for testing r=spidermonkey-reviewers,jonco

Cosmin Sabou [:CosminS]

Comment 19

•

2 months ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/28ecdf292567

Status: REOPENED → RESOLVED

Closed: 3 months ago → 2 months ago

status-firefox156: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → 156 Branch