821013 - "Assertion failure: !InNoGCScope(),"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

for each(let c in [
    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
    0, 0, 0, 0, 0, 0, 0, 0, 0, ({'0': 0})
]) {}

asserts js debug shell on m-c changeset 1cc19f36ee66 with --no-jm at Assertion failure: !InNoGCScope(),

s-s because GC is in the stack. I'll leave it up to the devs or someone else to take a stab at the security rating.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   115711:9602f98a6a70
user:        Terrence Cole
date:        Wed Dec 05 14:21:44 2012 -0800
summary:     Bug 819118 - Use accessor rather than direct script access; r=billm

Comment 1

[Christian Holler (:decoder)]

Cannot process bug: Unable to reproduce bug on original revision.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Christian Holler (:decoder) from comment #1)
> Cannot process bug: Unable to reproduce bug on original revision.

I can definitely reproduce this, on Mac 64-bit. It's showing up on the tinderbox shells as well, at least for Linux 32-bit and Mac 64-bit. This is pretty easy to trigger.

Comment 3

[Christian Holler (:decoder)]

The problem might be that Bugmon doesn't try --no-jm

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Christian Holler (:decoder) from comment #3)
> The problem might be that Bugmon doesn't try --no-jm

Yes, that's the issue. The assertion goes away without --no-jm.

Comment 5

[Christian Holler (:decoder)]

Added the option, let's give it a try.

Comment 6

[Terrence Cole [:terrence]]

Good find.  Not sec-sensitive until we turn on exact rooting.

Comment 7

[Terrence Cole [:terrence]]

Attachment: v0

Root the script, since elementWriteIsDenseArray can GC.

Comment 8

[Terrence Cole [:terrence]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b2b21508b90b

Comment 9

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/b2b21508b90b

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Test got landed -> VERIFIED and in-testsuite+.