926779 - "Assertion failure: thing" with schedulegc, crypto exception

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: q10-p.html

1. Install https://www.squarefree.com/extensions/domFuzzLite3.xpi
2. Load the testcase

Assertion failure: thing, at js/src/gc/Marking.cpp:125

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Andrew McCreight [:mccr8]]

The stack includes mozilla::dom::TypedArrayObjectStorage::TraceSelf.

Comment 3

[Andrew McCreight [:mccr8]]

Hitting an unexpected null doesn't sound too bad.

Comment 4

[Jason Orendorff [:jorendorff]]

Looks unexploitable (and fairly easy to patch).

Comment 5

[Jason Orendorff [:jorendorff]]

Unhiding.

Comment 6

[Jason Orendorff [:jorendorff]]

Needs an owner. I can promise a quick review.

Comment 7

[Andrew McCreight [:mccr8]]

This may be a dupe of another bug that was fixed, where it was forwarding to the wrong window, so somebody should retest.

Comment 8

[Andrew McCreight [:mccr8]]

Bug 927901 that is.

Comment 9

[Terrence Cole [:terrence]]

Attachment: typedarray_object_null_marking-v0.diff

Yeah, this is pretty silly. The code in |getRandomValues| is doing:

  RootedTypedArray<ArrayBufferView > arg0(cx);
  if (!args[0].isObject()) {
    ThrowErrorMessage(cx, MSG_NOT_OBJECT, "Argument 1 of Crypto.getRandomValues");
    // Crash happens ^^ when we GC with a default constructed ArrayBufferView
    // on stack because it tries to mark nullptr.
    return false;
  }

I think the right fix is to make the default constructed view safely traceable.

Comment 10

[Eric Faust [:efaust]]

Comment on attachment 823394 [details] [diff] [review]
typedarray_object_null_marking-v0.diff

Review of attachment 823394 [details] [diff] [review]:
-----------------------------------------------------------------

r=me. This seems like a fairly innocuous-looking use case, and in general, I think it's important that all default-constructed rooteds be tracable without everything blowing up.

Comment 11

[Terrence Cole [:terrence]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0147aa726de1

Comment 12

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/0147aa726de1

Comment 13

[Paul Silaghi, QA [:pauly]]

Reproduced on Nightly 2013-10-14-mozilla-central-debug.
Verified fixed Nightly 2013-12-08-mozilla-central-debug, Win 7 x64.