Closed Bug 1813556 Opened 2 years ago Closed 2 years ago

Assertion failure: !tc->isMarkedGray(), at js/src/gc/GC.cpp:5044

Categories

(Core :: JavaScript: GC, defect, P1)

Firefox 111
defect

Tracking

()

RESOLVED FIXED
111 Branch
Tracking Status
firefox-esr102 --- wontfix
firefox109 --- wontfix
firefox110 --- wontfix
firefox111 --- fixed

People

(Reporter: lukas.bernhard, Assigned: jonco)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: regression)

Attachments

(2 files)

Attached file reprl.py (deleted) —

Steps to reproduce:

The following bug is a bit annoying to reproduce, sorry for that. During fuzzing, I encountered an assertion violation at js/src/gc/GC.cpp:5044
Unfortunately, the I only managed to reproduce the crash when supplying 2 separate files via the reprl interface (standard for Fuzzilli fuzzing); neither concatenating nor -f a.js -f b.js worked. I wrote a small python script which instanciates the js-shell in reprl mode and feeds the 2 snippets.
First, there will be an assertion violation at Assertion failure: rt->supportedImportAssertions.ref().empty(), at js/src/vm/Modules.cpp:45. This one in probably unrelated; I removed this assert as it triggers occasionally during fuzzing.
The second assert, !tc->isMarkedGray() seems more interesting.
Bisecting the GC issue points to commit 8d993476b0fca3d388d139a207d8fe838aeb2187 related to bug 1749298. Setting s-s because one other regressor of bug 1749298 was set to sec-high.

Tested on commit fb1e6d6e5735dcf12d96fde70351aca305961b53. The option --enable-js-fuzzilli is required in .mozconfig for enabling the reprl interface.
Note that debugging the issue under rr might not work out of the box because (on my system). rr uses one of the hard-coded fuzzilli file-descriptors
(100, used by fuzzilli for REPRL_CRFD). Changing REPRL_{CRFD, CWFD, DRFD, DWFD} in the attached script and js.cpp allows reproduction under rr.

#0  0x000055555859559d in js::gc::detail::AssertCellIsNotGray (cell=0x1d6a25a67988)
    at js/src/gc/GC.cpp:5044
#1  0x000055555752bb30 in JS::AssertCellIsNotGray (maybeCell=0x1d6a25a67988)
    at obj-x86_64-pc-linux-gnu/dist/include/js/RootingAPI.h:423
#2  0x000055555754f511 in JSContext::enterRealmOf (this=0x7ffff6b2f100, target=0x1d6a25a67988)
    at js/src/vm/JSContext-inl.h:301
#3  0x000055555759cac6 in js::AutoRealm::AutoRealm<JSFunction*> (this=0x7fffffffe680, cx=0x7ffff6b2f100,
    target=@0x7fffffffe690: 0x1d6a25a67988) at js/src/vm/Realm-inl.h:62
#4  0x0000555557520cd9 in MaybeRunFinalizationRegistryCleanupTasks (cx=0x7ffff6b2f100)
    at js/src/shell/js.cpp:1115
#5  0x00005555574f8abe in RunShellJobs (cx=0x7ffff6b2f100)
    at js/src/shell/js.cpp:1162
#6  0x00005555574ea836 in Shell (cx=0x7ffff6b2f100, op=0x7fffffffea58)
    at js/src/shell/js.cpp:11333
#7  0x00005555574e541c in main (argc=8, argv=0x7fffffffed18)
    at js/src/shell/js.cpp:12459
Group: firefox-core-security → core-security
Component: Untriaged → JavaScript: GC
Product: Firefox → Core
Group: core-security → javascript-core-security
Flags: needinfo?(jcoppeard)
Keywords: regression
Regressed by: 1749298

Set release status flags based on info from the regressing bug 1749298

Assignee: nobody → jcoppeard
Flags: needinfo?(jcoppeard)

We need to expose the queued finalization registry callback objects to active JS. The queue itself is a roots but objects can be queue while gray and they won't be marked black until the next GC.

I think black-grey edges just cause null derefs, so I'll unhide this.

Group: javascript-core-security
Blocks: GC
Severity: -- → S3
Priority: -- → P1
Pushed by jcoppeard@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/a5d59a0ec5a3 Expose finalization registry callback objects to active JS r=sfink
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → 111 Branch
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: