Hermes: Assertion Failure at HandleRootOwner.h:413

[HongxuChen]

Bug Description

When running hermes $JSFILE with some crafted JSFILEs, hermes may trigger the assertion failure.

• [x] I have confirmed this bug does not occur with JSC

Hermes version: 0.7.0 (git ab7c2cfa)
React Native version (if any):
Android version (if any):
Platform (most likely one of arm64-v8a, armeabi-v7a, x86, x86_64): x86_64

Steps To Reproduce

1. Craft a javascript file test.js with the following content:

h = {}
p = new Proxy({}, h)
h.__proto__ = p;
try { p._ } catch {}

1. run ./hermes test.js and it reports:

hermes: /home/hongxu/work/hermes/hermes-asan/include/hermes/VM/HandleRootOwner.h:413: hermes::vm::PinnedHermesValue* hermes::vm::GCScope::newHandle(hermes::vm::HermesValue): Assertion `getHandleCountDbg() < handlesLimit_ && "Too many handles allocated in GCScope"' failed.

The Expected Behavior

No assertion triggered.

[HongxuChen]

see also #279

[mhorowitz]

closed by https://github.com/facebook/hermes/commit/4108bf9b66d16dbddde55e951c247d70aaedc64e

[WilliamParks]

The following code produces the same assertion error on commit b0102191e58f82de45ce16c6ba3b2ab74feeb537

var a = new Proxy([],{valueOf:13.37});
var b = new Proxy(a,Reflect);
for (var c in b) {
}

[WilliamParks]

Here are some additional samples, which trigger the assertion against commit 7d4cb023f9cfc87d2b0e8144ccad3bd329269af8

function main() {
    var v1 = "9";
    var v4 = 0 < 10;
    while (v4 != 1024) {
        v1 += "$1";
        "".replace(/^(.*)/,v1);
        v4++;
    }
}
main();

var v0 = {};
var v3 = {__v_2:1};
var v4 = v3;
var v7 = {};
var v8 = new Proxy(v7,v4);
v0.__proto__ = v8;
function v9() {
    return v0;
}
v4.getPrototypeOf = v9;
var v11 = Object.prototype;
var v12 = v11.isPrototypeOf;
v12.call(0,v8);

var v9 = Array.from("ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789",Array);
var v11 = String.fromCharCode;
var v13 = v11.apply(this,v9);



md5-b8e735b24792e53a699d702db023c375



var v2 = () => {};
var v3 = new Proxy(v2,{});
v0.apply = v3;

[tmikov]

At least a few of these have different causes. We will triage.

[WilliamParks]

In case it helps, here is a directory containing every trigger of that assertion that I've been able to find. handlesLimit.tar.gz

[tmikov]

@WilliamParks, thanks!

BTW, I want to clarify that this specific assertion is intended to diagnose potential waste of resources (handles of heap objects), so it doesn't indicate a crash or incorrect behavior in the release version (fortunately! :-) ).

[mhorowitz]

@WilliamParks can you tell us how you are finding these? Are you using a fuzzer (which one?) or some other technique?

[WilliamParks]

@mhorowitz I've been using a modified version of Fuzzilli