1370905 - Assertion failure: !cx->isExceptionPending(), at js/src/jscntxtinlines.h:296 with Debugger and OOM

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 5801aa478de1 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-stdcxx-compat --disable-profiling --enable-debug --enable-optimize, run with --fuzzing-safe --ion-offthread-compile=off):

var lfLogBuffer = `
var global = newGlobal();
global.eval('function f() { debugger; }');
var debug = new Debugger(global);
function evalAndNoteScripts(prog) {
    debug.onDebuggerStatement = function(frame) {
            oomAfterAllocations(50);
            scripts.argument = frame.arguments[0].script;
    };
    global.eval(prog);
}
var scripts = evalAndNoteScripts('f(f)');
`;
loadFile(lfLogBuffer);
function loadFile(lfVarx) {
    oomTest(new Function(lfVarx));
}



Backtrace:

 received signal SIGSEGV, Segmentation fault.
0x000000000054040e in js::CallJSNative (cx=cx@entry=0x7ffff6924000, native=0xb059d0 <js::DebuggerFrame::argumentsGetter(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:296
#0  0x000000000054040e in js::CallJSNative (cx=cx@entry=0x7ffff6924000, native=0xb059d0 <js::DebuggerFrame::argumentsGetter(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:296
#1  0x00000000005351d3 in js::InternalCallOrConstruct (cx=cx@entry=0x7ffff6924000, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:470
#2  0x00000000005355e8 in InternalCall (cx=cx@entry=0x7ffff6924000, args=...) at js/src/vm/Interpreter.cpp:515
#3  0x000000000053571d in js::Call (cx=cx@entry=0x7ffff6924000, fval=..., fval@entry=..., thisv=..., thisv@entry=..., args=..., rval=..., rval@entry=...) at js/src/vm/Interpreter.cpp:534
#4  0x00000000005358bc in js::CallGetter (cx=cx@entry=0x7ffff6924000, thisv=thisv@entry=..., getter=getter@entry=..., rval=rval@entry=...) at js/src/vm/Interpreter.cpp:649
#5  0x0000000000b8c449 in CallGetter (vp=..., shape=..., receiver=..., obj=..., cx=0x7ffff6924000) at js/src/vm/NativeObject.cpp:2019
#6  GetExistingProperty<(js::AllowGC)1> (cx=0x7ffff6924000, receiver=..., obj=..., shape=..., vp=...) at js/src/vm/NativeObject.cpp:2067
#7  0x0000000000b8d17f in NativeGetPropertyInline<(js::AllowGC)1> (cx=0x7ffff6924000, obj=..., receiver=..., id=..., nameLookup=nameLookup@entry=NotNameLookup, vp=...) at js/src/vm/NativeObject.cpp:2298
#8  0x0000000000b8d960 in js::NativeGetProperty (cx=<optimized out>, obj=..., receiver=..., id=..., vp=...) at js/src/vm/NativeObject.cpp:2332
#9  0x00000000005388d4 in js::GetProperty (cx=<optimized out>, obj=..., receiver=..., id=..., vp=...) at js/src/vm/NativeObject.h:1543
#10 0x00000000005237e9 in js::GetProperty (vp=..., name=<optimized out>, receiver=..., obj=..., cx=0x7ffff6924000) at js/src/jsobj.h:853
#11 js::GetProperty (cx=cx@entry=0x7ffff6924000, v=..., v@entry=..., name=..., name@entry=..., vp=vp@entry=...) at js/src/vm/Interpreter.cpp:4402
#12 0x0000000000809af1 in js::jit::ComputeGetPropResult (res=..., val=..., name=..., op=JSOP_GETPROP, frame=0x7fffffff9278, cx=0x7ffff6924000) at js/src/jit/SharedIC.cpp:2018
#13 js::jit::DoGetPropFallback (cx=0x7ffff6924000, frame=0x7fffffff9278, stub_=<optimized out>, val=..., res=...) at js/src/jit/SharedIC.cpp:2075
[...]
#42 0x00000000005e8302 in EnterBaseline (cx=0xffff9390, data=...) at js/src/jit/BaselineJIT.cpp:162
Backtrace stopped: frame did not save the PC
rax	0x0	0
rbx	0x7fffffff8c00	140737488325632
rcx	0x7ffff6c28a2d	140737333332525
rdx	0x0	0
rsi	0x7ffff6ef7770	140737336276848
rdi	0x7ffff6ef6540	140737336272192
rbp	0x7fffffff8a90	140737488325264
rsp	0x7fffffff8a40	140737488325184
r8	0x7ffff6ef7770	140737336276848
r9	0x7ffff7fe4740	140737354024768
r10	0x0	0
r11	0x0	0
r12	0x7ffff6924000	140737330167808
r13	0x7fffffff8a50	140737488325200
r14	0xb059d0	11557328
r15	0x7fffffff8c00	140737488325632
rip	0x54040e <js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)+414>
=> 0x54040e <js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)+414>:	movl   $0x0,0x0
   0x540419 <js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)+425>:	ud2

Comment 1

[Fuzzing Team]

JSBugMon: Bisection requested, result:
=== Treeherder Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20160115010341" and the hash "32a8c6a3be186bbc1f39da147eb09b087ed322e3".
The "bad" changeset has the timestamp "20160115014842" and the hash "df444117c7bea0a407387dca31ed54c3598b054a".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=32a8c6a3be186bbc1f39da147eb09b087ed322e3&tochange=df444117c7bea0a407387dca31ed54c3598b054a

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Jon, is bug 1239369 a likely regressor?

Comment 3

[Jon Coppeard (:jonco)]

Attachment: bug1370905-debugger-args

Patch to check for failure in DebuggerFrame::getArguments.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/6685b967780d
Check for failure creating DebuggerArguments r=jimb

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/6685b967780d

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Is this worth backporting to Beta for 55 or should we let it ride the 56 train?

Comment 7

[Jon Coppeard (:jonco)]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #6)
I'd say let it ride the trains.