1019612 - Assertion failure: data, at shell/js.cpp:359 with setInterruptCallback

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, critical)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision f28005b84ed0 (run with --fuzzing-safe):


try {
  var g = newGlobal();
  g.eval("" + function f(d) { g(d); });
  g.eval("" + function g(d) { h(d); });
  g.eval("" + function h(d) {
    var i = (0);
    while (d)
      interruptIf(d && i++ == 4000);
  });
  setInterruptCallback(function () {
    dbg.addDebuggee(g);
  });
  g.eval("(" + function () {
    f(true);
  } + ")();");
} catch(exc0) {}
evaluate("function gamma() { stack = Error().stack; }; gamma();", {newContext: true});

Comment 1

[Christian Holler (:decoder)]

Depending on the timing, it seems that this can also cause crashes on the heap.

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140503173936" and the hash "023fbafabe55".
The "bad" changeset has the timestamp "20140503183935" and the hash "a939ec127378".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=023fbafabe55&tochange=a939ec127378

Comment 3

[Christian Holler (:decoder)]

Bisect is bogus, probably intermittent. Jason, this involves jsdbg2, can you tell who should look at this?

Comment 4

[Shu-yu Guo [:shu]]

That'll be me. Is there a stack?

Comment 5

[Shu-yu Guo [:shu]]

NI myself as a reminder.

Comment 6

[Shu-yu Guo [:shu]]

Attachment: Fix setting of gServceInterrupt in js shell.

There are actually 3 bugs here:

 1) We try to DestroyContext after inability to allocate a data. DestroyContext
    then asserts that the cx it's trying to destroy doesn't have a private data.

 2) We forbid creation of new context after servicing an interrupt.

 3) We don't reset gServiceInterrupt after servicing the interrupt.

Comment 7

[Shu-yu Guo [:shu]]

Goddammit they should move the QA contact slot somewhere else.

Comment 8

[Jason Orendorff [:jorendorff]]

Comment on attachment 8433649 [details] [diff] [review]
Fix setting of gServceInterrupt in js shell.

Review of attachment 8433649 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks.

Comment 9

[Shu-yu Guo [:shu]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0869b8d56014

Comment 10

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/0869b8d56014