1115246 - Assertion failure: !cx->isExceptionPending(), at jscntxtinlines.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

var x = Object.toString()
function z() {
    if (/x/) {}
};
// Randomly chosen test: js/src/tests/ecma/GlobalObject/15.1-1-n.js
// -- reduced away --
// Randomly chosen test: js/src/jit-test/tests/basic/testBug756919.js
try {
    eval(`
        gcparam("maxBytes", gcparam("gcBytes") + 1);
        function f() {
            var y = "";
            function g() {}
            f();
            eval();
        }
        f();
    `)
} catch (e) {};
// Randomly chosen test: js/src/jit-test/tests/basic/testMultipleArgumentsObjects.js
try {
    load("a.js");
} catch (e) {}
// Randomly chosen test: js/src/jit-test/tests/self-hosting/alternate-static-and-instance-array-extras.js
// -- reduced away --
// Randomly chosen test: js/src/jit-test/tests/closures/incr-exit-3.js
// -- reduced away --

and a.js is:

function g() {
    x = arguments;
    function f(e, which) {
        var args = [x, arguments]
        return args[which][0]
    }
    m = [0, 0, 1]
    for (i = 0; i < 3; i++) {
        m[i] = f("f", m[i])
    }
    return m.toString()
}
assertEq(g(), ",,f")

asserts js debug shell on m-c changeset b17e7747d3fb with --fuzzing-safe --no-threads --no-ion at Assertion failure: !cx->isExceptionPending(), at js/src/jscntxtinlines.h.

Debug configure options:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

This was found by combining random js tests together with jsfunfuzz, the specific file(s) is/are:

http://hg.mozilla.org/mozilla-central/file/b17e7747d3fb/js/src/tests/ecma/GlobalObject/15.1-1-n.js
http://hg.mozilla.org/mozilla-central/file/b17e7747d3fb/js/src/jit-test/tests/basic/testBug756919.js
http://hg.mozilla.org/mozilla-central/file/b17e7747d3fb/js/src/jit-test/tests/basic/testMultipleArgumentsObjects.js
http://hg.mozilla.org/mozilla-central/file/b17e7747d3fb/js/src/jit-test/tests/self-hosting/alternate-static-and-instance-array-extras.js
http://hg.mozilla.org/mozilla-central/file/b17e7747d3fb/js/src/jit-test/tests/closures/incr-exit-3.js

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/9605a571ca8a
user:        Brian Hackett
date:        Tue Aug 19 22:25:37 2014 -0800
summary:     Bug 934450 - Allow objects to have copy on write elements, r=billm,jandem.

Brian, not sure if bug 934450 is the actual regressor here. Thoughts?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This also asserts on:

https://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2014-12-23-mozilla-central-debug/jsshell-mac64.zip

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(lldb) bt 5
* thread #1: tid = 0x98eab, 0x00000001006311ce js-dbg-opt-64-dm-nsprBuild-darwin-b17e7747d3fb`js::Invoke(cx=<unavailable>, args=<unavailable>, construct=<unavailable>) + 1262 at Interpreter.cpp:471, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x00000001006311ce js-dbg-opt-64-dm-nsprBuild-darwin-b17e7747d3fb`js::Invoke(cx=<unavailable>, args=<unavailable>, construct=<unavailable>) + 1262 at Interpreter.cpp:471
    frame #1: 0x000000010064dfe0 js-dbg-opt-64-dm-nsprBuild-darwin-b17e7747d3fb`Interpret(cx=<unavailable>, state=<unavailable>) + 43632 at Interpreter.cpp:2561
    frame #2: 0x0000000100643549 js-dbg-opt-64-dm-nsprBuild-darwin-b17e7747d3fb`js::RunScript(cx=0x0000000101b149e0, state=0x00007fff5fbff178) + 345 at Interpreter.cpp:452
    frame #3: 0x000000010062c66d js-dbg-opt-64-dm-nsprBuild-darwin-b17e7747d3fb`js::ExecuteKernel(cx=0x0000000101b149e0, scopeChainArg=0x0000000101e5d060, thisv=<unavailable>, type=<unavailable>, result=<unavailable>, script=<unavailable>, evalInFrame=<unavailable>) + 925 at Interpreter.cpp:661
    frame #4: 0x00000001006562c1 js-dbg-opt-64-dm-nsprBuild-darwin-b17e7747d3fb`js::Execute(cx=0x0000000101b149e0, scopeChainArg=<unavailable>, rval=0x0000000000000000, script=<unavailable>) + 433 at Interpreter.cpp:697
(lldb)

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

var x = Object.toString()
function z() {
    if (/x/) {}
};
// Randomly chosen test: js/src/tests/ecma/GlobalObject/15.1-1-n.js
// -- reduced away --
// Randomly chosen test: js/src/jit-test/tests/basic/testBug756919.js
try {
    eval(`
        gcparam("maxBytes", gcparam("gcBytes") + 1);
        function f() {
            var y = "";
            function g() {}
            f();
            eval();
        }
        f();
    `)
} catch (e) {};
// Randomly chosen test: js/src/jit-test/tests/basic/testMultipleArgumentsObjects.js
evaluate(`
    function g() {
        x = arguments;
        function f(e, which) {
            var args = [x, arguments];
            return args[which][0]
        }
        m = [0, 0, 1];
        for (i = 0; i < 3; i++) {
            m[i] = f("f", m[i])
        }
        return m.toString()
    }
    assertEq(g(), ",,f")
`, {
    compileAndGo: true
})
// Randomly chosen test: js/src/jit-test/tests/self-hosting/alternate-static-and-instance-array-extras.js
// -- reduced away --
// Randomly chosen test: js/src/jit-test/tests/closures/incr-exit-3.js
// -- reduced away --

asserts js debug shell on m-c changeset b17e7747d3fb with --fuzzing-safe --no-threads --no-ion at Assertion failure: !cx->isExceptionPending(), at js/src/jscntxtinlines.h.

This now has the load function removed. Thanks to :decoder for his help.

Comment 5

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 6

[Brian Hackett [Laid off!]]

Attachment: patch

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Helped to land this:

https://hg.mozilla.org/integration/mozilla-inbound/rev/9878f361d7f7

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This might or might not have caused bustage:

http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-linux/1419897912/mozilla-inbound-linux-bm70-build1-build580.txt.gz

Let's see what we get by backing it out.

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

Backed out in https://hg.mozilla.org/integration/mozilla-inbound/rev/c139cf2e487d for that bustage.

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Over IRC:

16:39   glandium: gkw, KWierso|sheriffduty: fwiw, that build error means that running xpcshell with MOZ_STARTUP_CACHE doesn't work properly
16:39   gkw: glandium: I see. Thanks!

Comment 11

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=9878f361d7f7

has other failures. Oops.

Comment 12

[Mike Hommey [:glandium]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #11)
> https://treeherder.mozilla.org/#/jobs?repo=mozilla-
> inbound&revision=9878f361d7f7
> 
> has other failures. Oops.

More precisely, it broke everything bug Cpp unit tests.

Comment 13

[Mike Hommey [:glandium]]

(In reply to Mike Hommey [:glandium] (out from Dec 31 to Jan 5 incl.) from comment #12)
> More precisely, it broke everything bug Cpp unit tests.

s/everything bug/everything but/

Comment 14

[Brian Hackett [Laid off!]]

Hmm, getConstantValue would also return false if it wasn't allowed to convert nested objects.  This patch fixes this case by returning a magic value in such cases, so the return value is used consistently.

https://hg.mozilla.org/integration/mozilla-inbound/rev/60bccc6ddd08

Comment 15

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/60bccc6ddd08