1298656 - Assertion failure: stepperCount == trappingScript->stepModeCount(), at js/src/vm/Debugger.cpp:1995

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision a551f534773c (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --thread-count=2 --ion-eager):

// Adapted from randomly chosen test: js/src/jit-test/tests/debug/bug1133196.js
var g = newGlobal();
g.parent = this;
g.eval("(" + function() {
    var dbg = new Debugger(parent);
    dbg.onExceptionUnwind = function(frame) {
        frame.older.onStep = function() {}
    };
} + ")()");
// Adapted from randomly chosen test: js/src/jit-test/tests/basic/bug1234414.js
oomTest(function() {
    function f(b) {
        if (b) {
            f(b - 1);
        } else eval('\
        var z = w; \
        z = 1 + w; \
        c = 5\
        ');
    }
    f(99);
});


Backtrace:

0   js-dbg-64-dm-clang-darwin-a551f534773c	0x00000001100eb149 js::Debugger::onSingleStep(JSContext*, JS::MutableHandle<JS::Value>) + 3289 (Debugger.cpp:1995)
1   js-dbg-64-dm-clang-darwin-a551f534773c	0x000000010fe7be81 js::jit::HandleDebugTrap(JSContext*, js::jit::BaselineFrame*, unsigned char*, bool*) + 353 (VMFunctions.cpp:931)
2   ???                           	0x0000000111ce5861 0 + 4593703009
3   ???                           	000000000000000000 0 + 0
4   ???                           	0x00000001120ddc91 0 + 4597865617
5   js-dbg-64-dm-clang-darwin-a551f534773c	0x000000010fc2bfeb js::jit::IonCannon(JSContext*, js::RunState&) + 715 (Ion.cpp:2837)
6   js-dbg-64-dm-clang-darwin-a551f534773c	0x00000001101b140f js::RunScript(JSContext*, js::RunState&) + 383 (Interpreter.cpp:380)
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This seems to get intermittent as bisection goes back in time, due to it not reproducing with --ion-offthread-compile=off nor --no-threads, so unable to get a result.

Setting needinfo? from our Debugger gurus.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: OOM_VERBOSE=1 stack from m-c rev a551f534773c

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> so unable to get a result.

Actually I may have gotten one:

Due to skipped revisions, the first bad revision could be any of:
changeset:   https://hg.mozilla.org/mozilla-central/rev/cb6fc6d38f8d
user:        Shu-yu Guo
date:        Thu Aug 25 01:28:47 2016 -0700
summary:     Bug 1263355 - Rewrite the frontend: bindings. (r=jorendorff,Waldo)

changeset:   https://hg.mozilla.org/mozilla-central/rev/18bec78f348e
user:        Shu-yu Guo
date:        Thu Aug 25 01:28:47 2016 -0700
summary:     Bug 1263355 - Report memory metrics for Scopes. (r=njn)

Though I'm unsure if it's the right one. Setting needinfo? from Shu-yu as well.

Comment 5

[Shu-yu Guo [:shu]]

I get 

Assertion failure: cx->isExceptionPending() (Thunk execution failed but no exception was raised - missing call to js::ReportOutOfMemory()?), at /home/shu/moz/central/js/src/builtin/TestingFunctions.cpp:1409

instead of the stepperCount assertion.

Comment 6

[Shu-yu Guo [:shu]]

Oh, it's because I forgot to do --fuzzing-safe.

Comment 7

[Jim Blandy :jimb]

Shu says he's going to look at this, and needinfo me if he wants to hand it off.

Comment 8

[Shu-yu Guo [:shu]]

Attachment: Fix OOM handling in Debugger::replaceFrameGuts.

I don't know how to commit a test for this. The fuzz test is extremely
slow if it doesn't crash, and these OOM tests are so brittle that
literally any allocation changes in the engine cause them to no longer
test what they were testing.

Comment 9

[Shu-yu Guo [:shu]]

Comment on attachment 8786142 [details] [diff] [review]
Fix OOM handling in Debugger::replaceFrameGuts.

Patch is still wrong.

Comment 10

[Shu-yu Guo [:shu]]

Attachment: Fix OOM handling in Debugger::replaceFrameGuts.

Turned out patch was right, but subtle. Add clarifying comment.

Comment 11

[Shu-yu Guo [:shu]]

Attachment: Fix OOM handling in Debugger::replaceFrameGuts.

More clarifying comments on all the OOM points in replaceFrameGuts.

Comment 12

[Jim Blandy :jimb]

I might file a follow-up to work on those comments a bit, but the fixes make sense to me.

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/8b8fdf720a19
Fix OOM handling in Debugger::replaceFrameGuts. (r=jimb)

Comment 14

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/8b8fdf720a19