1310589 - Assertion failure: !cx->isExceptionPending(), at js/src/jscntxt.h:689

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 9079d1671121 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

See attachment.

Backtrace:

0   js-dbg-64-dm-clang-darwin-9079d1671121	0x0000000108c2491d js::array_reverse(JSContext*, unsigned int, JS::Value*) + 1325 (jscntxt.h:689)
1   js-dbg-64-dm-clang-darwin-9079d1671121	0x000000010933ec0d js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) + 93 (jscntxtinlines.h:240)
2   js-dbg-64-dm-clang-darwin-9079d1671121	0x000000010933e988 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) + 696 (Interpreter.cpp:446)
3   js-dbg-64-dm-clang-darwin-9079d1671121	0x0000000109336394 Interpret(JSContext*, js::RunState&) + 34644 (Interpreter.cpp:2922)
4   js-dbg-64-dm-clang-darwin-9079d1671121	0x000000010932da1b js::RunScript(JSContext*, js::RunState&) + 443 (Interpreter.cpp:404)
5   js-dbg-64-dm-clang-darwin-9079d1671121	0x000000010933e923 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) + 595 (Interpreter.cpp:476)
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Testcase

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

=== Treeherder Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20160302090939" and the hash "09bb9469a14d4587e44027e648438a5f23526cd7".
The "bad" changeset has the timestamp "20160302093919" and the hash "9de2c10a1cc34fdeade8523b53f03d567e7f190b".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=09bb9469a14d4587e44027e648438a5f23526cd7&tochange=9de2c10a1cc34fdeade8523b53f03d567e7f190b

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: OOM_VERBOSE=1 stack from m-c rev 9079d1671121

Not sure if the regression window is entirely accurate, so setting needinfo? from Jon as a start.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/432cce28b337
user:        Boris Zbarsky
date:        Wed Mar 02 12:38:23 2016 -0500
summary:     Bug 1252905.  Don't invoke the interrupt callback while an exception is pending.  r=jandem

Not sure if this result is correct...

Comment 6

[Jan de Mooij [:jandem]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #5)
> Not sure if this result is correct...

Likely unrelated, it just happened to add the assert that's failing here.

Comment 7

[André Bargull [:anba]]

https://dxr.mozilla.org/mozilla-central/rev/9079d167112122805f99f57bb8856e1b1675af0f/js/src/vm/NativeObject.cpp#500-502 adds the pending exception, but doesn't propagate the allocation failure resp. clears the pending exception when allocation failures can be ignored.

Comment 8

[Jon Coppeard (:jonco)]

Attachment: bug1310589-shrinkSlots-OOM

We need to clear the exception here since we're ignoring it.

Comment 9

[Tom S [:evilpie]]

Comment on attachment 8802069 [details] [diff] [review]
bug1310589-shrinkSlots-OOM

Review of attachment 8802069 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/vm/NativeObject.cpp
@@ +498,5 @@
>      MOZ_ASSERT_IF(!is<ArrayObject>(), newCount >= SLOT_CAPACITY_MIN);
>  
>      HeapSlot* newslots = ReallocateObjectBuffer<HeapSlot>(cx, this, slots_, oldCount, newCount);
> +    if (!newslots) {
> +        cx->recoverFromOutOfMemory();

This makes sense and matches NativeObject::shrinkElements. r+

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/e2d125de7b24
Fix OOM handling in NativeObject::shrinkSlots r=evilpie

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/e2d125de7b24