1335533 - Assertion failure: !JS_IsExceptionPending(cx), at js/src/jsexn.h:124

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect, P3)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 1fe66bd0efba (build with --enable-debug --enable-more-deterministic --32, run with --fuzzing-safe --no-threads --ion-eager):

// jsfunfuzz-generated
oomTest(function () {
    // Adapted from randomly chosen test: js/src/jit-test/tests/debug/bug999655.js
    var g = newGlobal();
    Debugger(g).onNewScript = function (script) {
        fscript = script.getChildScripts()[0]
    }
    g.eval("function f(){}");
    fscript.setBreakpoint(0, {
        hit: function (frame) {
            frame.arguments[0]
        }
    });
    g.f()
})

Backtrace:

0   js-dbg-32-dm-clang-darwin-1fe66bd0efba	0x0028a568 js::jit::GetPropIRGenerator::tryAttachStub() + 2232 (jsexn.h:124)
1   js-dbg-32-dm-clang-darwin-1fe66bd0efba	0x00be7aef js::jit::DoGetElemFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICGetElem_Fallback*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) + 1231 (BaselineIC.cpp:851)
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/0b58022dda33
user:        Eddy Bruel
date:        Thu Dec 29 15:10:11 2016 +0100
summary:     Bug 1271650 - Implement a C++ interface for DebuggerFrame.arguments. r=jimb

Jim, is bug 1271650 a likely regressor?

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: OOM_VERBOSE=1 stack from m-c rev 1fe66bd0efba

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/48078fb0fcc2
user:        André Bargull
date:        Fri Jun 02 12:04:31 2017 +0200
summary:     Bug 1368963 - Avoid extra calls to GetPropertyKeys() in Object.freeze/seal/preventExtensions. r=jandem

I don't think this is a likely fix, is it? Shu-yu, you've fixed a few Debugger issues related to Exceptions, what do you think?

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> I don't think this is a likely fix, is it? Shu-yu, you've fixed a few
> Debugger issues related to Exceptions, what do you think?

Moving needinfo? to Jim.

Comment 6

[Jim Blandy :jimb]

Looking into this today.

Comment 7

[Jim Blandy :jimb]

I'm also able to reproduce this on the parent of the changeset given in comment 2. I get:

Assertion failure: cx->isExceptionPending() (Thunk execution failed but no exception was raised - missing call to js::ReportOutOfMemory()?), at /home/jimb/moz/dbg/js/src/builtin/TestingFunctions.cpp:1406
Segmentation fault (core dumped)

Comment 8

[Jim Blandy :jimb]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #4)
> autoBisect shows this is probably related to the following changeset:
> 
> The first good revision is:
> changeset:   https://hg.mozilla.org/mozilla-central/rev/48078fb0fcc2
> user:        André Bargull
> date:        Fri Jun 02 12:04:31 2017 +0200
> summary:     Bug 1368963 - Avoid extra calls to GetPropertyKeys() in
> Object.freeze/seal/preventExtensions. r=jandem
> 
> I don't think this is a likely fix, is it? Shu-yu, you've fixed a few
> Debugger issues related to Exceptions, what do you think?

This does not seem like a likely fix for this bug.

Comment 9

[Intermittent Failures Robot]

1 failures in 831 pushes (0.001 failures/push) were associated with this bug in the last 7 days.    

Repository breakdown:
* autoland: 1

Platform breakdown:
* linux32: 1

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1335533&startday=2018-02-26&endday=2018-03-04&tree=all

Comment 10

[Intermittent Failures Robot]

2 failures in 822 pushes (0.002 failures/push) were associated with this bug in the last 7 days.    

Repository breakdown:
* mozilla-inbound: 1
* mozilla-central: 1

Platform breakdown:
* windows7-32: 1
* linux32: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?bug=1335533&startday=2018-03-20&endday=2018-03-26&tree=trunk

Comment 11

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Let's resolve this WFM, since it no longer reproduces. We'll find more fuzzbugs of these types going forward as well.