1364348 - Assertion failure: !GetShellContext(cx)->quitting, at js/src/shell/js.cpp:806

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 8a7d0b15595f (build with --enable-debug --enable-more-deterministic --without-intl-api, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

// jsfunfuzz-generated
function d() {
    quit();
}
(function () {
    // Adapted from randomly chosen test: js/src/jit-test/tests/gc/bug-1218900.js
    Function.prototype.toString = function () {
        this();
    }
    getBacktrace({
        thisprops: true
    })
})()


Backtrace:

#0  DrainJobQueue (cx=0x7fce64675000, argc=<optimized out>, vp=<optimized out>) at js/src/shell/js.cpp:806
#1  0x0000000000535edf in js::CallJSNative (cx=cx@entry=0x7fce64675000, native=0x4418f0 <DrainJobQueue(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:293
#2  0x000000000052ac43 in js::InternalCallOrConstruct (cx=0x7fce64675000, args=..., construct=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:470
#3  0x000000000051d704 in js::CallFromStack (args=..., cx=<optimized out>) at js/src/vm/Interpreter.cpp:521
#4  Interpret (cx=0x7fce64675000, state=...) at js/src/vm/Interpreter.cpp:3025
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/a56ac3aa583c
user:        Till Schneidereit
date:        Wed May 10 16:16:27 2017 +0200
summary:     Bug 1357958 - Move the JS shell's Promise job handling into the engine to be used as a default implementation. r=jandem

Till, is bug 1357958 a likely regressor?

Comment 3

[Till Schneidereit [:till]]

Attachment: Throw instead of failing an assert if drainJobQueue is called after quit

I hadn't realized that there are situations in which additional JS is executed after quit() was called.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/59b80bc77946
Throw instead of failing an assert if drainJobQueue is called after quit. r=jandem

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/59b80bc77946