1370875 - Assertion failure: !done(), at js/src/vm/Stack.h:1843 with Promise and inIon

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 5801aa478de1 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-stdcxx-compat --disable-profiling --enable-debug --enable-optimize, run with --fuzzing-safe):

Promise.resolve().then(inIon);



Backtrace:

 received signal SIGSEGV, Segmentation fault.
0x0000000000867858 in js::FrameIter::isJit (this=<optimized out>) at js/src/vm/Stack.h:1843
#0  0x0000000000867858 in js::FrameIter::isJit (this=<optimized out>) at js/src/vm/Stack.h:1843
#1  js::FrameIter::isIon (this=<optimized out>) at js/src/vm/Stack.h:2145
#2  testingFunc_inIon (cx=0x7ffff6924000, argc=<optimized out>, vp=<optimized out>) at js/src/builtin/TestingFunctions.cpp:2161
#3  0x00000000005402df in js::CallJSNative (cx=cx@entry=0x7ffff6924000, native=0x8675f0 <testingFunc_inIon(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:293
#4  0x00000000005351d3 in js::InternalCallOrConstruct (cx=0x7ffff6924000, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:470
#5  0x00000000005355e8 in InternalCall (cx=<optimized out>, args=...) at js/src/vm/Interpreter.cpp:515
#6  0x000000000053571d in js::Call (cx=<optimized out>, fval=..., fval@entry=..., thisv=..., args=..., rval=..., rval@entry=...) at js/src/vm/Interpreter.cpp:534
#7  0x00000000005b87e3 in PromiseReactionJob (cx=0x7ffff6924000, argc=<optimized out>, vp=<optimized out>) at js/src/builtin/Promise.cpp:1001
#8  0x00000000005402df in js::CallJSNative (cx=cx@entry=0x7ffff6924000, native=0x5b7de0 <PromiseReactionJob(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:293
#9  0x00000000005351d3 in js::InternalCallOrConstruct (cx=cx@entry=0x7ffff6924000, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:470
#10 0x00000000005355e8 in InternalCall (cx=cx@entry=0x7ffff6924000, args=...) at js/src/vm/Interpreter.cpp:515
#11 0x000000000053571d in js::Call (cx=cx@entry=0x7ffff6924000, fval=..., fval@entry=..., thisv=..., thisv@entry=..., args=..., rval=..., rval@entry=...) at js/src/vm/Interpreter.cpp:534
#12 0x0000000000925db0 in JS::Call (cx=cx@entry=0x7ffff6924000, thisv=..., thisv@entry=..., fval=..., fval@entry=..., args=..., rval=..., rval@entry=...) at js/src/jsapi.cpp:2891
#13 0x000000000096bbe3 in JS::Call (rval=..., args=..., funObj=..., thisv=..., cx=0x7ffff6924000) at js/src/jsapi.h:3448
#14 js::RunJobs (cx=cx@entry=0x7ffff6924000) at js/src/jscntxt.cpp:1253
#15 0x000000000043bcc9 in Shell (envp=<optimized out>, op=0x7fffffffda30, cx=0x7ffff6924000) at js/src/shell/js.cpp:8125
#16 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at js/src/shell/js.cpp:8511
rax	0x0	0
rbx	0x7fffffffcc10	140737488342032
rcx	0x7ffff6c28a2d	140737333332525
rdx	0x0	0
rsi	0x7ffff6ef7770	140737336276848
rdi	0x7ffff6ef6540	140737336272192
rbp	0x7fffffffd0a0	140737488343200
rsp	0x7fffffffcbd0	140737488341968
r8	0x7ffff6ef7770	140737336276848
r9	0x7ffff7fe4740	140737354024768
r10	0x58	88
r11	0x7ffff6b9f750	140737332770640
r12	0x7ffff6924000	140737330167808
r13	0x7fffffffd3a0	140737488343968
r14	0x1	1
r15	0x7fffffffd3a8	140737488343976
rip	0x867858 <testingFunc_inIon(JSContext*, unsigned int, JS::Value*)+616>
=> 0x867858 <testingFunc_inIon(JSContext*, unsigned int, JS::Value*)+616>:	movl   $0x0,0x0
   0x867863 <testingFunc_inIon(JSContext*, unsigned int, JS::Value*)+627>:	ud2

Comment 1

[Shu-yu Guo [:shu]]

Attachment: Return false in inIon if there are no JS frames on stack.

Comment 2

[Fuzzing Team]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/d4cf63e47ae9
user:        Till Schneidereit
date:        Thu Jul 21 00:44:16 2016 +0200
summary:     Bug 911216 - Part 30: Enable SpiderMonkey Promise implementation. r=bz,efaust,bholley,Paolo,tromey,shu

This iteration took 224.683 seconds to run.

Comment 3

[Nicolas B. Pierron [:nbp]]

Comment on attachment 8880973 [details] [diff] [review]
Return false in inIon if there are no JS frames on stack.

Review of attachment 8880973 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks :)

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/967aac2f682f
Return false in inIon if there are no JS frames on stack. (r=nbp)

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/967aac2f682f