Closed Bug 1394492 Opened 2 years ago Closed 2 years ago

Self-hosted JavaScript assertion info: "js/src/builtin/Module.js:554: Module has different error set after failed evaluation"

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla57
Tracking Status
firefox-esr52 --- unaffected
firefox55 --- unaffected
firefox56 --- unaffected
firefox57 --- fixed

People

(Reporter: decoder, Assigned: jonco)

References

(Blocks 1 open bug)

Details

(4 keywords, Whiteboard: [fuzzblocker] [jsbugmon:update])

Attachments

(1 file)

The following testcase crashes on mozilla-central revision d10c97627b51 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-stdcxx-compat --disable-profiling --enable-debug --enable-optimize, run with --fuzzing-safe):

let m = parseModule(`
  throw i => { return 5; }, m-1;
`);
m.declarationInstantiation();
function eval(source) {
  return m.evaluation();
}
eval("");



Backtrace:

 received signal SIGSEGV, Segmentation fault.
0x0000000000c10376 in intrinsic_AssertionFailed (cx=<optimized out>, argc=<optimized out>, vp=<optimized out>) at js/src/vm/SelfHosting.cpp:421
#0  0x0000000000c10376 in intrinsic_AssertionFailed (cx=<optimized out>, argc=<optimized out>, vp=<optimized out>) at js/src/vm/SelfHosting.cpp:421
#1  0x0000000000548c0b in js::CallJSNative (cx=cx@entry=0x7ffff6924000, native=0xc102e0 <intrinsic_AssertionFailed(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:293
#2  0x000000000053de6b in js::InternalCallOrConstruct (cx=0x7ffff6924000, args=..., construct=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:469
#3  0x0000000000530af3 in js::CallFromStack (args=..., cx=<optimized out>) at js/src/vm/Interpreter.cpp:520
#4  Interpret (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:3065
#5  0x000000000053da33 in js::RunScript (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:409
#6  0x000000000053df86 in js::InternalCallOrConstruct (cx=0x7ffff6924000, args=..., construct=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:487
#7  0x0000000000530af3 in js::CallFromStack (args=..., cx=<optimized out>) at js/src/vm/Interpreter.cpp:520
#8  Interpret (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:3065
#9  0x000000000053da33 in js::RunScript (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:409
#10 0x000000000053df86 in js::InternalCallOrConstruct (cx=0x7ffff6924000, args=..., construct=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:487
#11 0x00000000005394c7 in js::CallFromStack (args=..., cx=<optimized out>) at js/src/vm/Interpreter.cpp:520
#12 Interpret (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:2981
#13 0x000000000053da33 in js::RunScript (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:409
[...]
#22 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at js/src/shell/js.cpp:8592
rax	0x0	0
rbx	0x7ffff465be00	140737293696512
rcx	0x7ffff6c28a2d	140737333332525
rdx	0x0	0
rsi	0x7ffff6ef7770	140737336276848
rdi	0x7ffff6ef6540	140737336272192
rbp	0x7fffffffbb70	140737488337776
rsp	0x7fffffffbb50	140737488337744
r8	0x7ffff6ef7770	140737336276848
r9	0x7ffff7fe4740	140737354024768
r10	0x58	88
r11	0x7ffff6b9f750	140737332770640
r12	0x7ffff6ef6700	140737336272640
r13	0x7fffffffbb90	140737488337808
r14	0xc102e0	12649184
r15	0x7ffff42801d0	140737289650640
rip	0xc10376 <intrinsic_AssertionFailed(JSContext*, unsigned int, JS::Value*)+150>
=> 0xc10376 <intrinsic_AssertionFailed(JSContext*, unsigned int, JS::Value*)+150>:	movl   $0x0,0x0
   0xc10381 <intrinsic_AssertionFailed(JSContext*, unsigned int, JS::Value*)+161>:	ud2
Whiteboard: [jsbugmon:update,bisect][fuzzblocker] → [fuzzblocker] [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/2e4748827cda
user:        Jon Coppeard
date:        Wed Aug 09 18:05:15 2017 +0100
summary:     Bug 1374239 - Store and re-throw module instantiation and evaluation errors r=shu

This iteration took 270.539 seconds to run.
Jon, is bug 1374239 a likely regressor?
Blocks: 1374239
Flags: needinfo?(jcoppeard)
Oh, NaN !== NaN.
Assignee: nobody → jcoppeard
Flags: needinfo?(jcoppeard)
Patch to use SameValue() rather than === to compare exception values.
Attachment #8903531 - Flags: review?(arai.unmht)
Comment on attachment 8903531 [details] [diff] [review]
bug1394492-module-errors

Review of attachment 8903531 [details] [diff] [review]:
-----------------------------------------------------------------

looks good :)
Attachment #8903531 - Flags: review?(arai.unmht) → review+
Duplicate of this bug: 1394787
Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/57b37489a2e3
Fix module error assertion which fails if we throw NaN r=arai
https://hg.mozilla.org/mozilla-central/rev/57b37489a2e3
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla57
You need to log in before you can comment on or make changes to this bug.