[wasm] Assertion failure: !cx->isExceptionPending(), at js/src/jscntxtinlines.h:294

RESOLVED FIXED in Firefox 58

Status

()

defect
P1
critical
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: gkw, Assigned: luke)

Tracking

(Blocks 2 bugs, {assertion, jsbugmon, testcase})

Trunk
mozilla58
x86_64
Linux
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox-esr52 unaffected, firefox56 unaffected, firefox57 unaffected, firefox58 fixed)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(2 attachments)

Reporter

Description

2 years ago
The following testcase crashes on mozilla-central revision b2f459b88cab (build with --enable-debug, run with --fuzzing-safe --ion-offthread-compile=off --ion-eager):

// Adapted from randomly chosen test: js/src/jit-test/tests/asm.js/oom-helper-thread-plus-validation-error.js
oomAfterAllocations(1, 2);
// Adapted from randomly chosen test: js/src/jit-test/tests/wasm/streaming.js
var x = wasmTextToBinary('(module (func (export "run") (result i32) i32.const 42))');
WebAssembly.compileStreaming(x);
drainJobQueue();

Backtrace:

Assertion failure: !cx->isExceptionPending(), at /home/gkwubu/trees/mozilla-central/js/src/jscntxtinlines.h:294

Thread 1 "js-dbg-64-linux" received signal SIGSEGV, Segmentation fault.
0x000000000055dfd8 in js::CallJSNative (cx=0x7ffff6976000, native=0x4532d0 <DrainJobQueue(JSContext*, unsigned int, JS::Value*)>, args=...)
    at /home/gkwubu/trees/mozilla-central/js/src/jscntxtinlines.h:294
warning: Source file is more recent than executable.
294	        MOZ_ASSERT_IF(!alreadyThrowing, !cx->isExceptionPending());
(gdb) bt
#0  0x000000000055dfd8 in js::CallJSNative (cx=0x7ffff6976000, native=0x4532d0 <DrainJobQueue(JSContext*, unsigned int, JS::Value*)>, args=...)
    at /home/gkwubu/trees/mozilla-central/js/src/jscntxtinlines.h:294
#1  0x000000000055258f in js::InternalCallOrConstruct (cx=cx@entry=0x7ffff6976000, args=..., construct=construct@entry=js::NO_CONSTRUCT)
    at /home/gkwubu/trees/mozilla-central/js/src/vm/Interpreter.cpp:472
#2  0x000000000055296d in InternalCall (cx=0x7ffff6976000, args=...) at /home/gkwubu/trees/mozilla-central/js/src/vm/Interpreter.cpp:521
#3  0x0000000000552a9a in js::CallFromStack (cx=<optimized out>, args=...) at /home/gkwubu/trees/mozilla-central/js/src/vm/Interpreter.cpp:527
#4  0x000000000063a3c3 in js::jit::DoCallFallback (cx=0x7ffff6976000, frame=0x7fffffffc558, stub_=<optimized out>, argc=<optimized out>, vp=0x7fffffffc518, res=...)
    at /home/gkwubu/trees/mozilla-central/js/src/jit/BaselineIC.cpp:2539
#5  0x00000d36068184cb in ?? ()
#6  0xfffe7ffff7e00340 in ?? ()
/snip

For detailed crash information, see attachment.
Reporter

Comment 2

2 years ago
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/b9053d53c1ca
user:        Luke Wagner
date:        Tue Oct 10 14:17:50 2017 -0500
summary:     Bug 1347644 - Baldr: shell WebAssembly.compileStreaming and instantiateStreaming (r=till)

Luke, is bug 1347644 a likely regressor?
Blocks: 1347644
Flags: needinfo?(luke)
Reporter

Updated

2 years ago
Summary: Assertion failure: !cx->isExceptionPending(), at js/src/jscntxtinlines.h:294 → [wasm] Assertion failure: !cx->isExceptionPending(), at js/src/jscntxtinlines.h:294
Assignee

Comment 3

2 years ago
Quite; I'll look into this as soon as I have some free time.
Flags: needinfo?(luke)
Priority: -- → P1
Assignee

Comment 4

2 years ago
Posted patch fix-oom-bugSplinter Review
Two silly OOM-handling bugs caught here.
Assignee: nobody → luke
Attachment #8926175 - Flags: review?(bbouvier)
Comment on attachment 8926175 [details] [diff] [review]
fix-oom-bug

Review of attachment 8926175 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks!
Attachment #8926175 - Flags: review?(bbouvier) → review+

Comment 6

2 years ago
Pushed by lwagner@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/babcc25a10ea
Baldr: fix OOM handling in compileStreaming (r=bbouvier)
Backed out for failing Jit's tests/jit-test/jit-test/tests/wasm/regress/oom-wasm-streaming.js:

https://hg.mozilla.org/integration/mozilla-inbound/rev/5b1e338684c7fee1512606f4aedad79d87a39280

Failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=143103423&repo=mozilla-inbound
TEST-UNEXPECTED-FAIL | tests/jit-test/jit-test/tests/wasm/regress/oom-wasm-streaming.js | /builds/worker/workspace/build/tests/jit-test/jit-test/tests/wasm/regress/oom-wasm-streaming.js:1:1 ReferenceError: oomAfterAllocations is not defined (code 3, args "") [0.1 s]
...
Flags: needinfo?(luke)
Assignee

Comment 8

2 years ago
Arg, just when I think I have something simple enough that I don't need to try-server...
Flags: needinfo?(luke)

Comment 9

2 years ago
Pushed by lwagner@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/b592e6f5ac17
Baldr: fix OOM handling in compileStreaming (r=bbouvier)

Comment 11

2 years ago
Pushed by lwagner@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/f7fe2e79e4ef
Baldr: fix OOM handling in compileStreaming (r=bbouvier)
Assignee

Comment 12

2 years ago
D'oh, sorry again; --no-threads disables WebAssembly.compileStreaming.
Flags: needinfo?(luke)

Comment 13

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/f7fe2e79e4ef
Status: NEW → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla58
You need to log in before you can comment on or make changes to this bug.