1461034 - Assertion failure: cx_->isExceptionPending(), at js/src/frontend/BytecodeCompiler.cpp:588

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 4303d49c5393 (build with --enable-debug, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

oomTest(function(){s[-1]})

Backtrace:

#0  0x000055d46d3a3e05 in AutoAssertReportedException::~AutoAssertReportedException (this=0x7ffd781f33f0, __in_chrg=<optimized out>) at js/src/frontend/BytecodeCompiler.cpp:588
#1  0x000055d46d39f7b5 in js::frontend::CompileLazyFunction (cx=<optimized out>, lazy=..., lazy@entry=..., chars=<optimized out>, length=length@entry=9) at js/src/frontend/BytecodeCompiler.cpp:745
#2  0x000055d46d089570 in JSFunction::createScriptForLazilyInterpretedFunction (cx=<optimized out>, fun=...) at js/src/vm/JSFunction.cpp:1626
#3  0x000055d46c97179c in JSFunction::getOrCreateScript (cx=<optimized out>, fun=...) at js/src/vm/JSFunction.h:528
#4  0x000055d46caa0c11 in js::InternalCallOrConstruct (cx=<optimized out>, cx@entry=0x7f9940817000, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:470
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/ce42829bf948
user:        Jan de Mooij
date:        Thu May 03 16:17:09 2018 +0200
summary:     Bug 1458198 - Assert the frontend reported an exception if it fails to compile a script. r=jorendorff

Jan, is bug 1458198 a likely regressor?

Comment 3

[Jan de Mooij [:jandem]]

The OOM trap: when you improve our OOM testing/asserts and then get to fix all the issues that come up...

Comment 4

[Jan de Mooij [:jandem]]

Attachment: Patch

We reported OOM correctly but then we incorrectly called recoverFromOutOfMemory.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/0d1f6fbcc3a1
Don't clear an OOM exception in FoldElement. r=jonco

Comment 6

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/mozilla-central/rev/0d1f6fbcc3a1