1483016 - Assertion failure: !cx->isExceptionPending(), at js/src/vm/JSContext-inl.h:331 with ES6 Modules

Status: RESOLVED DUPLICATE of bug 1483182

(Core :: JavaScript Engine, defect, P1)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision bf79440c1376 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --disable-profiling --enable-debug --enable-optimize, run with --fuzzing-safe --ion-offthread-compile=off):

var lfLogBuffer = `
  var obj = {};
  for (var x in obj)
    var h = {};
`;
loadFile(lfLogBuffer);
loadFile(lfLogBuffer);
function loadFile(lfVarx) {
    oomTest(function() {
        let m = parseModule(lfVarx);
        m.declarationInstantiation();
        m.evaluation();
    });
}


Backtrace:

received signal SIGSEGV, Segmentation fault.
0x00000000004d8cf0 in js::CheckForInterrupt (cx=0x7ffff5f17000) at js/src/vm/JSContext-inl.h:331
#0  0x00000000004d8cf0 in js::CheckForInterrupt (cx=0x7ffff5f17000) at js/src/vm/JSContext-inl.h:331
#1  0x00000000005a79b8 in Interpret (cx=0x7ffff5f17000, state=...) at js/src/vm/Interpreter.cpp:2268
#2  0x00000000005b2956 in js::RunScript (cx=0x7ffff5f17000, state=...) at js/src/vm/Interpreter.cpp:425
#3  0x00000000005b5cbd in js::ExecuteKernel (cx=<optimized out>, script=..., script@entry=..., envChainArg=..., newTargetValue=..., evalInFrame=..., evalInFrame@entry=..., result=result@entry=0x7fffffffbc98) at js/src/vm/Interpreter.cpp:773
#4  0x00000000005b6119 in js::Execute (cx=<optimized out>, cx@entry=0x7ffff5f17000, script=script@entry=..., envChainArg=..., rval=rval@entry=0x7fffffffbc98) at js/src/vm/Interpreter.cpp:806
#5  0x00000000006127a1 in js::ModuleObject::execute (cx=0x7ffff5f17000, self=..., self@entry=..., rval=rval@entry=...) at js/src/builtin/ModuleObject.cpp:1117
#6  0x0000000000cbba5d in intrinsic_ExecuteModule (cx=<optimized out>, argc=<optimized out>, vp=<optimized out>) at js/src/vm/SelfHosting.cpp:2218
#7  0x00001fc7f711d2db in ?? ()
[...]
#11 0x0000000000000000 in ?? ()
rax	0x0	0
rbx	0x7ffff5f17000	140737319628800
rcx	0x7ffff6c1c2dd	140737333281501
rdx	0x0	0
rsi	0x7ffff6eeb770	140737336227696
rdi	0x7ffff6eea540	140737336223040
rbp	0x7fffffffb2b0	140737488335536
rsp	0x7fffffffb290	140737488335504
r8	0x7ffff6eeb770	140737336227696
r9	0x7ffff7fe6780	140737354033024
r10	0x58	88
r11	0x7ffff6b927a0	140737332717472
r12	0x7fffffffba40	140737488337472
r13	0x1	1
r14	0x1	1
r15	0x7fffffffb7a0	140737488336800
rip	0x4d8cf0 <js::CheckForInterrupt(JSContext*)+224>
=> 0x4d8cf0 <js::CheckForInterrupt(JSContext*)+224>:	movl   $0x0,0x0
   0x4d8cfb <js::CheckForInterrupt(JSContext*)+235>:	ud2

Comment 1

[Fuzzing Team]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/ad30dc53e38e
user:        Nicholas Nethercote
date:        Fri Aug 10 18:00:29 2018 +1000
summary:     Bug 1481998 - Make mozilla::Hash{Map,Set}'s entry storage allocation lazy. r=luke,sfink

This iteration took 285.028 seconds to run.

Comment 2

[Nicholas Nethercote [inactive]]

I can reproduce this and I have confirmed that bug 1481998 is at fault. The failure reproduces about 50% of the time for me.

Comment 4

[Liz Henry (:lizzard) (relman/hg->git project)]

Fixed in 63 in bug 1483016.