1512008 - Assertion failure: CheckedUnwrap(promiseObj)->is<PromiseObject>(), at js/src/jsapi.cpp:4054 with ReadableStream

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 47077594d943 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

// Adapted from randomly chosen test: js/src/tests/non262/Promise/bug-1287334.js
Object.defineProperty(Promise, Symbol.species, {
    value: function(g) {
        g(function() {}, function() {})
    }
});
// Adapted from randomly chosen test: js/src/tests/non262/ReadableStream/tee-start.js
new ReadableStream(Object.e).tee();

Backtrace:

#0  CallOriginalPromiseThenImpl (cx=0x7f8911e18000, promiseObj=..., onResolvedObj_=..., onRejectedObj_=..., resultObj=..., createDependent=js::CreateDependentPromise::Never) at js/src/jsapi.cpp:4054
#1  0x00005560fa7698f8 in JS::AddPromiseReactions (cx=0x7f8912f40680 <_IO_2_1_stderr_>, promiseObj=..., onResolvedObj=..., onRejectedObj=...) at js/src/jsapi.cpp:4079
#2  0x00005560fa5a91f3 in ReadableStreamControllerCallPullIfNeeded (cx=0x7f8911e18000, unwrappedController=...) at js/src/builtin/Stream.cpp:2773
#3  0x00005560fa5a79e8 in ControllerStartHandler (cx=0x7f8911e18000, argc=<optimized out>, vp=<optimized out>) at js/src/builtin/Stream.cpp:2198
#4  0x00005560fa1c9365 in CallJSNative (cx=0x7f8911e18000, native=0x5560fa5a7810 <ControllerStartHandler(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/vm/Interpreter.cpp:443
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/3db828b6494a
user:        Jason Orendorff
date:        Wed Oct 24 16:53:09 2018 +0000
summary:     Bug 1501734 - Enable streams by default in the JS shell. r=tcampbell

Jason, this is probably related to streams - bug 1501734 right?

Comment 3

[Jason Orendorff [:jorendorff]]

We need a CallOriginalPromiseThen variant that performs the type check in <https://tc39.github.io/ecma262/#sec-promise.prototype.then> step 2 rather than asserting it.

There are already way too many variations on that theme, though. :-\

Comment 4

[Jason Orendorff [:jorendorff]]

Attachment: Bug 1512008 - Fix assertion failure with ReadableStream and Promise[Symbol.species]. r?arai

Comment 5

[Jason Orendorff [:jorendorff]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=f57bb5ecbfee8055b98034f6ac2655b651754003

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/71253f35ac3c
Fix assertion failure with ReadableStream and Promise[Symbol.species]. r=arai

Comment 7

[Dorel Luca [:dluca]]

Backed out 5 changesets (bug 1507950, bug 1503012, bug 1507943, bug 1512050, bug 1512008) for spidermonkey and jit failures

Log:
https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=215990151&repo=autoland&lineNumber=90481

Backout:
https://hg.mozilla.org/integration/autoland/rev/7eb42458e2d82b085a298cb3b7801cab2a3d4c51

Comment 8

[Jason Orendorff [:jorendorff]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=b69a637f9126d81034468d17b3604a6919050b02

Comment 9

[Jason Orendorff [:jorendorff]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=d6ba1d851fb1f7ce16a5adff8ac49e647e290bcf

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c0c4ff2b0485
Fix assertion failure with ReadableStream and Promise[Symbol.species]. r=arai

Comment 11

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/mozilla-central/rev/c0c4ff2b0485