1527862 - Assertion failure: cx->jobQueue->empty(), at js/src/builtin/Promise.cpp:5182 with async and Debugger

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision f0ea53f47215 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

// Adapted from randomly chosen test: js/src/tests/test262/language/arguments-object/cls-expr-async-gen-func-args-trailing-comma-multiple.js
f = async function*() {};
f().next().then();
// Adapted from randomly chosen test: js/src/jit-test/tests/debug/bug1254190.js
var g = newGlobal({ newCompartment: true });
var dbg = new Debugger(g);
oomTest(() => {
    g.eval("(function() {})");
});

Backtrace:

#0 JS::AutoDebuggerJobQueueInterruption::~AutoDebuggerJobQueueInterruption (this=0x7fff89d2bb78) at js/src/builtin/Promise.cpp:5182
#1 0x000055f0ffc12499 in js::Debugger::dispatchHook<js::Debugger::slowPathOnNewScript(JSContext*, JS::Handle<JSScript*>)::$_11(js::Debugger::slowPathOnNewScript(JSContext*, JS::Handle<JSScript*>)::$_12)> (cx=0x7f38b7217000, hookIsEnabled=..., fireHook=...) at js/src/vm/Debugger.cpp:2087
#2 js::Debugger::slowPathOnNewScript (cx=0x7f38b7217000, script=...) at js/src/vm/Debugger.cpp:2090
#3 0x000055f10019e87c in js::frontend::BytecodeEmitter::emitScript (this=0x7fff89d2be18, body=0x7f38b72e8220) at js/src/frontend/BytecodeEmitter.cpp:2477
#4 0x000055f1001c9561 in js::frontend::ScriptCompiler<char16_t>::compileScript (this=0x7fff89d2cc70, info=..., environment=..., sc=<optimized out>) at js/src/frontend/BytecodeCompiler.cpp:555
/snip

For detailed crash information, see attachment.

Setting [fuzzblocker] as this is being hit a lot.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/3ae9f2b94f97
user: Jim Blandy
date: Tue Feb 12 08:10:54 2019 +0000
summary: Bug 1145201: Use AutoDebuggerJobQueueInterruption in Debugger. r=jorendorff

Jim, is bug 1145201 a likely regressor?

Comment 3

[Jim Blandy :jimb]

Yes, that is almost certainly the regressor. I can reproduce this.

Comment 4

[Jim Blandy :jimb]

The assertion is complaining that the Debugger onNewScript hook didn't properly drain its microtask queue before returning. However, the call to AutoDebuggerJobQueueInterruption::runJobs is definitely made unconditionally after running the hook. Since this is an OOM test, I suspect that an OOM is preventing the job queue from draining completely.

Comment 5

[Jim Blandy :jimb]

Attachment: Bug 1527862: Use proper initialization condition in AutoDebuggerJobQueueInterruption destructor. r?arai

The AutoDebuggerJobQueueInterruption destructor asserts that the Debugger has
properly managed its hooks' asynchronous jobs. But this assertion clearly only
applies when the AutoDebuggerJobQueueInterruption is properly initialized;
otherwise, the debuggee's job queue is still in place.

Unfortunately, the destructor was using the wrong test to determine whether the
debuggee's queue had been saved. This patch makes it uses the initialized
method, rather that checking the cx field, which is always initialized.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/fb6c0d850fa3
Use proper initialization condition in AutoDebuggerJobQueueInterruption destructor. r=arai

Comment 7

[Noemi Erli[:noemi_erli]]

Backed out changeset fb6c0d850fa3 (Bug 1527862) for bustage in job-queue-04.js CLOSED TREE

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&classifiedState=unclassified&revision=fb6c0d850fa3bac79d61a81fd35346a309e5e5c7&selectedJob=229547696

Failure log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=229547696&repo=autoland&lineNumber=50424

Backout: Backed out changeset fb6c0d850fa3 (Bug 1527862) for bustage in job-queue-04.js CLOSED TREE

Comment 8

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e2990d679a3b
Backed out changeset fb6c0d850fa3 for bustage in job-queue-04.js CLOSED TREE

Comment 9

[Oana Pop-Rus]

https://hg.mozilla.org/mozilla-central/rev/fb6c0d850fa3

Comment 10

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/mozilla-central/rev/989d16d0f995
Backed out changeset fb6c0d850fa3 for bustage in job-queue-04.js CLOSED TREE

Comment 11

[Jim Blandy :jimb]

Oh, this is a dumb one: tests that use oomTest need to make sure it's defined.

Comment 12

[Jim Blandy :jimb]

I've queued a fixed version of the patch to land.

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6dea1af62279
Use proper initialization condition in AutoDebuggerJobQueueInterruption destructor. r=arai

Comment 14

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/6dea1af62279

Comment 15

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/6dea1af62279