1545369 - Crash [@ JSObject::getClass] involving async/await

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 02b89c29412b (build with --enable-debug, run with --fuzzing-safe --no-threads --no-baseline --no-ion --no-cgc):

// jsfunfuzz-generated
async function f(x) {
    await await x;
};
for (let i = 0; i < 7; ++i) {
    for (let j = 0; j < 89; ++j) {
        f();
    }
}
// Adapted from randomly chosen test: js/src/jit-test/tests/parser/bug-1263355-14.js
gcparam("maxBytes", gcparam("gcBytes"));

Backtrace:

#0 JSObject::getClass (this=0x0) at js/src/vm/JSObject.h:106
#1 JSObject::is<js::ArrayObject> (this=0x0) at js/src/vm/JSObject.h:508
#2 JSObject::as<js::ArrayObject> (this=0x0) at js/src/vm/JSObject.h:513
#3 ReportUnhandledRejections (cx=<optimized out>) at js/src/shell/js.cpp:10667
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: w365-reduced.zip

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/c6317f06ed07
user: Jon Coppeard
date: Mon Apr 01 18:38:26 2019 +0100
summary: Bug 1505622 - Skip last ditch GC and fail the allocation if we already did last ditch GC within the last minute r=sfink

Jon, is bug 1505622 a likely regressor?

Comment 5

[Jon Coppeard (:jonco)]

This was caused by a missing error check in the shell.

Comment 6

[Jon Coppeard (:jonco)]

Attachment: Bug 1545369 - Check for OOM in shell ReportUnhandledRejections function r=pbone?

Add an error check in ReportUnhandledRejections function.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/d06933631a6e
Check for OOM in shell ReportUnhandledRejections function r=pbone

Comment 8

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/d06933631a6e