Crash [@ JSObject::getClass] involving async/await
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
Tracking | Status | |
---|---|---|
firefox-esr60 | --- | unaffected |
firefox67 | --- | unaffected |
firefox68 | --- | fixed |
People
(Reporter: gkw, Assigned: jonco)
References
(Regression)
Details
(4 keywords, Whiteboard: [jsbugmon:update])
Crash Data
Attachments
(2 files)
The following testcase crashes on mozilla-central revision 02b89c29412b (build with --enable-debug, run with --fuzzing-safe --no-threads --no-baseline --no-ion --no-cgc):
// jsfunfuzz-generated
async function f(x) {
await await x;
};
for (let i = 0; i < 7; ++i) {
for (let j = 0; j < 89; ++j) {
f();
}
}
// Adapted from randomly chosen test: js/src/jit-test/tests/parser/bug-1263355-14.js
gcparam("maxBytes", gcparam("gcBytes"));
Backtrace:
#0 JSObject::getClass (this=0x0) at js/src/vm/JSObject.h:106
#1 JSObject::is<js::ArrayObject> (this=0x0) at js/src/vm/JSObject.h:508
#2 JSObject::as<js::ArrayObject> (this=0x0) at js/src/vm/JSObject.h:513
#3 ReportUnhandledRejections (cx=<optimized out>) at js/src/shell/js.cpp:10667
/snip
For detailed crash information, see attachment.
![]() |
Reporter | |
Comment 1•6 years ago
|
||
![]() |
Reporter | |
Comment 2•6 years ago
|
||
![]() |
Reporter | |
Comment 4•6 years ago
|
||
autobisectjs shows this is probably related to the following changeset:
The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/c6317f06ed07
user: Jon Coppeard
date: Mon Apr 01 18:38:26 2019 +0100
summary: Bug 1505622 - Skip last ditch GC and fail the allocation if we already did last ditch GC within the last minute r=sfink
Jon, is bug 1505622 a likely regressor?
![]() |
Reporter | |
Updated•6 years ago
|
Assignee | ||
Comment 5•6 years ago
|
||
This was caused by a missing error check in the shell.
Assignee | ||
Comment 6•6 years ago
|
||
Add an error check in ReportUnhandledRejections function.
Comment 8•6 years ago
|
||
bugherder |
Updated•6 years ago
|
Description
•