Assertion failure: !cx->isExceptionPending(), at js/src/builtin/TestingFunctions.cpp:1942 or Assertion failure: !JS_IsExceptionPending(cx_), at vm/JSContext.h:1185

RESOLVED FIXED in Firefox 68

Status

()

defect
P1
critical
RESOLVED FIXED
2 months ago
6 days ago

People

(Reporter: gkw, Assigned: evilpie)

Tracking

(Blocks 1 bug, Regression, 4 keywords)

Trunk
mozilla68
x86_64
Linux
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox-esr60 unaffected, firefox67 unaffected, firefox68 fixed)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(3 attachments)

Reporter

Description

2 months ago

The following testcase crashes on mozilla-central revision 083106d8fc74 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

(function() {
    oomTest(async function() {
        x;
    })
})();

Backtrace:

#0 RunIterativeFailureTest (cx=0x7f7146319000, params=..., simulator=...) at js/src/builtin/TestingFunctions.cpp:1942
#1 0x000055a85e6605f7 in OOMTest (cx=0x7f7146319000, argc=<optimized out>, vp=<optimized out>) at js/src/builtin/TestingFunctions.cpp:2119
#2 0x000055a85e265035 in CallJSNative (cx=0x7f7146319000, native=0x55a85e660500 <OOMTest(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/vm/Interpreter.cpp:443
#3 0x000055a85e254ea4 in js::InternalCallOrConstruct (cx=0x7f7146319000, args=..., construct=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:535
#4 0x000055a85e24adbd in js::CallFromStack (cx=<optimized out>, args=...) at js/src/vm/Interpreter.cpp:594
#5 Interpret (cx=<optimized out>, state=...) at js/src/vm/Interpreter.cpp:3082
/snip

For detailed crash information, see attachment.

Reporter

Comment 2

2 months ago

Due to skipped revisions, the first bad revision could be any of:
changeset: https://hg.mozilla.org/mozilla-central/rev/827f19b7bf2b
user: Jan de Mooij
date: Thu May 02 08:38:06 2019 +0000
summary: Bug 1541404 part 18 - Various minor changes for debugger support. r=tcampbell

changeset: https://hg.mozilla.org/mozilla-central/rev/8dce6a746f7b
user: Tom Schuster
date: Thu May 02 11:12:27 2019 +0000
summary: Bug 1547131 - JS shell: show the stack for thrown values that are not Error objects. r=jorendorff

Jan/Tom, which one of bug 1541404 or bug 1547131 may be the likely regressor? I'm guessing bug 1547131?

Flags: needinfo?(jdemooij)
Flags: needinfo?(evilpies)
Regressed by: 1547131

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #2)

Jan/Tom, which one of bug 1541404 or bug 1547131 may be the likely regressor? I'm guessing bug 1547131?

Yes I think bug 1547131 is the more likely regressor...

Flags: needinfo?(jdemooij)
Assignee

Comment 4

2 months ago

PrintError (https://searchfox.org/mozilla-central/rev/b59a99943de4dd314bae4e44ab43ce7687ccbbec/js/src/shell/js.cpp#9499) can also set a pending exception. We either add another JS_ClearPendingException call or move the call outside the PrintStackTrace block again.

Flags: needinfo?(evilpies)
Assignee

Updated

2 months ago
Assignee: nobody → evilpies
Status: NEW → ASSIGNED
Priority: -- → P1
Reporter

Comment 6

Last month
oomTest(function() {
    return {
        x: async function() {
            y
        }(), z
    }
});

asserts js debug shell compiled with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion at:

Assertion failure: !JS_IsExceptionPending(cx_), at vm/JSContext.h:1185

This also points to bug 1547131 as a regressor - please also add this testcase?

Flags: needinfo?(evilpies)
Summary: Assertion failure: !cx->isExceptionPending(), at js/src/builtin/TestingFunctions.cpp:1942 → Assertion failure: !cx->isExceptionPending(), at js/src/builtin/TestingFunctions.cpp:1942 or Assertion failure: !JS_IsExceptionPending(cx_), at vm/JSContext.h:1185

Comment 7

Last month
Pushed by evilpies@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/1177f0af9ec0
Always clear exception after PrintError. r=jorendorff

Comment 8

Last month
bugherder
Status: ASSIGNED → RESOLVED
Closed: Last month
Resolution: --- → FIXED
Target Milestone: --- → mozilla68
Assignee

Updated

10 days ago
Flags: needinfo?(evilpies)
You need to log in before you can comment on or make changes to this bug.