1548759 - Assertion failure: !cx->isExceptionPending(), at js/src/builtin/TestingFunctions.cpp:1942 or Assertion failure: !JS_IsExceptionPending(cx_), at vm/JSContext.h:1185

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 083106d8fc74 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

(function() {
    oomTest(async function() {
        x;
    })
})();

Backtrace:

#0 RunIterativeFailureTest (cx=0x7f7146319000, params=..., simulator=...) at js/src/builtin/TestingFunctions.cpp:1942
#1 0x000055a85e6605f7 in OOMTest (cx=0x7f7146319000, argc=<optimized out>, vp=<optimized out>) at js/src/builtin/TestingFunctions.cpp:2119
#2 0x000055a85e265035 in CallJSNative (cx=0x7f7146319000, native=0x55a85e660500 <OOMTest(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/vm/Interpreter.cpp:443
#3 0x000055a85e254ea4 in js::InternalCallOrConstruct (cx=0x7f7146319000, args=..., construct=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:535
#4 0x000055a85e24adbd in js::CallFromStack (cx=<optimized out>, args=...) at js/src/vm/Interpreter.cpp:594
#5 Interpret (cx=<optimized out>, state=...) at js/src/vm/Interpreter.cpp:3082
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Due to skipped revisions, the first bad revision could be any of:
changeset: https://hg.mozilla.org/mozilla-central/rev/827f19b7bf2b
user: Jan de Mooij
date: Thu May 02 08:38:06 2019 +0000
summary: Bug 1541404 part 18 - Various minor changes for debugger support. r=tcampbell

changeset: https://hg.mozilla.org/mozilla-central/rev/8dce6a746f7b
user: Tom Schuster
date: Thu May 02 11:12:27 2019 +0000
summary: Bug 1547131 - JS shell: show the stack for thrown values that are not Error objects. r=jorendorff

Jan/Tom, which one of bug 1541404 or bug 1547131 may be the likely regressor? I'm guessing bug 1547131?

Comment 3

[Jan de Mooij [:jandem]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #2)

Jan/Tom, which one of bug 1541404 or bug 1547131 may be the likely regressor? I'm guessing bug 1547131?

Yes I think bug 1547131 is the more likely regressor...

Comment 4

[Tom Schuster [:evilpie]]

PrintError (https://searchfox.org/mozilla-central/rev/b59a99943de4dd314bae4e44ab43ce7687ccbbec/js/src/shell/js.cpp#9499) can also set a pending exception. We either add another JS_ClearPendingException call or move the call outside the PrintStackTrace block again.

Comment 5

[Tom Schuster [:evilpie]]

Attachment: Bug 1548759 - Always clear exception after PrintError. r?jorendorff

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

oomTest(function() {
    return {
        x: async function() {
            y
        }(), z
    }
});

asserts js debug shell compiled with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion at:

Assertion failure: !JS_IsExceptionPending(cx_), at vm/JSContext.h:1185

This also points to bug 1547131 as a regressor - please also add this testcase?

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1177f0af9ec0
Always clear exception after PrintError. r=jorendorff

Comment 8

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/1177f0af9ec0

Comment 9

[Tom Schuster [:evilpie]]

Attachment: Bug 1548759 - Add crash tests. r?jandem

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/dd17bc19ea6d
Add crash tests. r=jorendorff

Comment 11

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/dd17bc19ea6d