1564230 - Assertion failure: isExceptionPending(), at js/src/vm/JSContext.cpp:1215 with Debugger

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 7b346e25734f (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

// jsfunfuzz-generated
options("strict_mode");
// Adapted from randomly chosen test: js/src/jit-test/tests/gc/bug-1292564.js
oomTest(function () {
    g = newGlobal({
        sameZoneAs: this
    });
    Debugger(g).onDebuggerStatement = function(frame) {
        frame.eval("");
    };
    g.eval("debugger");
});

Backtrace:

#0  JSContext::alreadyReportedError (this=0x7fe1cb417000) at js/src/vm/JSContext.cpp:1215
#1  0x000055a3911c2649 in DebuggerGenericEval (cx=0x7fe1cb417000, chars=..., bindings=..., options=..., dbg=0x7fe1cac6f800, envArg=..., iter=0x7ffd0514ac00) at js/src/vm/Debugger.cpp:9760
#2  0x000055a3911c2060 in js::DebuggerFrame::eval (cx=0x7fe1cb417000, frame=..., chars=..., bindings=..., options=...) at js/src/vm/Debugger.cpp:9828
#3  0x000055a3911c85a5 in js::DebuggerFrame::evalMethod (cx=0x7fe1cb417000, argc=<optimized out>, vp=<optimized out>) at js/src/vm/Debugger.cpp:10423
#4  0x000055a391035f45 in CallJSNative (cx=0x7fe1cb417000, native=0x55a3911c8280 <js::DebuggerFrame::evalMethod(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/vm/Interpreter.cpp:448
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/4f26d027343a
user: Jim Blandy
date: Sun Jul 07 09:47:52 2019 +0000
summary: Bug 1470558: Use Completion type for Debugger eval-related methods. r=jorendorff

Jim, is bug 1470558 a likely regressor?

Comment 3

[Liz Henry (:lizzard) (relman/hg->git project)]

Steven, can you help find an owner for this bug / assign a priority? Thanks!

Comment 4

[Steven DeTar [:sdetar]]

Jason, could you help triage this bug and help find a good owner to look at it?

Comment 5

[Jim Blandy :jimb]

I can reproduce this. Taking.

Comment 7

[Jim Blandy :jimb]

Got distracted by other things; picking this up again.

Comment 8

[Fuzzing Team]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 835d0d9cdae8).

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Comment 8 is incorrect, I can still reproduce with m-c rev efe4a620841c .

Comment 10

[janet [:janet]]

Hi Jim - can you please give an update on this, it's marked as a P1 for FF70.

Comment 11

[Jim Blandy :jimb]

I believe this is a duplicate of bug 1565278, but I'm having a little trouble reproducing this at the moment. I have a fix for that bug, so I should be able to resolve this tomorrow (Tuesday).

Comment 12

[Jim Blandy :jimb]

This is not a duplicate of bug 1565278, but I can reproduce the bug.

It looks easy to fix. (Famous last words.)

Comment 13

[Jim Blandy :jimb]

Attachment: Bug 1564230: Properly report OOM from js::DebugEnvironments::updateLiveEnvironments. r?jorendorff

I don't have a test for this that doesn't take several minutes to pass, and the
change seems too obvious to require a test.

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c6aac8e24622
Properly report OOM from js::DebugEnvironments::updateLiveEnvironments. r=jorendorff

Comment 15

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/c6aac8e24622

Comment 16

[Ryan VanderMeulen [:RyanVM]]

Is there a user impact which justifies backport consideration here or can this ride with Fx71 to release?

Comment 17

[Jim Blandy :jimb]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #16)

Is there a user impact which justifies backport consideration here or can this ride with Fx71 to release?

No, there is no urgent user impact.