1629503 - Assertion failure: !doneValue.isMagic(), at jit/JitFrames.cpp:118

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect, P1)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20200410-82d84da94d8d (debug build, run with --fuzzing-safe --no-threads --ion-warmup-threshold=1 --baseline-warmup-threshold=0 --disable-oom-functions):

function testWithAwait() {
  const g37 = newGlobal({newCompartment: true});
  const dbg = new Debugger(g37);
  g37.eval(`
    async function f() {
      await p;
    };
  `);
  dbg.onEnterFrame = function(frame) { 
    [ , dbg ] = [];
  }
  g37.eval("var y;");
  g37.eval("var p = f();");
}
testWithAwait();

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x000055555669a543 in js::jit::HandleException(js::jit::ResumeFromException*) ()
#1  0x00000a0d3c45b766 in ?? ()
[...]
#5  0x0000000000000000 in ?? ()
rax	0x555556e90eb9	93825018695353
rbx	0x7ffff5eeeaa4	140737319463588
rcx	0x555557f4d850	93825036245072
rdx	0x0	0
rsi	0x7ffff6efd770	140737336301424
rdi	0x7ffff6efc540	140737336296768
rbp	0x7fffffffa270	140737488331376
rsp	0x7fffffff9c40	140737488329792
r8	0x7ffff6efd770	140737336301424
r9	0x7ffff7f9bd00	140737353727232
r10	0x0	0
r11	0x0	0
r12	0x7fffffffa290	140737488331408
r13	0xaaaaaaaaaaaaaaaa	-6148914691236517206
r14	0x7fffffffa1a0	140737488331168
r15	0x7ffff5e27000	140737318645760
rip	0x55555669a543 <js::jit::HandleException(js::jit::ResumeFromException*)+11731>
=> 0x55555669a543 <_ZN2js3jit15HandleExceptionEPNS0_19ResumeFromExceptionE+11731>:	movl   $0x76,0x0
   0x55555669a54e <_ZN2js3jit15HandleExceptionEPNS0_19ResumeFromExceptionE+11742>:	callq  0x5555558167f6 <abort>

Comment 1

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Bug 1629503 - Set the hasTryBlock flag for JSOp::TryDestructuring. r?arai!

It's basically like a try-catch so we have to ensure we don't optimize away
the done/iter stack slots.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cb9f27043c05
Set the hasTryBlock flag for JSOp::TryDestructuring. r=arai

Comment 5

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/cb9f27043c05

Comment 6

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as fixed on rev mozilla-central 20200423145559-03626342f6e6.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.