Open Bug 1664211 Opened 3 years ago Updated 5 months ago

Assertion failure: !cx->isExceptionPending(), at /builds/worker/checkouts/gecko/js/src/vm/JSContext-inl.h:306

Categories

(Core :: WebVR, defect)

Product:
Core
Component:
WebVR
Type:
defect

Tracking

()

Tracking Flags:
Tracking Status
firefox82 --- affected

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, bugmon, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(2 files)

testcase.html
770 bytes, text/html
Details
prefs.js
8.88 KB, application/x-javascript
Details
Attached file testcase.html —

Testcase found while fuzzing mozilla-central rev 8948d4a41f23 (built with --enable-debug).

Assertion failure: !cx->isExceptionPending(), at /builds/worker/checkouts/gecko/js/src/vm/JSContext-inl.h:306

    #0 0x7fea2d024d35 in js::CheckForInterrupt(JSContext*) /builds/worker/checkouts/gecko/js/src/vm/JSContext-inl.h:306:3
    #1 0x7fea2d075999 in bool ArrayJoinKernel<CharSeparatorOp<unsigned char> >(JSContext*, CharSeparatorOp<unsigned char>, JS::Handle<JSObject*>, unsigned long, js::StringBuffer&) /builds/worker/checkouts/gecko/js/src/builtin/Array.cpp:1261:10
    #2 0x7fea2d074e53 in js::array_join(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/js/src/builtin/Array.cpp:1458:12
    #3 0x7fea2d01b521 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:508:13
    #4 0x7fea2d01ac99 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:600:12
    #5 0x7fea2d01c7f1 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:665:10
    #6 0x7fea2d01088c in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:669:10
    #7 0x7fea2d01088c in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3337:16
    #8 0x7fea2d007c43 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:469:13
    #9 0x7fea2d01ac6a in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:637:13
    #10 0x7fea2d01c7f1 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:665:10
    #11 0x7fea2d01ca2f in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:682:8
    #12 0x7fea2d15e1fb in js::Call(JSContext*, JS::Handle<JS::Value>, JSObject*, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.h:98:10
    #13 0x7fea2d326a0f in MaybeCallMethod(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/JSObject.cpp:2941:10
    #14 0x7fea2d3262fd in JS::OrdinaryToPrimitive(JSContext*, JS::Handle<JSObject*>, JSType, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/JSObject.cpp:2987:10
    #15 0x7fea2d326fcd in js::ToPrimitiveSlow(JSContext*, JSType, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/JSObject.cpp:3084:10
    #16 0x7fea2d461cf7 in ToPrimitive /builds/worker/checkouts/gecko/js/src/vm/JSObject.h:782:10
    #17 0x7fea2d461cf7 in JSString* js::ToStringSlow<(js::AllowGC)1>(JSContext*, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType) /builds/worker/checkouts/gecko/js/src/vm/StringType.cpp:2252:10
    #18 0x7fea2915ff62 in ToString /builds/worker/workspace/obj-build/dist/include/js/Conversions.h:262:10
    #19 0x7fea2915ff62 in bool mozilla::dom::FindEnumStringIndex<false>(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::EnumEntry const*, char const*, char const*, int*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/BindingUtils.h:1318:28
    #20 0x7fea2b475fed in mozilla::dom::XRSystem::RequestSession(JSContext*, mozilla::dom::XRSessionMode, mozilla::dom::XRSessionInit const&, mozilla::dom::CallerType, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/vr/XRSystem.cpp:201:13
    #21 0x7fea29cab428 in mozilla::dom::XRSystem_Binding::requestSession_promiseWrapper(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/WebXRBinding.cpp:7269:60
    #22 0x7fea2a246fb0 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ConvertExceptionsToPromises>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3229:13
    #23 0x7fea2d01b521 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:508:13
    #24 0x7fea2d01ac99 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:600:12
    #25 0x7fea2d01c7f1 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:665:10
    #26 0x7fea2d01088c in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:669:10
    #27 0x7fea2d01088c in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3337:16
    #28 0x7fea2d007c43 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:469:13
    #29 0x7fea2d01ac6a in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:637:13
    #30 0x7fea2d01c7f1 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:665:10
    #31 0x7fea2d01ca2f in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:682:8
    #32 0x7fea2d3f82b7 in js::CallSelfHostedFunction(JSContext*, JS::Handle<js::PropertyName*>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/SelfHosting.cpp:1694:10
    #33 0x7fea2d1acdc1 in AsyncFunctionResume(JSContext*, JS::Handle<js::AsyncFunctionGeneratorObject*>, ResumeKind, JS::Handle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/AsyncFunction.cpp:128:8
    #34 0x7fea2d271a07 in AsyncFunctionPromiseReactionJob /builds/worker/checkouts/gecko/js/src/builtin/Promise.cpp:1701:10
    #35 0x7fea2d271a07 in PromiseReactionJob(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/js/src/builtin/Promise.cpp:1853:12
    #36 0x7fea2d01b521 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:508:13
    #37 0x7fea2d01ac99 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:600:12
    #38 0x7fea2d01c7f1 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:665:10
    #39 0x7fea2d01ca2f in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:682:8
    #40 0x7fea2d121b47 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jsapi.cpp:2820:10
    #41 0x7fea295e8a90 in mozilla::dom::PromiseJobCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/PromiseBinding.cpp:30:8
    #42 0x7fea270ff18c in mozilla::dom::PromiseJobCallback::Call(mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:91:12
    #43 0x7fea270fe2f3 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:104:12
    #44 0x7fea270fe2f3 in mozilla::PromiseJobRunnable::Run(mozilla::AutoSlowOperation&) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:211:18
    #45 0x7fea270ec3d4 in mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:646:17
    #46 0x7fea270ed019 in mozilla::CycleCollectedJSContext::AfterProcessTask(unsigned int) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:461:3
    #47 0x7fea282c3627 in XPCJSContext::AfterProcessTask(unsigned int) /builds/worker/checkouts/gecko/js/xpconnect/src/XPCJSContext.cpp:1407:28
    #48 0x7fea271f51a8 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1271:24
    #49 0x7fea271fa83a in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:513:10
    #50 0x7fea27af7846 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:87:21
    #51 0x7fea27a6a463 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #52 0x7fea27a6a37d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #53 0x7fea27a6a37d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #54 0x7fea2b705ff8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
    #55 0x7fea2cedf3a3 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:913:20
    #56 0x7fea27af8609 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:237:9
    #57 0x7fea27a6a463 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #58 0x7fea27a6a37d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #59 0x7fea27a6a37d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #60 0x7fea2cedef88 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:744:34
    #61 0x5632a04fc8d7 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #62 0x5632a04fc8d7 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:303:18
    #63 0x7fea429c1b96 in __libc_start_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310
Flags: in-testsuite?
Attached file prefs.js —

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200912092623-6f8fba692420.
The bug appears to have been introduced in the following build range:

Start: a13c047193c3ee0701ec9c2aaac5735ba173978c (20200406193301)
End: a3426e213b24c1da02ec131ae2fff6f29d04b2a4 (20200406194107)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=a13c047193c3ee0701ec9c2aaac5735ba173978c&tochange=a3426e213b24c1da02ec131ae2fff6f29d04b2a4

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.