1778439 - Assertion failure: hadEvaluationError(), at js/src/builtin/ModuleObject.cpp:1120

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20220706-e651649b0dac (debug build, run with --fuzzing-safe --ion-offthread-compile=off test.js):

evaluate(`parseModule("").evaluationError `);

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x57d4be27 in js::ModuleObject::evaluationError() const ()
#1  0x57b3d5c0 in ShellModuleObjectWrapper_evaluationErrorGetter_raw(js::ModuleObject*) ()
#2  0x57b3d12a in bool ShellModuleWrapperGetter<js::shell::ShellModuleObjectWrapper, JS::Value (*)(js::ModuleObject*), bool (*)(JSContext*, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>)>(JSContext*, JS::CallArgs const&, JS::Value (*)(js::ModuleObject*), bool (*)(JSContext*, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>)) ()
#3  0x57b3c422 in ShellModuleObjectWrapper_evaluationErrorGetter(JSContext*, unsigned int, JS::Value*) ()
#4  0x57cb2921 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) ()
[...]
#33 0x57b22bc0 in main ()
eax	0x5672bf90	1450360720
ebx	0x591dda6c	1495128684
ecx	0x591df54c	1495135564
edx	0xf7b3ccc7	-139211577
esi	0xfffb1088	-323448
edi	0xf533f0d0	-181145392
ebp	0xfffb1038	4294643768
esp	0xfffb1020	4294643744
eip	0x57d4be27 <js::ModuleObject::evaluationError() const+247>
=> 0x57d4be27 <_ZNK2js12ModuleObject15evaluationErrorEv+247>:	movl   $0x460,0x0
   0x57d4be31 <_ZNK2js12ModuleObject15evaluationErrorEv+257>:	call   0x57bae0ef <abort>

Likely a shell issue with ShellModuleObjectWrapper_evaluationErrorGetter.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220706214039-e651649b0dac.
The bug appears to have been introduced in the following build range:

Start: f93461c8f7bac0491ec2acce3a98a58bea6acb9d (20220706151542)
End: e651649b0dace098a1af4d12d8cd2af5cb0d0b92 (20220706214039)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=f93461c8f7bac0491ec2acce3a98a58bea6acb9d&tochange=e651649b0dace098a1af4d12d8cd2af5cb0d0b92

Comment 4

[Jon Coppeard (:jonco)]

Attachment: Bug 1778439 - Don't assert whether an evaluation error has been set in the shell's ModuleObject.evaluationError getter r?arai

This makes this return undefined if there has been no error set, in line with
the other shell getters.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1778318

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6089693c3337
Don't assert whether an evaluation error has been set in the shell's ModuleObject.evaluationError getter r=arai

Comment 7

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/6089693c3337

Comment 8

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220707214915-f609957386ac.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.