1787730 - Assertion failure: cx_->isExceptionPending(), at frontend/BytecodeCompiler.cpp:72

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20220827-0b115d7382af (debug build, run with --fuzzing-safe --ion-offthread-compile=off --delazification-mode=concurrent-df+on-demand --baseline-eager --ion-warmup-threshold=0 test.js):

oomTest(() => evalcx(0))

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x000055a5cb4a0ff7 in AutoAssertReportedException::~AutoAssertReportedException() ()
#1  0x000055a5cb4a79fb in bool CompileGlobalScriptToStencilAndMaybeInstantiate<char16_t>(JSContext*, js::ErrorContext*, unsigned long, js::LifoAlloc&, js::frontend::CompilationInput&, js::frontend::ScopeBindingCache*, JS::SourceText<char16_t>&, js::ScopeKind, mozilla::Variant<mozilla::UniquePtr<js::frontend::ExtensibleCompilationStencil, JS::DeletePolicy<js::frontend::ExtensibleCompilationStencil> >, RefPtr<js::frontend::CompilationStencil>, js::frontend::CompilationGCOutput*>&) ()
#2  0x000055a5cb4734c4 in js::frontend::CompileGlobalScript(JSContext*, js::ErrorContext*, unsigned long, JS::ReadOnlyCompileOptions const&, JS::SourceText<char16_t>&, js::ScopeKind) ()
#3  0x000055a5cae4dd8d in bool EvaluateSourceBuffer<char16_t>(JSContext*, js::ScopeKind, JS::Handle<JSObject*>, JS::ReadOnlyCompileOptions const&, JS::SourceText<char16_t>&, JS::MutableHandle<JS::Value>) ()
#4  0x000055a5cae4d9c8 in JS::Evaluate(JSContext*, JS::ReadOnlyCompileOptions const&, JS::SourceText<char16_t>&, JS::MutableHandle<JS::Value>) ()
#5  0x000055a5cabaaf7e in EvalInContext(JSContext*, unsigned int, JS::Value*) ()
#6  0x00003f5ec83e628e in ?? ()
#7  0x00007ffca753ca28 in ?? ()
#8  0x00007ffca753c370 in ?? ()
#9  0x0000000000000000 in ?? ()
rax	0x55a5c98d1a0c	94170539432460
rbx	0x7ff0ec72a100	140672735813888
rcx	0x55a5cc2ab060	94170583314528
rdx	0x1	1
rsi	0x0	0
rdi	0x7ff0ed83d7d0	140672753719248
rbp	0x7ffca753ada0	140723115765152
rsp	0x7ffca753ad90	140723115765136
r8	0x0	0
r9	0x78	120
r10	0x55a5c956e55b	94170535880027
r11	0x7ff0ed6d1340	140672752227136
r12	0xaaaaaaaaaaaaaaaa	-6148914691236517206
r13	0x7ffca753c080	140723115769984
r14	0x0	0
r15	0x7ff0ec72a100	140672735813888
rip	0x55a5cb4a0ff7 <AutoAssertReportedException::~AutoAssertReportedException()+215>
=> 0x55a5cb4a0ff7 <_ZN27AutoAssertReportedExceptionD2Ev+215>:	movl   $0x48,0x0
   0x55a5cb4a1002 <_ZN27AutoAssertReportedExceptionD2Ev+226>:	callq  0x55a5cac11bb4 <abort>

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220829094551-ad01d1ce5556.
The bug appears to have been introduced in the following build range:

Start: c683eec886927339b9e34f6c3aef2b9360ea99cc (20220819145720)
End: 7259398085eb8272cf374a2e7b255b2c19cc8c41 (20220819150333)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=c683eec886927339b9e34f6c3aef2b9360ea99cc&tochange=7259398085eb8272cf374a2e7b255b2c19cc8c41

Comment 4

[Steven DeTar [:sdetar]]

:bthrall, could you take a quick look at this bug. Based on the Pushlog in the Bugmon Analysis is comment 3, this might be caused by your push.

Comment 5

[Bryan Thrall [:bthrall]]

Yes, this is almost certainly caused by the changes for bug 1761581. I will look at finding a fix ASAP.

My intuition says I can find the cause in an hour or two, but it might take longer.

Comment 6

[Steven DeTar [:sdetar]]

I am assigning this to :bthrall since he is actively working on this.

Comment 7

[Bryan Thrall [:bthrall]]

Attachment: Bug 1787730 - Ignore errors during off-thread delazification r=arai,nbp

Off-thread delazification was not reporting OOM back to the main thread's
JSContext, causing the assertion at BytecodeCompiler.cpp:71 to fail.

https://searchfox.org/mozilla-central/source/js/src/frontend/BytecodeCompiler.cpp#71

OverRecursed needs to be reported back to the JSContext, too, but I don't have
a test for that yet.

Based on JSContext::onOutOfMemory() and JSContext::onOverRecursed(), OOM takes
precedence over OverRecursed, so if we check OOM first, it will persist through
the check for OverRecursed, even if both have been set. If both have been set,
the expected result is an OOM exception status.

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

Based on comment #3, this bug contains a bisection range found by bugmon. However, the Regressed by field is still not filled.

:bthrall, if possible, could you fill the Regressed by field and investigate this regression?

For more information, please visit auto_nag documentation.

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1782569

Comment 10

[Bryan Thrall [:bthrall]]

My current patch depends on changes in the patch for bug 1786117.

If we need to resolve this bug sooner, I can easily adapt the patch to not depend on bug 1786117.

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

This bug prevents fuzzing from making progress; however, it has low severity. It is important for fuzz blocker bugs to be addressed in a timely manner (see here why?).
:bthrall, could you increase the severity?

For more information, please visit auto_nag documentation.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/bb6b001abe51
Ignore errors during off-thread delazification r=arai,nbp

Comment 13

[Bryan Thrall [:bthrall]]

I'm not sure what severity would be appropriate here, so I raised it to S3. Feel free to update it as you feel appropriate.

I just landed a patch for this, so unless something goes wrong, this bug will be resolved soon anyway :)

Comment 14

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/bb6b001abe51

Comment 15

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220906213903-b7f6557aaf06.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.