1921215 - Assertion failure: cx->isExceptionPending(), at js/src/jit/Bailouts.cpp:319

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

Steps to reproduce:

Checkout commit 6b6c3965d0a79880493b8ae44a92389b72d90636 and invoke the js shell as follows:

js --fast-warmup --fuzzing-safe <testcase>

Actual results:

Assertion failure: cx->isExceptionPending(), at js/src/jit/Bailouts.cpp:319

==2768723==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x5627b073cdf1 bp 0x7fff0de6b740 sp 0x7fff0de6b610 T2768723)
==2768723==The signal is caused by a WRITE memory access.
==2768723==Hint: address points to the zero page.
    #0 0x5627b073cdf1 in js::jit::ExceptionHandlerBailout(JSContext*, js::jit::InlineFrameIterator const&, js::jit::ResumeFromException*, js::jit::ExceptionBailoutInfo const&) js/src/jit/Bailouts.cpp:319:5
    #1 0x5627b0e50e1e in js::jit::HandleExceptionIon(JSContext*, js::jit::InlineFrameIterator const&, js::jit::ResumeFromException*, bool*) js/src/jit/JitFrames.cpp:314:15
    #2 0x5627b0e50e1e in js::jit::HandleException(js::jit::ResumeFromException*) js/src/jit/JitFrames.cpp:787:9
    #3 0x307b2eabc5e5  (<unknown module>)

Comment 1

[Nils Bars]

Attachment: bug.js

Comment 2

[Nils Bars]

I would be grateful if there were a grace period to fix up posts.

Comment 3

[Andrew McCreight [:mccr8]]

I've fixed the markup error in comment 0.

Comment 4

[Matthew Gaudet (he/him) [:mgaudet]]

(In reply to Nils Bars from comment #2)

I would be grateful if there were a grace period to fix up posts.

I think if you have editbugs you can do it yourself. See instructions here

Comment 5

[Andrew McCreight [:mccr8]]

(In reply to Matthew Gaudet (he/him) [:mgaudet] from comment #4)

I think if you have editbugs you can do it yourself. See instructions here

Most people don't have editbugs, unless they are employees.

Comment 6

[Matthew Gaudet (he/him) [:mgaudet]]

(In reply to Andrew McCreight [:mccr8] from comment #5)

Most people don't have editbugs, unless they are employees.

True, but it's wide open to get it with a very low bar

Comment 7

[Jan de Mooij [:jandem]]

This is a small but nasty test case :) What happens is:

1. We throw an overrecursion exception and this triggers an "exception handler bailout" from Ion to resume at a catch-block in the Baseline Interpreter.
2. During the bailout, we execute a RegExpMatcher recover instruction that executes a regular expression.
3. The test calls timeout, and this timeout is handled during this regular expression execution. This clears the pending exception and we now throw an uncatchable exception to stop execution.
4. The exception bailout code doesn't expect this change from catchable to uncatchable exception.

This looks like an overzealous assertion. There's another one in HandleExceptionIon and if I remove both of them, I think we do the right thing and the test finishes executing.

I don't really like deleting these assertions for this edge case though. I'll see if we can track these uncatchable exceptions a bit better.

Let's keep this hidden for now but I don't think this is security-sensitive.

Comment 8

[Jan de Mooij [:jandem]]

Attachment: Bug 1921215 - Fix some assertions to include uncatchable exceptions. r?jonco!

Bailouts can execute recover instructions, and recover instructions can perform
an interrupt check that can throw an uncatchable exception.

We don't have a good way to check if we're currently throwing an uncatchable exception,
so this patch adds a flag to the context that's true if we've ever thrown one.
This way we can still catch bugs caused by incorrectly returning false or nullptr
without throwing an exception.

Comment 9

[Nils Bars]

(In reply to Matthew Gaudet (he/him) [:mgaudet] from comment #6)

(In reply to Andrew McCreight [:mccr8] from comment #5)

Most people don't have editbugs, unless they are employees.

True, but it's wide open to get it with a very low bar

Thanks!

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/35caa008c3f0
Fix some assertions to include uncatchable exceptions. r=jonco

Comment 11

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/35caa008c3f0