1922620 - Assertion failure: cx->isExceptionPending() || cx->isPropagatingForcedReturn() || cx->hadUncatchableException(), at js/src/vm/Interpreter.cpp:440

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Nils Bars]

Steps to reproduce:

Version: 7e0ae4372c52b8183d1178132dd6493edb576738

Command line:

js --fuzzing-safe <test-case>

Test case:

try {
  for (; (() => {
         function a() {
           function b() { return a }
           c = b()
           try {
             disnative(b)
           } catch {
             async function d() {}
             d().finally(c)
           }
         } a()
       })();)
    ;
} catch {
}

Actual results:

This has been initially observed as Assertion failure: IsGCThingValidAfterMovingGC(t), at js/src/gc/Marking-inl.h:230, but the test case now raises the following error:

Assertion failure: cx->isExceptionPending() || cx->isPropagatingForcedReturn() || cx->hadUncatchableException(), at js/src/vm/Interpreter.cpp:440
     #0 0x559e6754914e in AssertExceptionResult(JSContext*) /js/src/vm/Interpreter.cpp:438:3
    #1 0x559e6754a56f in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /js/src/vm/Interpreter.cpp:533:5
    #2 0x559e6754974f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:624:12
    #3 0x559e68404d93 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /js/src/jit/BaselineIC.cpp:1677:10
    #4 0x676780abd5e  (<unknown module>)

Comment 1

[Jan de Mooij [:jandem]]

The new assertion was added in bug 1921780 and should be harmless. Could be an issue with the disnative shell function.

The GC assertion is probably more serious though. Did you see that with the test case here or with a different test?

I'll take a look next week.

Comment 2

[Nils Bars]

This test case triggered the GC assertion during fuzzing, but this was probably due to the GC state from previous test cases.

Comment 3

[Jan de Mooij [:jandem]]

This is a problem with the disnative shell function that's now caught by the assertions added in bug 1921780 \o/. Setting "Depends On" because "Regressed By" feels wrong since it's not really a regression.

Comment 4

[Jan de Mooij [:jandem]]

Attachment: Bug 1922620 - Fix disnative testing function to not return false without reporting an exception. r?arai!

Also removes some unnecessary null checks.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/600475b93fe9
Fix disnative testing function to not return false without reporting an exception. r=arai

Comment 6

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/600475b93fe9