1930808 - Assertion failure: cx->isExceptionPending() || cx->isPropagatingForcedReturn() || cx->hadUncatchableException(), at vm/Interpreter.cpp:440

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug stack

new WebAssembly.Tag({ parameters: [] });
oomTest(function () {
  new WebAssembly.Tag({ parameters: [] });
});

439       MOZ_ASSERT(cx->isExceptionPending() || cx->isPropagatingForcedReturn() ||
(gdb) bt
#0  AssertExceptionResult (cx=cx@entry=0x7ffff6f36200) at /home/i32g7900a/trees/mozilla-central/js/src/vm/Interpreter.cpp:439
#1  0x000055555727067f in CallJSNative (cx=cx@entry=0x7ffff6f36200, native=native@entry=0x555558705a00 <js::WasmTagObject::construct(JSContext*, unsigned int, JS::Value*)>, reason=reason@entry=js::CallReason::Call, args=...) at /home/i32g7900a/trees/mozilla-central/js/src/vm/Interpreter.cpp:537
#2  0x000055555727a32d in CallJSNativeConstructor (cx=cx@entry=0x7ffff6f36200, native=0x555558705a00 <js::WasmTagObject::construct(JSContext*, unsigned int, JS::Value*)>, args=...) at /home/i32g7900a/trees/mozilla-central/js/src/vm/Interpreter.cpp:550
#3  0x0000555557249fb2 in InternalConstruct (cx=cx@entry=0x7ffff6f36200, args=..., reason=reason@entry=js::CallReason::Call) at /home/i32g7900a/trees/mozilla-central/js/src/vm/Interpreter.cpp:756
#4  0x000055555725852f in js::ConstructFromStack (cx=0x7ffff6f36200, args=..., reason=<optimized out>) at /home/i32g7900a/trees/mozilla-central/js/src/vm/Interpreter.cpp:803
#5  js::Interpret (cx=0x7ffff6f36200, state=...) at /home/i32g7900a/trees/mozilla-central/js/src/vm/Interpreter.cpp:3314
/snip

I'm going to guess that this is related to bug 1921780 again.

Run with --fuzzing-safe --no-threads --no-baseline --no-ion, compile with AR=ar sh ../configure --enable-debug --enable-debug-symbols --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests, tested on m-c rev aef84d293121.

Setting s-s just in case. Jan, did bug 1921780 likely expose the issue?

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1921780

Comment 2

[Jan de Mooij [:jandem]]

A few minor OOM bugs.

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Bug 1930808 - Add some ReportOutOfMemory calls to WasmTagObject::construct. r?rhunt!

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/432337e20786
Add some ReportOutOfMemory calls to WasmTagObject::construct. r=rhunt

Comment 5

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/432337e20786

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:jandem, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox133 to wontfix.

For more information, please visit BugBot documentation.