1932934 - Assertion failure: cx->isExceptionPending() || cx->isPropagatingForcedReturn() || cx->hadUncatchableException(), at vm/Interpreter.cpp:440

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug stack

oomTest(function () {
  parseModule("{}", "", "json");
});

(gdb) bt
#0  AssertExceptionResult (cx=cx@entry=0x7ffff6f36200) at /home/i32g7900a/trees/mozilla-central/js/src/vm/Interpreter.cpp:439
#1  0x0000555557287eef in CallJSNative (cx=cx@entry=0x7ffff6f36200, native=<optimized out>, reason=reason@entry=js::CallReason::Call, args=...) at /home/i32g7900a/trees/mozilla-central/js/src/vm/Interpreter.cpp:537
#2  0x000055555725e4a2 in js::InternalCallOrConstruct (cx=0x7ffff6f36200, args=..., construct=construct@entry=js::NO_CONSTRUCT, reason=js::CallReason::Call) at /home/i32g7900a/trees/mozilla-central/js/src/vm/Interpreter.cpp:628
#3  0x000055555725f1d8 in InternalCall (cx=<optimized out>, args=..., reason=1490636128) at /home/i32g7900a/trees/mozilla-central/js/src/vm/Interpreter.cpp:695
#4  0x000055555726fdbc in js::CallFromStack (cx=0x7ffff7a1ca60 <_IO_stdfile_2_lock>, args=..., reason=<optimized out>) at /home/i32g7900a/trees/mozilla-central/js/src/vm/Interpreter.cpp:700
#5  js::Interpret (cx=0x7ffff6f36200, state=...) at /home/i32g7900a/trees/mozilla-central/js/src/vm/Interpreter.cpp:3329
/snip

I'm going to guess that this is related to bug 1921780 again.

Run with --fuzzing-safe --no-threads --no-baseline --no-ion, compile with AR=ar sh ../configure --enable-debug --enable-debug-symbols --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests, tested on m-c rev d50cbcf0ded7.

Setting s-s just in case. Jan, did bug 1921780 likely expose the issue?

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1921780

Comment 2

[Jan de Mooij [:jandem]]

Various OOM bugs in the new JSON modules code.

(Results in either a nullptr dereference or it incorrectly throws an uncatchable exception that terminates execution. The latter is now caught by the assertions added in bug 1921780.)

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Bug 1932934 - Fix some OOM bugs in the JSON modules code. r?jonco!

Drive-by change to use RootedVector<Value> for a stack-allocated vector because
it has some inline space and we append just one item.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e58c116fb1ab
Fix some OOM bugs in the JSON modules code. r=jonco

Comment 5

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/e58c116fb1ab