1941179 - Assertion failure: cx->isExceptionPending() || cx->isPropagatingForcedReturn() || cx->hadUncatchableException(), at vm/Interpreter.cpp:440

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug stack

oomTest(function () {
  new WebAssembly.Instance(
    new WebAssembly.Module(
      wasmTextToBinary(
        '(module (import "m" "f" (func $f) )(func call $f))',
      ),
    ),
    {
      m: { f: function () {} },
    },
  );
});

(gdb) bt
#0  AssertExceptionResult (cx=0x7ffff693a200) at /home/i32g7900a/trees/mozilla-central/js/src/vm/Interpreter.cpp:439
#1  CallJSNative (cx=cx@entry=0x7ffff693a200, native=native@entry=0x5555587f6f20 <js::WasmInstanceObject::construct(JSContext*, unsigned int, JS::Value*)>,
    reason=reason@entry=js::CallReason::Call, args=...) at /home/i32g7900a/trees/mozilla-central/js/src/vm/Interpreter.cpp:537
#2  0x000055555730f94d in CallJSNativeConstructor (cx=cx@entry=0x7ffff693a200,
    native=0x5555587f6f20 <js::WasmInstanceObject::construct(JSContext*, unsigned int, JS::Value*)>, args=...)
    at /home/i32g7900a/trees/mozilla-central/js/src/vm/Interpreter.cpp:550
#3  0x00005555572df820 in InternalConstruct (cx=0x7ffff693a200, args=..., reason=js::CallReason::Call)
    at /home/i32g7900a/trees/mozilla-central/js/src/vm/Interpreter.cpp:756
#4  0x00005555572df20d in js::ConstructFromStack (cx=0x7ffff7a1ca60 <_IO_stdfile_2_lock>, cx@entry=0x7ffff693a200, args=..., reason=4154570531,
    reason@entry=js::CallReason::Call) at /home/i32g7900a/trees/mozilla-central/js/src/vm/Interpreter.cpp:803
#5  0x0000555557f39e06 in js::jit::DoCallFallback (cx=0x7ffff693a200, frame=0x7fffffffc2c8, stub=0x7ffff69d7bb8, argc=2, vp=0x7fffffffc258, res=...)
    at /home/i32g7900a/trees/mozilla-central/js/src/jit/BaselineIC.cpp:1682
#6  0x0000096f2fb55e0f in ?? ()
/snip

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/de8b96102f94
user:        Jan de Mooij
date:        Tue Oct 01 11:02:38 2024 +0000
summary:     Bug 1921780 - Improve exception handling assertions in the JS shell. r=arai

Run with --fuzzing-safe --no-threads --no-baseline --no-ion --cache-ir-stubs=off, compile with AR=ar sh ../configure --enable-debug --enable-debug-symbols --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests, tested on m-c rev abc92a419107.

Setting s-s just in case. Jan, did bug 1921780 likely expose the issue?

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1921780

Comment 2

[Jan de Mooij [:jandem]]

Some missing ReportOutOfMemory calls.

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Bug 1941179 - Add some missing ReportOutOfMemory calls. r?rhunt!

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/46a96e69f5d9
Add some missing ReportOutOfMemory calls. r=rhunt

Comment 5

[pstanciu]

https://hg.mozilla.org/mozilla-central/rev/46a96e69f5d9