2007770 - Assertion failure: cx->isExceptionPending(), at jit/Ion.cpp:2010

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug stack

oomTest(function () {
  Object.defineProperty([], 1, { function() {} });
  for (var i of "month") {};
  Object.defineProperty([], "", {});
});

(gdb) bt
#0  0x00005555580ca60e in MOZ_CrashSequence (aAddress=0x0, aLine=2010)
    at /home/msf2/shell-cache/js-dbg-64-linux-x86_64-6a0626aaa09a-601896/objdir-js/dist/include/mozilla/Assertions.h:237
#1  js::jit::Compile (cx=cx@entry=0x7ffff5e38200, script=script@entry=..., osrFrame=osrFrame@entry=0x7fffffffbcc8, osrPc=osrPc@entry=0x0)
    at /home/msf2/trees/firefox/js/src/jit/Ion.cpp:2010
#2  0x00005555580cb17b in BaselineCanEnterAtEntry (cx=0x7ffff5e38200, script=..., frame=0x7fffffffbcc8) at /home/msf2/trees/firefox/js/src/jit/Ion.cpp:2125
#3  IonCompileScriptForBaseline (cx=0x7ffff5e38200, frame=0x7fffffffbcc8, pc=<optimized out>) at /home/msf2/trees/firefox/js/src/jit/Ion.cpp:2234
#4  0x000028e88a565066 in ?? ()
#5  0x00007fffffffbd00 in ?? ()
/snip

23b0c4c44976-601276
23b0c4c449768f62d52310e79f7a977cb3c24364 is the first interesting commit
commit 23b0c4c449768f62d52310e79f7a977cb3c24364
Author: Hannes Verschore
Date:   Thu Dec 18 16:07:13 2025 +0000

    Bug 1999828: Part 1 - Split TryFoldingStubs into two passes. One to detect the shape (and later slot offset) and another to gather the values. r=iain

    Preparation to being able to fold GuardShape followed by {Load|Store}{Fixed|Dynamic}Slot.
    For this we split the detection of stubs with different shapes (and in the future slots) and gathering.
    This patch does this in two passes. One to detect the availability to fold (detect shape and slot change at same offset).
    The second pass is used to make sure all Stub information is the same and saves the different shapes (and slots).
    The other changes are to support the subsequent patches.

    Differential Revision: https://phabricator.services.mozilla.com/D274201

Run with --fuzzing-safe --baseline-warmup-threshold=6 --blinterp-warmup-threshold=1 --ion-warmup-threshold=0 --trial-inlining-warmup-threshold=0, compile with AR=ar sh ~/trees/firefox/js/src/configure --enable-debug --enable-debug-symbols --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests, tested on gh rev 6a0626aaa09a87200258dbf6161fde44722c763e.

Hannes, is bug 1999828 a likely regressor?

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1999828

Comment 2

[Hannes Verschore [:h4writer]]

I am a bit fuzzy about the OOM rules. But looking at where we are failing, I see I added a "cx->recoverFromOutOfMemory();" where there was none previously.

I assume this error is because

1. We fail allocation
2. We run cx->recoverFromOutOfMemory();
3. We still do "return false" indicating a problem
4. Ion expects an exception, but there isn't one.

Upon allocation failures we need to do (IIUC):
cx->recoverFromOutOfMemory();
return true;

or

return false; // no recoverFromOutOfMemory();

Patch should be arriving today.

Comment 3

[Hannes Verschore [:h4writer]]

Attachment: Bug 2007770: Fix oom reporting around stubfolding, r?iain

Comment 4

[Iain Ireland [:iain]]

This isn't security sensitive. There probably isn't a reliable way to trigger OOM here, and even if there was, there's nothing exploitable about accidentally not throwing an exception.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/142f61d2952f
https://hg.mozilla.org/integration/autoland/rev/2562fc8bf4db
Fix oom reporting around stubfolding, r=iain

Comment 6

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/2562fc8bf4db