653033 - "Assertion failure: cx->isExceptionPending()" with proxies, typed arrays, OOM

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: testcase (hangs and then crashes Firefox)

Assertion failure: cx->isExceptionPending(), at js/src/jsscan.cpp:1931

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[David Mandelin [:dmandelin]]

This appears to be an OOM crash. I got a different stack trace from what you got: I got a compartment assert via trying to call JS_GetParent as part of reporting an OOM error:

nsIScriptGlobalObject *
nsJSUtils::GetStaticScriptGlobal(JSContext* aContext, JSObject* aObj)
{
  nsISupports* supports;
  JSClass* clazz;
  JSObject* parent;
  JSObject* glob = aObj; // starting point for search

  if (!glob)
    return nsnull;

  while ((parent = ::JS_GetParent(aContext, glob)))
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                   compartment assert here
    glob = parent;

glob is a BackstagePass, and we get here from running chrome JS. That seems like some kind of good hint, but I don't know what it means.

Comment 3

[Tom S. (please needinfo tschuster)]

WFM on current nightly, also it hangs a little bit. GetStaticScriptGlobal seems to be gone.

Comment 4

[Jesse Ruderman]

Yeah, WFM.  I think it makes sense that the testcase hangs for a bit.