Assertion failure: !cx->isExceptionPending()

RESOLVED WORKSFORME

Status

()

--
critical
RESOLVED WORKSFORME
6 years ago
4 years ago

People

(Reporter: bc, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
All
Windows XP
assertion, regression, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(URL)

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

6 years ago
1. http://fantasy.thescore.com/thescore/pigskin12/enter_picks
2. Assertion failure: !cx->isExceptionPending(), at c:\work\mozilla\builds\nightly\mozilla\js\src\jscntxtinlines.h:367

Windows XP and Windows 7, Beta, Aurora, Nightly

Thread 0 (crashed)
 0  mozjs.dll!js::CallJSNative(JSContext *,int (*)(JSContext *,unsigned int,JS::Value *),JS::CallArgs const &) [jscntxtinlines.h : 367 + 0x2e]
    eip = 0x69bdd847   esp = 0x0022c1dc   ebp = 0x0022c1e8   ebx = 0x00000001
    esi = 0x04a4a040   edi = 0xffffff87   eax = 0x00000000   ecx = 0x7092537e
    edx = 0x6da5f4d8   efl = 0x00000202
    Found by: given as instruction pointer in context
 1  mozjs.dll!js::InvokeKernel(JSContext *,JS::CallArgs,js::MaybeConstruct) [jsinterp.cpp : 367 + 0x1c]
    eip = 0x69bdd4a1   esp = 0x0022c1f0   ebp = 0x0022c254
    Found by: call frame info
 2  mozjs.dll!js::Invoke(JSContext *,js::InvokeArgsGuard &,js::MaybeConstruct) [jsinterp.h : 109 + 0x36]
    eip = 0x69b08485   esp = 0x0022c25c   ebp = 0x0022c280
    Found by: call frame info
 3  mozjs.dll!js_fun_apply(JSContext *,unsigned int,JS::Value *) [jsfun.cpp : 968 + 0xe]
    eip = 0x69b7c56e   esp = 0x0022c288   ebp = 0x0022c4a0
    Found by: call frame info
 4  mozjs.dll!js::CallJSNative(JSContext *,int (*)(JSContext *,unsigned int,JS::Value *),JS::CallArgs const &) [jscntxtinlines.h : 364 + 0x18]
    eip = 0x69bdd7ed   esp = 0x0022c4a8   ebp = 0x0022c4c0
    Found by: call frame info
 5  mozjs.dll!js::InvokeKernel(JSContext *,JS::CallArgs,js::MaybeConstruct) [jsinterp.cpp : 367 + 0x1c]
    eip = 0x69bdd4a1   esp = 0x0022c4c8   ebp = 0x0022c52c
    Found by: call frame info

Found regression between 20120929232118-20120930213017
Pushlog: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a680fd777c3b&tochange=beee809b7ade
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012/09/2012-09-30-mozilla-central-debug/firefox-18.0a1.en-US.debug-win32.installer.exe
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012/10/2012-10-01-mozilla-central-debug/firefox-18.0a1.en-US.debug-win32.installer.exe

Found regression between 20120929031017-20120930132520
Pushlog: http://hg.mozilla.org/releases/mozilla-aurora/pushloghtml?fromchange=be487bceb80a&tochange=8061df55a71d
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012/09/2012-09-30-mozilla-aurora-debug/firefox-17.0a2.en-US.debug-win32.installer.exe
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012/10/2012-10-01-mozilla-aurora-debug/firefox-17.0a2.en-US.debug-win32.installer.exe

Found regression between 20120928202819-20121001165617
Pushlog: http://hg.mozilla.org/releases/mozilla-beta/pushloghtml?fromchange=bf691ea80fa4&tochange=8a8a932fbef4
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012/09/2012-09-29-mozilla-beta-debug/firefox-16.0.en-US.debug-win32.installer.exe
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012/10/2012-10-02-mozilla-beta-debug/firefox-16.0.en-US.debug-win32.installer.exe

Bug 793370 appears to be the common checkin so maybe this isn't js-engine at all. Does that make any sense?

local test case doesn't reproduce. get it while you can.
also bughunter found another site http://webglsamples.googlecode.com/hg/collectibles/index.html causing the same assertion and 

Thread 0 (crashed)
 0  XUL!js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) [jscntxtinlines.h : 222 + 0x0]
    rbx = 0x0000000000000003   r12 = 0x0000000100193d04
    r13 = 0x0000000000000001   r14 = 0x00007fff5fbf70a0
    r15 = 0x0000000100202401   rip = 0x00000001060fdd3d
    rsp = 0x00007fff5fbf0700   rbp = 0x00007fff5fbf0760
    Found by: given as instruction pointer in context
 1  XUL + 0x2a9f98f
    rip = 0x00000001047fc990   rsp = 0x00007fff5fbf0720
    rbp = 0x00007fff5fbf0760
    Found by: stack scanning
 2  XUL + 0x2a9f98f
    rip = 0x00000001047fc990   rsp = 0x00007fff5fbf0750
    rbp = 0x00007fff5fbf0760
    Found by: stack scanning
 3  XUL!js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) [Interpreter.cpp : 489 + 0x28]
    rip = 0x00000001060f1476   rsp = 0x00007fff5fbf0770
    rbp = 0x00007fff5fbf0bf0
    Found by: stack scanning
 4  XUL!js::AutoEnterPolicy::~AutoEnterPolicy() [jsproxy.h : 406 + 0x4]
    rip = 0x0000000103acca75   rsp = 0x00007fff5fbf07c0
Created attachment 8333795 [details]
reduced testcase (at least was lithium was able to) that crashes locally

was able to create a local testcase from the google page

Updated

5 years ago
Keywords: testcase
Created attachment 8333801 [details]
better testcase without the lithium bit
Attachment #8333795 - Attachment is obsolete: true
(Assignee)

Updated

4 years ago
Assignee: general → nobody
(Reporter)

Comment 4

4 years ago
Retested with OSX 10.{6,8,9}, RHEL6 {32,64}bit, Windows 7 {32,64}bit, Beta/38, Aurora/39, Nightly/40 and no crash. -> WFM.
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.