812747 - "Assertion failure: !cx->isExceptionPending()" with Proxy

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: testcase (asserts fatally when loaded)

Assertion failure: !cx->isExceptionPending(), at js/src/jsinterp.cpp:3804

I'm guessing this is a JavaScript Engine bug (despite DOM stuff in the testcase) because the stack is js/src/ from #17 up.

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Yeah, IsDuckTypedErrorObject didn't realize that HasProperty can call back into JS now.

Comment 3

[Masatoshi Kimura [:emk]]

Why HasProperty asserts while GetProperty doesn't?

Comment 4

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Because the proxy in the test case only has a 'has' trap that throws.

Comment 5

[Masatoshi Kimura [:emk]]

Attachment: testcase without Proxy

'has' trap is not a essence.
Even Proxy is not essential because this testcase crashes at js_ReportUncaughtException.

Comment 6

[Alex Keybl [:akeybl]]

What user impact does this bug have? Was this testcase reduced from a popular website? Or do we expect it to affect websites?

Comment 7

[Masatoshi Kimura [:emk]]

Cannot reproduce on release builds because this is an assertion failure.

Comment 8

[Jesse Ruderman]

This testcase was reduced from something the fuzzer dreamed up.

Comment 9

[Boris Zbarsky [:bzbarsky]]

In release builds the failure would manifest by random calls from JS silently terminating the JS execution without actually throwing an exception the web page can catch.

Comment 10

[Masatoshi Kimura [:emk]]

I thought js_ReportUncaughtException will be called only when the web page didn't catch the exception. Is it wrong?

Comment 11

[Jesse Ruderman]

"random" in what way?

Comment 12

[Boris Zbarsky [:bzbarsky]]

"random" in the sense that it's impossible for the page author to predict which call will fail.  Basically, the first one after someone doesn't report (via returning false) a pending exception...

> I thought js_ReportUncaughtException will be called only when the web page didn't catch
> the exception. Is it wrong?

That's probably right; the problems start when an exception is pending but never thrown because a false return is swallowed.

Comment 13

[Masatoshi Kimura [:emk]]

(In reply to Boris Zbarsky (:bz) from comment #12)
> > I thought js_ReportUncaughtException will be called only when the web page didn't catch
> > the exception. Is it wrong?
> 
> That's probably right; the problems start when an exception is pending but
> never thrown because a false return is swallowed.
Even if the exception is thrown, it will not be visible from the Web page anyway. So I think this bug will not affect websites. Could you write a Web-visible STR?

Comment 14

[Boris Zbarsky [:bzbarsky]]

I haven't looked into the code carefully enough.  Does it currently guarantee that if it set an exception on the JSContext it will return false?  If not, then it's definitely web-visible.

Comment 15

[Alex Keybl [:akeybl]]

Not enough known user impact to warrant tracking for release. We'd accept a low-risk uplift, however.

Comment 16

[Jesse Ruderman]

WFM on mozilla-central