Closed Bug 884114 Opened 9 years ago Closed 8 years ago

Assertion failure: !JS_IsExceptionPending(cx), at jsiter.cpp or Assertion failure: !cx->isExceptionPending(), at vm/Interpreter.cpp

Categories

(Core :: JavaScript Engine, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update,ignore])

Attachments

(1 file)

Attached file stacks
function w() {
    function v() {
        ({ invalidObjectInitializer });
    };
}
w();
for (var h of []) {}

asserts js debug shell on m-c changeset b7175c5829b5 with --ion-eager at Assertion failure: !JS_IsExceptionPending(cx), at jsiter.cpp

function w() {
    function v() {
        ({ invalidObjectInitializer });
    };
}
w();
try { throw 3 } catch(e) {}

asserts js debug shell on m-c changeset b7175c5829b5 with --ion-eager at Assertion failure: !cx->isExceptionPending(), at vm/Interpreter.cpp

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   135052:ce43d28276e4
user:        Brian Hackett
date:        Fri Jun 14 05:58:28 2013 -0600
summary:     Bug 678037 - Enable lazy JS parsing and fix various bugs, r=waldo,evilpie,nobody.
Flags: needinfo?(bhackett1024)
I'm not really sure if lazy bytecode is indeed the cause of this bug, re-running bisect to be sure.
Whiteboard: [jsbugmon:update] → [jsbugmon:update,bisect]
I just re-ran autoBisect locally and it indeed still points to bug 678037.
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
This is a structural problem with IonBuilder, any exceptions thrown during building will just cause the script to be disabled and will not bubble up properly to callers.
Flags: needinfo?(bhackett1024)
(In reply to Brian Hackett (:bhackett) from comment #3)
> This is a structural problem with IonBuilder, any exceptions thrown during
> building will just cause the script to be disabled and will not bubble up
> properly to callers.

jandem, do you know who might be able to take a look at this?
Flags: needinfo?(jdemooij)
I find it counter-intuitive that lazy bytecode changes the time at which this syntax error is reported.  See also bug 887549.
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision c7e005de1329).
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/34adc60a3e6a
user:        Brian Hackett
date:        Mon Jul 08 07:08:15 2013 -0600
summary:     Bug 887549 - Don't handle destructuring shorthand in syntax parser, r=jandem.

Is bug 887549 likely to have fixed this?
Flags: needinfo?(bhackett1024)
For this case, yes, though the underlying issue is still there.
Flags: needinfo?(bhackett1024)
I moved comment 3 out to bug 892791. Resolving this as FIXED by bug 887549 for now.
Status: NEW → RESOLVED
Closed: 8 years ago
Flags: needinfo?(jdemooij) → in-testsuite?
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.