884114 - Assertion failure: !JS_IsExceptionPending(cx), at jsiter.cpp or Assertion failure: !cx->isExceptionPending(), at vm/Interpreter.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stacks

function w() {
    function v() {
        ({ invalidObjectInitializer });
    };
}
w();
for (var h of []) {}

asserts js debug shell on m-c changeset b7175c5829b5 with --ion-eager at Assertion failure: !JS_IsExceptionPending(cx), at jsiter.cpp

function w() {
    function v() {
        ({ invalidObjectInitializer });
    };
}
w();
try { throw 3 } catch(e) {}

asserts js debug shell on m-c changeset b7175c5829b5 with --ion-eager at Assertion failure: !cx->isExceptionPending(), at vm/Interpreter.cpp

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   135052:ce43d28276e4
user:        Brian Hackett
date:        Fri Jun 14 05:58:28 2013 -0600
summary:     Bug 678037 - Enable lazy JS parsing and fix various bugs, r=waldo,evilpie,nobody.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I'm not really sure if lazy bytecode is indeed the cause of this bug, re-running bisect to be sure.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I just re-ran autoBisect locally and it indeed still points to bug 678037.

Comment 3

[Brian Hackett [Laid off!]]

This is a structural problem with IonBuilder, any exceptions thrown during building will just cause the script to be disabled and will not bubble up properly to callers.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Brian Hackett (:bhackett) from comment #3)
> This is a structural problem with IonBuilder, any exceptions thrown during
> building will just cause the script to be disabled and will not bubble up
> properly to callers.

jandem, do you know who might be able to take a look at this?

Comment 5

[Jesse Ruderman]

I find it counter-intuitive that lazy bytecode changes the time at which this syntax error is reported.  See also bug 887549.

Comment 6

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision c7e005de1329).

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/34adc60a3e6a
user:        Brian Hackett
date:        Mon Jul 08 07:08:15 2013 -0600
summary:     Bug 887549 - Don't handle destructuring shorthand in syntax parser, r=jandem.

Is bug 887549 likely to have fixed this?

Comment 8

[Brian Hackett [Laid off!]]

For this case, yes, though the underlying issue is still there.

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I moved comment 3 out to bug 892791. Resolving this as FIXED by bug 887549 for now.