909447 - Assertion failure: !JS_IsExceptionPending(cx), at shell/js.cpp

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function f(code) {
    try {
        g = Function(code)
    } catch (e) {}
    g()
}
f("\
    Object.defineProperty(this,\"x\",{\
        get: function(){\
            evaluate(\"Array(x)\",{\
                newContext:true,\
                catchTermination:(function(){})\
            })\
        }\
    })\
");
f("x");
f(")");
f("x");

asserts js debug threadsafe shell on m-c changeset 69d61f4ce0a9 with --baseline-eager --ion-parallel-compile=on at Assertion failure: !JS_IsExceptionPending(cx), at shell/js.cpp

Tested on https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64-debug/1377436285/jsshell-mac64.zip

This seems no longer reproducible with http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2013-08-26-mozilla-central-debug/jsshell-mac64.zip

If this is somehow fixed, we should land this testcase.

Comment 1

[Bobby Holley (:bholley)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3300c750cd53

Comment 2

[Ryan VanderMeulen [:RyanVM]]

Backed out.
https://hg.mozilla.org/integration/mozilla-inbound/rev/b2e8b8887816

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Ryan VanderMeulen [:RyanVM UTC-4] from comment #2)
> Backed out.
> https://hg.mozilla.org/integration/mozilla-inbound/rev/b2e8b8887816


(Actually this test never landed, the testcase in bug 909441 got landed in place instead)

Comment 4

[Eric Faust [:efaust]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/46345150fef4

since it's the same test, this also landed with bug 909441.

Comment 5

[Eric Faust [:efaust]]

bug909441, where the test landed, has been RESOLVED FIXED.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Thanks! However, since the patch that supposedly fixes this is unknown, resolving WFM instead.