950725 - Assertion failure: throwing, at jscntxt.h:584 with GC

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 9e03cd21db08 (threadsafe build, run with --ion-eager):


function test() {
  + T[g].act
}
gc();
for (var i = 0; i < 20; test['$+']) {
  try {
      __count__(f(2), 1);
  } catch (e) {}
}

Comment 1

[Christian Holler (:decoder)]

Marked s-s because it involves GC. Jandem is already investigating this one.

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Patch

Silly bug: js_HandleExecutionInterrupt can end up calling clearPendingException (somewhere deep inside the parser, under AttachFinishedCompilations). The getPendingException call in GetAndClearException then fails.

This patch gets and clears the pending exception before calling js_HandleExecutionInterrupt.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 4

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/323b1482feec

Also has a one-line fix for a VMFunction marking issue exposed by this patch; r=nbp on IRC for that.

Not security sensitive, we could get |undefined| instead of the actual exception value but that's not exploitable.

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/323b1482feec