987622 - Assertion failure: !cx->isExceptionPending(), at jscntxtinlines.h:242 with shell-only function getpda

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 5c0673441fc8 (run with --fuzzing-safe):


function f([x]) {}
getpda(DataView.prototype)

Comment 1

[Christian Holler (:decoder)]

This is probably shell-only (getpda), but the signature and assertion is quite generic, so it would be nice to get this fixed quickly to reduce the amount of assertions like that popping up. It's also very easy to trigger.

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unknown exception (check manually)

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 4

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
Due to skipped revisions, the first bad revision could be any of:
changeset:   https://hg.mozilla.org/mozilla-central/rev/9defe3666015
parent:      160860:f542c81e7e31
user:        Ehsan Akhgari
date:        Tue Dec 17 13:26:45 2013 -0500
summary:     Bug 951207 - Rename the chromium LOG macro to CHROMIUM_LOG; r=bent

changeset:   https://hg.mozilla.org/mozilla-central/rev/767fa5332415
user:        Jeff Muizelaar
date:        Tue Dec 17 13:33:34 2013 -0500
summary:     Bug 951216. Avoid unnecessary Snapshot() copies by clearing the pattern. r=Bas

changeset:   https://hg.mozilla.org/mozilla-central/rev/ecc8eaeac93a
user:        Nicholas Hurley
date:        Tue Dec 17 10:45:46 2013 -0800
summary:     Bug 948757 - Don't flood servers with bunches of speculative connections. r=mcmanus

changeset:   https://hg.mozilla.org/mozilla-central/rev/940b2974f35b
user:        Gregory Szorc
date:        Fri Dec 13 00:47:02 2013 +0900
summary:     Bug 774572 - Part 1: Support for defining JAR manifests in moz.build; r=glandium

changeset:   https://hg.mozilla.org/mozilla-central/rev/9872d86dfa0c
user:        Gregory Szorc
date:        Tue Dec 10 16:18:11 2013 +0900
summary:     Bug 774572 - Part 2: Define JAR_MANIFESTS in moz.build files; r=glandium

changeset:   https://hg.mozilla.org/mozilla-central/rev/81820a46dee2
user:        Ehsan Akhgari
date:        Tue Dec 17 14:43:29 2013 -0500
summary:     Bug 950840 - Rename some logging macros in content/media/wmf; r=cpearce

changeset:   https://hg.mozilla.org/mozilla-central/rev/7da640f24355
user:        Malini Das
date:        Tue Dec 17 14:51:59 2013 -0500
summary:     Bug 951153 - fix unclear error message if manifest has a non-existent file, r=jgriffin

changeset:   https://hg.mozilla.org/mozilla-central/rev/8500bb462515
user:        Eric Faust
date:        Tue Dec 17 12:38:52 2013 -0800
summary:     Bug 950568 - Fix missing null check in EffectlesslyLookupProperty. (r=djvj)

changeset:   https://hg.mozilla.org/mozilla-central/rev/caf902c15026
user:        Terrence Cole
date:        Tue Dec 17 13:01:05 2013 -0800
summary:     Bug 951282 - Wrap the pending exception lazily; r=luke

changeset:   https://hg.mozilla.org/mozilla-central/rev/fbeed56db621
user:        Bill McCloskey
date:        Sat Nov 23 21:32:27 2013 -0800
summary:     Bug 682048 - Change Firefox frame script handling to support anon/global scope (r=felipe)

changeset:   https://hg.mozilla.org/mozilla-central/rev/4a15ec074e47
user:        Bill McCloskey
date:        Sat Nov 23 21:32:32 2013 -0800
summary:     Bug 682048 - Change Metro frame script handling to support anon/global scope (r=jimm,mbrubeck)

changeset:   https://hg.mozilla.org/mozilla-central/rev/ff4cb698555c
user:        Bill McCloskey
date:        Sat Nov 23 21:32:39 2013 -0800
summary:     Bug 682048 - Change B2G frame script handling to support anon/global scope (r=fabrice)

changeset:   https://hg.mozilla.org/mozilla-central/rev/e42976d8d656
user:        Bill McCloskey
date:        Sat Nov 23 21:32:45 2013 -0800
summary:     Bug 673569 - Let each frame script have its own anonymous scope (r=smaug,Waldo,mrbkap,bsmedberg)

changeset:   https://hg.mozilla.org/mozilla-central/rev/6de31ee204e6
parent:      160932:e42976d8d656
parent:      160899:eabe3f50b083
user:        Ryan VanderMeulen
date:        Tue Dec 17 16:20:31 2013 -0500
summary:     Merge m-c to inbound.

This iteration took 205.778 seconds to run.

Comment 5

[Christian Holler (:decoder)]

I'd guess it's bug 951282, terrence?

Comment 6

[Terrence Cole [:terrence]]

You are correct. This code is only called from jsd1, so instead of adding yet more complexity to the handling of the pending exception, we should just rip out jsd1.

Do you have the cycles to land that, Jim?

Comment 7

[Jim Blandy :jimb]

JSD is now deleted. So whatever it is that you want to delete, you can delete it now. See also bug 1031881, waiting for a review from sfink.

Comment 8

[Terrence Cole [:terrence]]

Attachment: remove_getpda-v0.diff

Trivial.

Looks like the underlying infrastructure is still, sadly, held live by something in XPConnect.

Comment 9

[Terrence Cole [:terrence]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4860e6f61363

Comment 10

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/4860e6f61363