1966657 - Assertion failure: !JS_IsExceptionPending(cx_), at vm/JSContext.h:1112 and various other similar asserts

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20250515-907a3d528f5e (debug build, run with --fuzzing-safe --ion-offthread-compile=off):

evalInWorker(`
  a = {
    then() {
      b
    }
  }
  Promise.any([a])
  c
`)

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x0000555557268afa in js::LookupNameNoGC(JSContext*, js::PropertyName*, JSObject*, js::NativeObject**, js::PropertyResult*) ()
#1  0x000055555706dbd6 in bool js::GetEnvironmentName<(js::GetNameMode)0>(JSContext*, JS::Handle<JSObject*>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) ()
#2  0x0000555557053771 in js::Interpret(JSContext*, js::RunState&) ()
#3  0x000055555703f112 in js::RunScript(JSContext*, js::RunState&) ()
#4  0x000055555703fbe6 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) ()
#5  0x000055555704115c in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) ()
#6  0x0000555557341ab1 in PromiseResolveThenableJob(JSContext*, unsigned int, JS::Value*) ()
#7  0x00005555570404b5 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) ()
#8  0x000055555703fbc0 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) ()
#9  0x000055555704115c in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) ()
#10 0x000055555716c70c in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) ()
#11 0x000055555723fac5 in js::InternalJobQueue::runJobs(JSContext*) ()
#12 0x000055555723f334 in js::RunJobs(JSContext*) ()
#13 0x0000555556eea748 in RunShellJobs(JSContext*) ()
#14 0x0000555556f142f5 in WorkerMain(mozilla::UniquePtr<WorkerInput, JS::DeletePolicy<WorkerInput> >) ()
#15 0x0000555556f1489a in js::detail::ThreadTrampoline<void (&)(mozilla::UniquePtr<WorkerInput, JS::DeletePolicy<WorkerInput> >), mozilla::UniquePtr<WorkerInput, JS::DeletePolicy<WorkerInput> > >::Start(void*) ()
#16 0x0000555556f6cedd in set_alt_signal_stack_and_start(PthreadCreateParams*) ()
#17 0x00007ffff7bfa609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#18 0x00007ffff7b1f353 in clone () from /lib/x86_64-linux-gnu/libc.so.6
rax	0x0	0
rbx	0x7ffff463e800	140737293576192
rcx	0x458	1112
rdx	0x1	1
rsi	0x0	0
rdi	0x7ffff7bee7d0	140737349871568
rbp	0x7ffff4fa4d90	140737303432592
rsp	0x7ffff4fa4d10	140737303432464
r8	0x0	0
r9	0x3	3
r10	0x0	0
r11	0x0	0
r12	0x7ffff4fa4da8	140737303432616
r13	0x7ffff463e800	140737293576192
r14	0x21994b808040	36942280425536
r15	0x27ba2c404c80	43680559811712
rip	0x555557268afa <js::LookupNameNoGC(JSContext*, js::PropertyName*, JSObject*, js::NativeObject**, js::PropertyResult*)+1850>
=> 0x555557268afa <_ZN2js14LookupNameNoGCEP9JSContextPNS_12PropertyNameEP8JSObjectPPNS_12NativeObjectEPNS_14PropertyResultE+1850>:	mov    %rcx,(%rax)
   0x555557268afd <_ZN2js14LookupNameNoGCEP9JSContextPNS_12PropertyNameEP8JSObjectPPNS_12NativeObjectEPNS_14PropertyResultE+1853>:	callq  0x555556f59c10 <abort>

I am seeing a massive amount of these asserts, in all sorts of places, all with "isExceptionPending" in some way. Marking as fuzzblocker.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20250515084440-907a3d528f5e.
The bug appears to have been introduced in the following build range:

Start: c542d5f7eb5f9679132aca26973e1c44b9df9fca (20250513094746)
End: 51eb71b80c66cb6ed436ad34b425fb4dfd4339cf (20250513100724)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=c542d5f7eb5f9679132aca26973e1c44b9df9fca&tochange=51eb71b80c66cb6ed436ad34b425fb4dfd4339cf

Comment 4

[Iain Ireland [:iain]]

I'm going to guess that it was probably this patch.

Comment 5

[André Bargull [:anba]]

Or part 14 when RunShellJobs was added after JS_ExecuteScript in WorkerMain, even when JS_ExecuteScript returned false.

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

:yulia, since you are the author of the regressor, bug 1467846, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 7

[Iain Ireland [:iain]]

Attachment: WIP: Bug 1966657: Don't run shell jobs in WorkerMain unless ExecuteScript succeeded

Comment 8

[Yulia Startsev [:yulia] OOO until July 2026]

Attachment: Bug 1966657: Only run shell jobs if JS_ExecuteScript returns true; r=iain

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0cf73230aa69
Only run shell jobs if JS_ExecuteScript returns true; r=iain

Comment 10

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/0cf73230aa69

Comment 11

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20250522154927-814af0869083.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.