[Webkit-unassigned] [Bug 187807] New: Regression (r233924) Unchecked JS exception: stress/json-stringify-getter-call.js

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Thu Jul 19 09:22:13 PDT 2018


https://bugs.webkit.org/show_bug.cgi?id=187807

            Bug ID: 187807
           Summary: Regression (r233924) Unchecked JS exception:
                    stress/json-stringify-getter-call.js
           Product: WebKit
           Version: Other
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Tools / Tests
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: David_fenton at apple.com
                CC: lforschler at apple.com

The following regression was introduced in https://trac.webkit.org/changeset/233924/webkit

sample error output: 
https://build.webkit.org/builders/Apple%20High%20Sierra%20Debug%20JSC%20%28Tests%29/builds/1281/steps/jscore-test/logs/stdio

stress/json-stringify-getter-call.js.default: ERROR: Unchecked JS exception:
stress/json-stringify-getter-call.js.default:     This scope can throw a JS exception: getPropertySlot @ /Volumes/Data/slave/highsierra-debug/build/Source/JavaScriptCore/runtime/JSObjectInlines.h:111
stress/json-stringify-getter-call.js.default:         (ExceptionScope::m_recursionDepth was 8)
stress/json-stringify-getter-call.js.default:     But the exception was unchecked as of this scope: callGetter @ ./runtime/GetterSetter.cpp:51
stress/json-stringify-getter-call.js.default:         (ExceptionScope::m_recursionDepth was 8)
stress/json-stringify-getter-call.js.default: 
stress/json-stringify-getter-call.js.default: Unchecked exception detected at:
stress/json-stringify-getter-call.js.default:     1   0x10b3b2b43 JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation&)
stress/json-stringify-getter-call.js.default:     2   0x10b38c409 JSC::ThrowScope::ThrowScope(JSC::VM&, JSC::ExceptionEventLocation)
stress/json-stringify-getter-call.js.default:     3   0x10b38c44a JSC::ThrowScope::ThrowScope(JSC::VM&, JSC::ExceptionEventLocation)
stress/json-stringify-getter-call.js.default:     4   0x10b16d8a8 JSC::callGetter(JSC::ExecState*, JSC::JSValue, JSC::JSValue)
stress/json-stringify-getter-call.js.default:     5   0x10b2ff4ae JSC::PropertySlot::functionGetter(JSC::ExecState*) const
stress/json-stringify-getter-call.js.default:     6   0x10a0c5e6c JSC::PropertySlot::getValue(JSC::ExecState*, unsigned int) const
stress/json-stringify-getter-call.js.default:     7   0x10b245369 JSC::Stringifier::Holder::appendNextProperty(JSC::Stringifier&, WTF::StringBuilder&)
stress/json-stringify-getter-call.js.default:     8   0x10b24450c JSC::Stringifier::appendStringifiedValue(WTF::StringBuilder&, JSC::JSValue, JSC::Stringifier::Holder const&, JSC::PropertyNameForFunctionCall const&)
stress/json-stringify-getter-call.js.default:     9   0x10b2439c9 JSC::Stringifier::stringify(JSC::JSValue)
stress/json-stringify-getter-call.js.default:     10  0x10b248705 JSC::JSONProtoFuncStringify(JSC::ExecState*)
stress/json-stringify-getter-call.js.default:     11  0x2d941655177
stress/json-stringify-getter-call.js.default:     12  0x10a01f1a6 llint_entry
stress/json-stringify-getter-call.js.default:     13  0x10a016b92 vmEntryToJavaScript
stress/json-stringify-getter-call.js.default:     14  0x10ae749fa JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
stress/json-stringify-getter-call.js.default:     15  0x10ae73fa1 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*)
stress/json-stringify-getter-call.js.default:     16  0x10b12d8d7 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
stress/json-stringify-getter-call.js.default:     17  0x105b93d00 runWithOptions(GlobalObject*, CommandLine&, bool&)
stress/json-stringify-getter-call.js.default:     18  0x105b6b5dc jscmain(int, char**)::$_3::operator()(JSC::VM&, GlobalObject*, bool&) const
stress/json-stringify-getter-call.js.default:     19  0x105b52d84 int runJSC<jscmain(int, char**)::$_3>(CommandLine, bool, jscmain(int, char**)::$_3 const&)
stress/json-stringify-getter-call.js.default:     20  0x105b5186f jscmain(int, char**)
stress/json-stringify-getter-call.js.default:     21  0x105b517ce main
stress/json-stringify-getter-call.js.default:     22  0x7fff6e830015 start
stress/json-stringify-getter-call.js.default: 
stress/json-stringify-getter-call.js.default: ASSERTION FAILED: !m_needExceptionCheck
stress/json-stringify-getter-call.js.default: ./runtime/VM.cpp(1186) : void JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation &)
stress/json-stringify-getter-call.js.default: 1   0x109f2b5e9 WTFCrash
stress/json-stringify-getter-call.js.default: 2   0x10b3b2c99 JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation&)
stress/json-stringify-getter-call.js.default: 3   0x10b38c409 JSC::ThrowScope::ThrowScope(JSC::VM&, JSC::ExceptionEventLocation)
stress/json-stringify-getter-call.js.default: 4   0x10b38c44a JSC::ThrowScope::ThrowScope(JSC::VM&, JSC::ExceptionEventLocation)
stress/json-stringify-getter-call.js.default: 5   0x10b16d8a8 JSC::callGetter(JSC::ExecState*, JSC::JSValue, JSC::JSValue)
stress/json-stringify-getter-call.js.default: 6   0x10b2ff4ae JSC::PropertySlot::functionGetter(JSC::ExecState*) const
stress/json-stringify-getter-call.js.default: 7   0x10a0c5e6c JSC::PropertySlot::getValue(JSC::ExecState*, unsigned int) const
stress/json-stringify-getter-call.js.default: 8   0x10b245369 JSC::Stringifier::Holder::appendNextProperty(JSC::Stringifier&, WTF::StringBuilder&)
stress/json-stringify-getter-call.js.default: 9   0x10b24450c JSC::Stringifier::appendStringifiedValue(WTF::StringBuilder&, JSC::JSValue, JSC::Stringifier::Holder const&, JSC::PropertyNameForFunctionCall const&)
stress/json-stringify-getter-call.js.default: 10  0x10b2439c9 JSC::Stringifier::stringify(JSC::JSValue)
stress/json-stringify-getter-call.js.default: 11  0x10b248705 JSC::JSONProtoFuncStringify(JSC::ExecState*)
stress/json-stringify-getter-call.js.default: 12  0x2d941655177
stress/json-stringify-getter-call.js.default: 13  0x10a01f1a6 llint_entry
stress/json-stringify-getter-call.js.default: 14  0x10a016b92 vmEntryToJavaScript
stress/json-stringify-getter-call.js.default: 15  0x10ae749fa JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
stress/json-stringify-getter-call.js.default: 16  0x10ae73fa1 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*)
stress/json-stringify-getter-call.js.default: 17  0x10b12d8d7 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
stress/json-stringify-getter-call.js.default: 18  0x105b93d00 runWithOptions(GlobalObject*, CommandLine&, bool&)
stress/json-stringify-getter-call.js.default: 19  0x105b6b5dc jscmain(int, char**)::$_3::operator()(JSC::VM&, GlobalObject*, bool&) const
stress/json-stringify-getter-call.js.default: 20  0x105b52d84 int runJSC<jscmain(int, char**)::$_3>(CommandLine, bool, jscmain(int, char**)::$_3 const&)
stress/json-stringify-getter-call.js.default: 21  0x105b5186f jscmain(int, char**)
stress/json-stringify-getter-call.js.default: 22  0x105b517ce main
stress/json-stringify-getter-call.js.default: 23  0x7fff6e830015 start
stress/json-stringify-getter-call.js.default: test_script_15648: line 2: 31076 Segmentation fault: 11  ( "$@" ../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --useFunctionDotArguments\=true --validateExceptionChecks\=true --useDollarVM\=true --maxPerThreadStackUsage\=1572864 --useFTLJIT\=true json-stringify-getter-call.js )
stress/json-stringify-getter-call.js.no-llint: ERROR: Unchecked JS exception:
stress/json-stringify-getter-call.js.no-llint:     This scope can throw a JS exception: getPropertySlot @ /Volumes/Data/slave/highsierra-debug/build/Source/JavaScriptCore/runtime/JSObjectInlines.h:111
stress/json-stringify-getter-call.js.no-llint:         (ExceptionScope::m_recursionDepth was 8)
stress/json-stringify-getter-call.js.no-llint:     But the exception was unchecked as of this scope: callGetter @ ./runtime/GetterSetter.cpp:51
stress/json-stringify-getter-call.js.no-llint:         (ExceptionScope::m_recursionDepth was 8)
stress/json-stringify-getter-call.js.no-llint: 
stress/json-stringify-getter-call.js.no-llint: Unchecked exception detected at:
stress/json-stringify-getter-call.js.no-llint:     1   0x11013db43 JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation&)
stress/json-stringify-getter-call.js.no-llint:     2   0x110117409 JSC::ThrowScope::ThrowScope(JSC::VM&, JSC::ExceptionEventLocation)
stress/json-stringify-getter-call.js.no-llint:     3   0x11011744a JSC::ThrowScope::ThrowScope(JSC::VM&, JSC::ExceptionEventLocation)
stress/json-stringify-getter-call.js.no-llint:     4   0x10fef88a8 JSC::callGetter(JSC::ExecState*, JSC::JSValue, JSC::JSValue)
stress/json-stringify-getter-call.js.no-llint:     5   0x11008a4ae JSC::PropertySlot::functionGetter(JSC::ExecState*) const
stress/json-stringify-getter-call.js.no-llint:     6   0x10ee50e6c JSC::PropertySlot::getValue(JSC::ExecState*, unsigned int) const
stress/json-stringify-getter-call.js.no-llint:     7   0x10ffd0369 JSC::Stringifier::Holder::appendNextProperty(JSC::Stringifier&, WTF::StringBuilder&)
stress/json-stringify-getter-call.js.no-llint:     8   0x10ffcf50c JSC::Stringifier::appendStringifiedValue(WTF::StringBuilder&, JSC::JSValue, JSC::Stringifier::Holder const&, JSC::PropertyNameForFunctionCall const&)
stress/json-stringify-getter-call.js.no-llint:     9   0x10ffce9c9 JSC::Stringifier::stringify(JSC::JSValue)
stress/json-stringify-getter-call.js.no-llint:     10  0x10ffd3705 JSC::JSONProtoFuncStringify(JSC::ExecState*)
stress/json-stringify-getter-call.js.no-llint:     11  0x19f2b2ef177
stress/json-stringify-getter-call.js.no-llint:     12  0x19f2b2f1cf9
stress/json-stringify-getter-call.js.no-llint:     13  0x10eda1b92 vmEntryToJavaScript
stress/json-stringify-getter-call.js.no-llint:     14  0x10fbff9fa JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
stress/json-stringify-getter-call.js.no-llint:     15  0x10fbfefa1 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*)
stress/json-stringify-getter-call.js.no-llint:     16  0x10feb88d7 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
stress/json-stringify-getter-call.js.no-llint:     17  0x10ebf2d00 runWithOptions(GlobalObject*, CommandLine&, bool&)
stress/json-stringify-getter-call.js.no-llint:     18  0x10ebca5dc jscmain(int, char**)::$_3::operator()(JSC::VM&, GlobalObject*, bool&) const
stress/json-stringify-getter-call.js.no-llint:     19  0x10ebb1d84 int runJSC<jscmain(int, char**)::$_3>(CommandLine, bool, jscmain(int, char**)::$_3 const&)
stress/json-stringify-getter-call.js.no-llint:     20  0x10ebb086f jscmain(int, char**)
stress/json-stringify-getter-call.js.no-llint:     21  0x10ebb07ce main
stress/json-stringify-getter-call.js.no-llint:     22  0x7fff6e830015 start
stress/json-stringify-getter-call.js.no-llint: 
stress/json-stringify-getter-call.js.no-llint: ASSERTION FAILED: !m_needExceptionCheck
stress/json-stringify-getter-call.js.no-llint: ./runtime/VM.cpp(1186) : void JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation &)
stress/json-stringify-getter-call.js.no-llint: 1   0x10ecb65e9 WTFCrash
stress/json-stringify-getter-call.js.no-llint: 2   0x11013dc99 JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation&)
stress/json-stringify-getter-call.js.no-llint: 3   0x110117409 JSC::ThrowScope::ThrowScope(JSC::VM&, JSC::ExceptionEventLocation)
stress/json-stringify-getter-call.js.no-llint: 4   0x11011744a JSC::ThrowScope::ThrowScope(JSC::VM&, JSC::ExceptionEventLocation)
stress/json-stringify-getter-call.js.no-llint: 5   0x10fef88a8 JSC::callGetter(JSC::ExecState*, JSC::JSValue, JSC::JSValue)
stress/json-stringify-getter-call.js.no-llint: 6   0x11008a4ae JSC::PropertySlot::functionGetter(JSC::ExecState*) const
stress/json-stringify-getter-call.js.no-llint: 7   0x10ee50e6c JSC::PropertySlot::getValue(JSC::ExecState*, unsigned int) const
stress/json-stringify-getter-call.js.no-llint: 8   0x10ffd0369 JSC::Stringifier::Holder::appendNextProperty(JSC::Stringifier&, WTF::StringBuilder&)
stress/json-stringify-getter-call.js.no-llint: 9   0x10ffcf50c JSC::Stringifier::appendStringifiedValue(WTF::StringBuilder&, JSC::JSValue, JSC::Stringifier::Holder const&, JSC::PropertyNameForFunctionCall const&)
stress/json-stringify-getter-call.js.no-llint: 10  0x10ffce9c9 JSC::Stringifier::stringify(JSC::JSValue)
stress/json-stringify-getter-call.js.no-llint: 11  0x10ffd3705 JSC::JSONProtoFuncStringify(JSC::ExecState*)
stress/json-stringify-getter-call.js.no-llint: 12  0x19f2b2ef177
stress/json-stringify-getter-call.js.no-llint: 13  0x19f2b2f1cf9
stress/json-stringify-getter-call.js.no-llint: 14  0x10eda1b92 vmEntryToJavaScript
stress/json-stringify-getter-call.js.no-llint: 15  0x10fbff9fa JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
stress/json-stringify-getter-call.js.no-llint: 16  0x10fbfefa1 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*)
stress/json-stringify-getter-call.js.no-llint: 17  0x10feb88d7 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
stress/json-stringify-getter-call.js.no-llint: 18  0x10ebf2d00 runWithOptions(GlobalObject*, CommandLine&, bool&)
stress/json-stringify-getter-call.js.no-llint: 19  0x10ebca5dc jscmain(int, char**)::$_3::operator()(JSC::VM&, GlobalObject*, bool&) const
stress/json-stringify-getter-call.js.no-llint: 20  0x10ebb1d84 int runJSC<jscmain(int, char**)::$_3>(CommandLine, bool, jscmain(int, char**)::$_3 const&)
stress/json-stringify-getter-call.js.no-llint: 21  0x10ebb086f jscmain(int, char**)
stress/json-stringify-getter-call.js.no-llint: 22  0x10ebb07ce main
stress/json-stringify-getter-call.js.no-llint: 23  0x7fff6e830015 start
stress/json-stringify-getter-call.js.no-llint: test_script_15649: line 2: 31085 Segmentation fault: 11  ( "$@" ../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --useFunctionDotArguments\=true --validateExceptionChecks\=true --useDollarVM\=true --maxPerThreadStackUsage\=1572864 --useLLInt\=false json-stringify-getter-call.js )
stress/json-stringify-getter-call.js.no-cjit-validate-phases: ERROR: Unchecked JS exception:
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     This scope can throw a JS exception: getPropertySlot @ /Volumes/Data/slave/highsierra-debug/build/Source/JavaScriptCore/runtime/JSObjectInlines.h:111
stress/json-stringify-getter-call.js.no-cjit-validate-phases:         (ExceptionScope::m_recursionDepth was 8)
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     But the exception was unchecked as of this scope: callGetter @ ./runtime/GetterSetter.cpp:51
stress/json-stringify-getter-call.js.no-cjit-validate-phases:         (ExceptionScope::m_recursionDepth was 8)
stress/json-stringify-getter-call.js.no-cjit-validate-phases: 
stress/json-stringify-getter-call.js.no-cjit-validate-phases: Unchecked exception detected at:
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     1   0x10f5a8b43 JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation&)
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     2   0x10f582409 JSC::ThrowScope::ThrowScope(JSC::VM&, JSC::ExceptionEventLocation)
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     3   0x10f58244a JSC::ThrowScope::ThrowScope(JSC::VM&, JSC::ExceptionEventLocation)
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     4   0x10f3638a8 JSC::callGetter(JSC::ExecState*, JSC::JSValue, JSC::JSValue)
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     5   0x10f4f54ae JSC::PropertySlot::functionGetter(JSC::ExecState*) const
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     6   0x10e2bbe6c JSC::PropertySlot::getValue(JSC::ExecState*, unsigned int) const
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     7   0x10f43b369 JSC::Stringifier::Holder::appendNextProperty(JSC::Stringifier&, WTF::StringBuilder&)
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     8   0x10f43a50c JSC::Stringifier::appendStringifiedValue(WTF::StringBuilder&, JSC::JSValue, JSC::Stringifier::Holder const&, JSC::PropertyNameForFunctionCall const&)
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     9   0x10f4399c9 JSC::Stringifier::stringify(JSC::JSValue)
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     10  0x10f43e705 JSC::JSONProtoFuncStringify(JSC::ExecState*)
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     11  0x3e4fe300177
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     12  0x10e2151a6 llint_entry
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     13  0x10e20cb92 vmEntryToJavaScript
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     14  0x10f06a9fa JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     15  0x10f069fa1 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*)
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     16  0x10f3238d7 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     17  0x10e05fd00 runWithOptions(GlobalObject*, CommandLine&, bool&)
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     18  0x10e0375dc jscmain(int, char**)::$_3::operator()(JSC::VM&, GlobalObject*, bool&) const
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     19  0x10e01ed84 int runJSC<jscmain(int, char**)::$_3>(CommandLine, bool, jscmain(int, char**)::$_3 const&)
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     20  0x10e01d86f jscmain(int, char**)
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     21  0x10e01d7ce main
stress/json-stringify-getter-call.js.no-cjit-validate-phases:     22  0x7fff6e830015 start

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180719/bfe9b574/attachment-0001.html>


More information about the webkit-unassigned mailing list