208766 2020-03-07 10:16:46 -0800 REGRESSION (r258049): Unchecked JS exception in jsc::Stringifier::toJSON 2020-03-07 14:54:15 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build All All RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=208725 InRadar P2 Trivial --- 1 ryanhaddad ashvayka ashvayka commit-queue ews-watchlist keith_miller mark.lam msaboff ross.kirsling saam tzagallo webkit-bot-watchers-bugzilla webkit-bug-importer ysuzuki oldest_to_newest 1627235 0 ryanhaddad 2020-03-07 10:16:46 -0800 After https://trac.webkit.org/changeset/258049/webkit, the debug JSC bit has 44 test failures due to an unchecked JS exception: microbenchmarks/json-stringify-many-objects-to-json.js.default: ERROR: Unchecked JS exception: microbenchmarks/json-stringify-many-objects-to-json.js.default: This scope can throw a JS exception: executeCall @ ./interpreter/Interpreter.cpp:858 microbenchmarks/json-stringify-many-objects-to-json.js.default: (ExceptionScope::m_recursionDepth was 10) microbenchmarks/json-stringify-many-objects-to-json.js.default: But the exception was unchecked as of this scope: toJSON @ ./runtime/JSONObject.cpp:301 microbenchmarks/json-stringify-many-objects-to-json.js.default: (ExceptionScope::m_recursionDepth was 9) microbenchmarks/json-stringify-many-objects-to-json.js.default: microbenchmarks/json-stringify-many-objects-to-json.js.default: Unchecked exception detected at: microbenchmarks/json-stringify-many-objects-to-json.js.default: 1 0x10b9c30ae JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation&) microbenchmarks/json-stringify-many-objects-to-json.js.default: 2 0x10b99beed JSC::ThrowScope::~ThrowScope() microbenchmarks/json-stringify-many-objects-to-json.js.default: 3 0x10b99c0f5 JSC::ThrowScope::~ThrowScope() microbenchmarks/json-stringify-many-objects-to-json.js.default: 4 0x10b80713c JSC::Stringifier::toJSON(JSC::JSValue, JSC::PropertyNameForFunctionCall const&) microbenchmarks/json-stringify-many-objects-to-json.js.default: 5 0x10b8063b9 JSC::Stringifier::appendStringifiedValue(WTF::StringBuilder&, JSC::JSValue, JSC::Stringifier::Holder const&, JSC::PropertyNameForFunctionCall const&) microbenchmarks/json-stringify-many-objects-to-json.js.default: 6 0x10b807efa JSC::Stringifier::Holder::appendNextProperty(JSC::Stringifier&, WTF::StringBuilder&) microbenchmarks/json-stringify-many-objects-to-json.js.default: 7 0x10b806cd5 JSC::Stringifier::appendStringifiedValue(WTF::StringBuilder&, JSC::JSValue, JSC::Stringifier::Holder const&, JSC::PropertyNameForFunctionCall const&) microbenchmarks/json-stringify-many-objects-to-json.js.default: 8 0x10b80608c JSC::Stringifier::stringify(JSC::JSValue) microbenchmarks/json-stringify-many-objects-to-json.js.default: 9 0x10b80b568 JSC::JSONProtoFuncStringify(JSC::JSGlobalObject*, JSC::CallFrame*) microbenchmarks/json-stringify-many-objects-to-json.js.default: 10 0x547503e01178 microbenchmarks/json-stringify-many-objects-to-json.js.default: 11 0x10a4faeb3 llint_entry microbenchmarks/json-stringify-many-objects-to-json.js.default: 12 0x10a4dda93 vmEntryToJavaScript microbenchmarks/json-stringify-many-objects-to-json.js.default: 13 0x10b2ecf57 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) microbenchmarks/json-stringify-many-objects-to-json.js.default: 14 0x10b2ec5ac JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*) microbenchmarks/json-stringify-many-objects-to-json.js.default: 15 0x10b671edc JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) microbenchmarks/json-stringify-many-objects-to-json.js.default: 16 0x109eade4f runWithOptions(GlobalObject*, CommandLine&, bool&) microbenchmarks/json-stringify-many-objects-to-json.js.default: 17 0x109e7f19a jscmain(int, char**)::$_6::operator()(JSC::VM&, GlobalObject*, bool&) const microbenchmarks/json-stringify-many-objects-to-json.js.default: 18 0x109e5997b int runJSC<jscmain(int, char**)::$_6>(CommandLine const&, bool, jscmain(int, char**)::$_6 const&) microbenchmarks/json-stringify-many-objects-to-json.js.default: 19 0x109e58408 jscmain(int, char**) microbenchmarks/json-stringify-many-objects-to-json.js.default: 20 0x109e581de main microbenchmarks/json-stringify-many-objects-to-json.js.default: 21 0x7fff719c87fd start https://build.webkit.org/builders/Apple-Catalina-Debug-JSC-Tests/builds/453 1627243 1 392867 ashvayka 2020-03-07 10:53:08 -0800 Created attachment 392867 Patch 1627314 2 392867 ysuzuki 2020-03-07 14:09:41 -0800 Comment on attachment 392867 Patch r=me, nice fix! 1627318 3 ross.kirsling 2020-03-07 14:29:02 -0800 Thanks for addressing this so quickly, Alexey! 1627319 4 ashvayka 2020-03-07 14:46:23 -0800 Thank you, folks. I thought this kind of errors would have been caught by regular EWS. Anyway, I will test future patches with JSC_validateExceptionChecks=true. 1627322 5 392867 commit-queue 2020-03-07 14:53:43 -0800 Comment on attachment 392867 Patch Clearing flags on attachment: 392867 Committed r258081: <https://trac.webkit.org/changeset/258081> 1627323 6 commit-queue 2020-03-07 14:53:45 -0800 All reviewed patches have been landed. Closing bug. 1627324 7 webkit-bug-importer 2020-03-07 14:54:15 -0800 <rdar://problem/60192817> 392867 2020-03-07 10:53:08 -0800 2020-03-07 14:53:43 -0800 Patch bug-208766-20200307205307.patch text/plain 1490 ashvayka SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjU4MDc1KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBA CisyMDIwLTAzLTA3ICBBbGV4ZXkgU2h2YXlrYSAgPHNodmFpa2FsZXNoQGdtYWlsLmNvbT4KKwor ICAgICAgICBSRUdSRVNTSU9OIChyMjU4MDQ5KTogVW5jaGVja2VkIEpTIGV4Y2VwdGlvbiBpbiBq c2M6OlN0cmluZ2lmaWVyOjp0b0pTT04KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTIwODc2NgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09Q UyEpLgorCisgICAgICAgICogcnVudGltZS9KU09OT2JqZWN0LmNwcDoKKyAgICAgICAgKEpTQzo6 U3RyaW5naWZpZXI6OnRvSlNPTik6IEFkZCBtaXNzaW5nIFJFTEVBU0VfQU5EX1JFVFVSTi4KKwog MjAyMC0wMy0wNiAgWXVzdWtlIFN1enVraSAgPHlzdXp1a2lAYXBwbGUuY29tPgogCiAgICAgICAg IFtKU0NdIEVuYWJsZSBwdWJsaWMgY2xhc3MgZmllbGRzCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlw dENvcmUvcnVudGltZS9KU09OT2JqZWN0LmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNj cmlwdENvcmUvcnVudGltZS9KU09OT2JqZWN0LmNwcAkocmV2aXNpb24gMjU4MDc1KQorKysgU291 cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvSlNPTk9iamVjdC5jcHAJKHdvcmtpbmcgY29weSkK QEAgLTMxMiw3ICszMTIsNyBAQCBBTFdBWVNfSU5MSU5FIEpTVmFsdWUgU3RyaW5naWZpZXI6OnRv SlNPCiAgICAgTWFya2VkQXJndW1lbnRCdWZmZXIgYXJnczsKICAgICBhcmdzLmFwcGVuZChwcm9w ZXJ0eU5hbWUudmFsdWUobV9nbG9iYWxPYmplY3QpKTsKICAgICBBU1NFUlQoIWFyZ3MuaGFzT3Zl cmZsb3dlZCgpKTsKLSAgICByZXR1cm4gY2FsbChtX2dsb2JhbE9iamVjdCwgYXNPYmplY3QodG9K U09ORnVuY3Rpb24pLCBjYWxsVHlwZSwgY2FsbERhdGEsIGJhc2VWYWx1ZSwgYXJncyk7CisgICAg UkVMRUFTRV9BTkRfUkVUVVJOKHNjb3BlLCBjYWxsKG1fZ2xvYmFsT2JqZWN0LCBhc09iamVjdCh0 b0pTT05GdW5jdGlvbiksIGNhbGxUeXBlLCBjYWxsRGF0YSwgYmFzZVZhbHVlLCBhcmdzKSk7CiB9 CiAKIFN0cmluZ2lmaWVyOjpTdHJpbmdpZnlSZXN1bHQgU3RyaW5naWZpZXI6OmFwcGVuZFN0cmlu Z2lmaWVkVmFsdWUoU3RyaW5nQnVpbGRlciYgYnVpbGRlciwgSlNWYWx1ZSB2YWx1ZSwgY29uc3Qg SG9sZGVyJiBob2xkZXIsIGNvbnN0IFByb3BlcnR5TmFtZUZvckZ1bmN0aW9uQ2FsbCYgcHJvcGVy dHlOYW1lKQo=