Summary: | [Apple-Ventura-AppleSilicon-Debug-JSC-Tests] ASSERTION FAILED: !m_needExceptionCheck in multiple tests in ChakraCore.yaml/ChakraCore/test | ||
---|---|---|---|
Product: | WebKit | Reporter: | Marta Darbinyan <darbinyan> |
Component: | JavaScriptCore | Assignee: | Dan Hecht <dan.hecht> |
Status: | RESOLVED FIXED | ||
Severity: | Normal | CC: | keith_miller, mark.lam, msaboff, webkit-bot-watchers-bugzilla, webkit-bug-importer |
Priority: | P2 | Keywords: | InRadar |
Version: | WebKit Nightly Build | ||
Hardware: | Unspecified | ||
OS: | Unspecified |
Description
Marta Darbinyan
2024-05-16 15:06:48 PDT
Full log: https://s3-us-west-2.amazonaws.com/archives.webkit.org/mac-ventura-x86_64%20arm64-debug-jscore-test/278857@main.txt ERROR: Unchecked JS exception: This scope can throw a JS exception: toStringSlowCase @ ./runtime/JSCJSValue.cpp:376 (ExceptionScope::m_recursionDepth was 4) But the exception was unchecked as of this scope: matchInline @ /Volumes/Data/worker/Apple-Ventura-Debug-Build/build/Source/JavaScriptCore/runtime/RegExpObjectInlines.h:106 (ExceptionScope::m_recursionDepth was 4) Unchecked exception detected at: 1 0x11a2ac3cc JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation&) 2 0x11a2885cc JSC::ThrowScope::ThrowScope(JSC::VM&, JSC::ExceptionEventLocation) 3 0x11a288600 JSC::ThrowScope::ThrowScope(JSC::VM&, JSC::ExceptionEventLocation) 4 0x119580094 JSC::RegExpObject::matchInline(JSC::JSGlobalObject*, JSC::JSString*) 5 0x1195343e4 JSC::RegExpObject::testInline(JSC::JSGlobalObject*, JSC::JSString*) 6 0x1195345c4 operationRegExpTest 7 0x121ae8754 6 ??? 0x0000000121ae8754 0x0 + 4860053332 8 0x11a9f8e2c llint_entry 9 0x11a9f8e2c llint_entry 10 0x11a9d25b4 vmEntryToJavaScript 11 0x119a54e84 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*) 12 0x119d90c6c JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 13 0x104fd411c runWithOptions(GlobalObject*, CommandLine&, bool&) 14 0x104f7e3e8 jscmain(int, char**)::$_10::operator()(JSC::VM&, GlobalObject*, bool&) const 15 0x104f3b7f4 int runJSC<jscmain(int, char**)::$_10>(CommandLine const&, bool, jscmain(int, char**)::$_10 const&) 16 0x104f38d24 jscmain(int, char**) 17 0x104f38808 main 18 0x18ac2bf28 start Running the test case with --dumpSimulatedThrows=1 produces: ERROR: Unchecked JS exception: This scope can throw a JS exception: toStringSlowCase @ ./runtime/JSCJSValue.cpp:376 (ExceptionScope::m_recursionDepth was 4) But the exception was unchecked as of this scope: matchInline @ ./runtime/RegExpObjectInlines.h:106 (ExceptionScope::m_recursionDepth was 4) The simulated exception was thrown at: 1 0x10cee85e4 JSC::ThrowScope::simulateThrow() 2 0x10cee84a4 JSC::ThrowScope::~ThrowScope() 3 0x10cee8638 JSC::ThrowScope::~ThrowScope() 4 0x10cb2d960 JSC::JSValue::toStringSlowCase(JSC::JSGlobalObject*, bool) const 5 0x10c0c9f90 JSC::JSValue::toStringOrNull(JSC::JSGlobalObject*) const 6 0x10c0ce38c operationRegExpTest 7 0x11696f960 6 ??? 0x000000011696f960 0x0 + 4673960288 8 0x116918550 7 ??? 0x0000000116918550 0x0 + 4673602896 9 0x1168b0068 8 ??? 0x00000001168b0068 0x0 + 4673175656 10 0x11690a7e0 9 ??? 0x000000011690a7e0 0x0 + 4673546208 11 0x11690f8e4 10 ??? 0x000000011690f8e4 0x0 + 4673566948 12 0x1168b0008 11 ??? 0x00000001168b0008 0x0 + 4673175560 13 0x1168b0428 12 ??? 0x00000001168b0428 0x0 + 4673176616 14 0x10c63e2a8 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*) 15 0x10c9afcd8 JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 16 0x1009e3164 runWithOptions(GlobalObject*, CommandLine&, bool&) 17 0x100989f1c jscmain(int, char**)::$_10::operator()(JSC::VM&, GlobalObject*, bool&) const 18 0x1009433b0 int runJSC<jscmain(int, char**)::$_10>(CommandLine const&, bool, jscmain(int, char**)::$_10 const&) 19 0x1009406e8 jscmain(int, char**) 20 0x100940178 main 21 0x197a6e0e0 start Unchecked exception detected at: 1 0x10cf0dd50 JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation&) 2 0x10cee82cc JSC::ThrowScope::ThrowScope(JSC::VM&, JSC::ExceptionEventLocation) 3 0x10cee830c JSC::ThrowScope::ThrowScope(JSC::VM&, JSC::ExceptionEventLocation) 4 0x10cdf9ca0 JSC::RegExpObject::matchInline(JSC::JSGlobalObject*, JSC::JSString*) 5 0x10c0ce1f8 JSC::RegExpObject::testInline(JSC::JSGlobalObject*, JSC::JSString*) 6 0x10c0ce3ec operationRegExpTest 7 0x11696f960 6 ??? 0x000000011696f960 0x0 + 4673960288 8 0x116918550 7 ??? 0x0000000116918550 0x0 + 4673602896 9 0x1168b0068 8 ??? 0x00000001168b0068 0x0 + 4673175656 10 0x11690a7e0 9 ??? 0x000000011690a7e0 0x0 + 4673546208 11 0x11690f8e4 10 ??? 0x000000011690f8e4 0x0 + 4673566948 12 0x1168b0008 11 ??? 0x00000001168b0008 0x0 + 4673175560 13 0x1168b0428 12 ??? 0x00000001168b0428 0x0 + 4673176616 14 0x10c63e2a8 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*) 15 0x10c9afcd8 JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 16 0x1009e3164 runWithOptions(GlobalObject*, CommandLine&, bool&) 17 0x100989f1c jscmain(int, char**)::$_10::operator()(JSC::VM&, GlobalObject*, bool&) const 18 0x1009433b0 int runJSC<jscmain(int, char**)::$_10>(CommandLine const&, bool, jscmain(int, char**)::$_10 const&) 19 0x1009406e8 jscmain(int, char**) 20 0x100940178 main 21 0x197a6e0e0 start ASSERTION FAILED: !m_needExceptionCheck In the common caller operationRegExpTest, there is no exception check between the call to toStringOrNull and testInline. The similar method uses this invariant to avoid an explicit exception check: EXCEPTION_ASSERT(!!scope.exception() == !input); which implies we will take the !input early return anyway if an exception is pending. Appears we should be able to do the same here (though I didn't exhaustively verify that this invariant is correct for all cases inside JSValue::toStringSlowCase()). Oops, meant to say: The similar method operationRegExpTestGeneric Pull request: https://github.com/WebKit/WebKit/pull/28728 Committed 278947@main (4b7d246d6d63): <https://commits.webkit.org/278947@main> Reviewed commits have been landed. Closing PR #28728 and removing active labels. |