Bug 274281 – [Apple-Ventura-AppleSilicon-Debug-JSC-Tests] ASSERTION FAILED: !m_needExceptionCheck in multiple tests in ChakraCore.yaml/ChakraCore/test

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Marta Darbinyan]

The following tests regressed in Apple-Ventura-AppleSilicon-Debug-JSC-Tests. The first failed test occurred on 278541@main. 

First failed: 278541@main
Last passed: 278465@main

The possible culprit range is in https://commits.webkit.org/compare/278465@main...278541@main

Failing tests:
ChakraCore.yaml/ChakraCore/test/Bugs/OS_5553123.js.default
ChakraCore.yaml/ChakraCore/test/Strings/HTMLHelpers.js.default
ChakraCore.yaml/ChakraCore/test/UnitTestFramework/UTFTests.js.default
ChakraCore.yaml/ChakraCore/test/es5/TypeConversions.js.default
ChakraCore.yaml/ChakraCore/test/es5/defineProperty.js.default
ChakraCore.yaml/ChakraCore/test/es6/ES6Function_bugs.js.default
ChakraCore.yaml/ChakraCore/test/es6/NumericLiteralTest.js.default
ChakraCore.yaml/ChakraCore/test/es6/map_basic.js.default
ChakraCore.yaml/ChakraCore/test/es6/proxytest6.js.default
ChakraCore.yaml/ChakraCore/test/es6/regex-quantifiers.js.default
ChakraCore.yaml/ChakraCore/test/es6/set_basic.js.default
ChakraCore.yaml/ChakraCore/test/es6/superDotOSBug3930962.js.default
ChakraCore.yaml/ChakraCore/test/es6/weakmap_basic.js.default
ChakraCore.yaml/ChakraCore/test/es6/weakset_basic.js.default


Errors:
ChakraCore.yaml/ChakraCore/test/es5/defineProperty.js.default: ASSERTION FAILED: !m_needExceptionCheck
ChakraCore.yaml/ChakraCore/test/es5/defineProperty.js.default: ./runtime/VM.cpp(1441) : void JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation &)
ChakraCore.yaml/ChakraCore/test/es5/defineProperty.js.default: test_script_86783: line 2: 78655 Trace/BPT trap: 5       ( "$@" ../../../../../.vm/JavaScriptCore.framework/Helpers/jsc --validateOptions\=true --useFTLJIT\=false --useFunctionDotArguments\=true --validateExceptionChecks\=true --useDollarVM\=true --maxPerThreadStackUsage\=1572864 --useFTLJIT\=true --thresholdForJITAfterWarmUp\=10 --thresholdForJITSoon\=10 --thresholdForOptimizeAfterWarmUp\=20 --thresholdForOptimizeAfterLongWarmUp\=20 --thresholdForOptimizeSoon\=20 --thresholdForFTLOptimizeAfterWarmUp\=20 --thresholdForFTLOptimizeSoon\=20 --thresholdForOMGOptimizeAfterWarmUp\=20 --thresholdForOMGOptimizeSoon\=20 --maximumEvalCacheableSourceLength\=150000 --useEagerCodeBlockJettisonTiming\=true --repatchBufferingCountdown\=0 jsc-lib.js defineProperty.js )
ChakraCore.yaml/ChakraCore/test/es5/defineProperty.js.default: ERROR: Unexpected exit code: 133
FAIL: ChakraCore.yaml/ChakraCore/test/es5/defineProperty.js.default

History:
https://results.webkit.org/?style=debug&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&test=ChakraCore.yaml%2FChakraCore%2Ftest%2FBugs%2FOS_5553123.js.default&test=ChakraCore.yaml%2FChakraCore%2Ftest%2FStrings%2FHTMLHelpers.js.default&test=ChakraCore.yaml%2FChakraCore%2Ftest%2FUnitTestFramework%2FUTFTests.js.default&test=ChakraCore.yaml%2FChakraCore%2Ftest%2Fes5%2FTypeConversions.js.default&test=ChakraCore.yaml%2FChakraCore%2Ftest%2Fes5%2FdefineProperty.js.default&test=ChakraCore.yaml%2FChakraCore%2Ftest%2Fes6%2FES6Function_bugs.js.default&test=ChakraCore.yaml%2FChakraCore%2Ftest%2Fes6%2FNumericLiteralTest.js.default&test=ChakraCore.yaml%2FChakraCore%2Ftest%2Fes6%2Fmap_basic.js.default&test=ChakraCore.yaml%2FChakraCore%2Ftest%2Fes6%2Fproxytest6.js.default&test=ChakraCore.yaml%2FChakraCore%2Ftest%2Fes6%2Fregex-quantifiers.js.default&test=ChakraCore.yaml%2FChakraCore%2Ftest%2Fes6%2Fset_basic.js.default&test=ChakraCore.yaml%2FChakraCore%2Ftest%2Fes6%2FsuperDotOSBug3930962.js.default&test=ChakraCore.yaml%2FChakraCore%2Ftest%2Fes6%2Fweakmap_basic.js.default&test=ChakraCore.yaml%2FChakraCore%2Ftest%2Fes6%2Fweakset_basic.js.default&version_name=Ventura


Test failure: https://build.webkit.org/#/builders/1026/builds/52/steps/12/logs/stdio

[Radar WebKit Bug Importer]

<rdar://problem/128228200>

[Ryan Haddad]

Full log: https://s3-us-west-2.amazonaws.com/archives.webkit.org/mac-ventura-x86_64%20arm64-debug-jscore-test/[e-mail]

ERROR: Unchecked JS exception:
    This scope can throw a JS exception: toStringSlowCase @ ./runtime/JSCJSValue.cpp:376
        (ExceptionScope::m_recursionDepth was 4)
    But the exception was unchecked as of this scope: matchInline @ /Volumes/Data/worker/Apple-Ventura-Debug-Build/build/Source/JavaScriptCore/runtime/RegExpObjectInlines.h:106
        (ExceptionScope::m_recursionDepth was 4)

Unchecked exception detected at:
    1   0x11a2ac3cc JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation&)
    2   0x11a2885cc JSC::ThrowScope::ThrowScope(JSC::VM&, JSC::ExceptionEventLocation)
    3   0x11a288600 JSC::ThrowScope::ThrowScope(JSC::VM&, JSC::ExceptionEventLocation)
    4   0x119580094 JSC::RegExpObject::matchInline(JSC::JSGlobalObject*, JSC::JSString*)
    5   0x1195343e4 JSC::RegExpObject::testInline(JSC::JSGlobalObject*, JSC::JSString*)
    6   0x1195345c4 operationRegExpTest
    7   0x121ae8754 6   ???                                 0x0000000121ae8754 0x0 + 4860053332
    8   0x11a9f8e2c llint_entry
    9   0x11a9f8e2c llint_entry
    10  0x11a9d25b4 vmEntryToJavaScript
    11  0x119a54e84 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*)
    12  0x119d90c6c JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
    13  0x104fd411c runWithOptions(GlobalObject*, CommandLine&, bool&)
    14  0x104f7e3e8 jscmain(int, char**)::$_10::operator()(JSC::VM&, GlobalObject*, bool&) const
    15  0x104f3b7f4 int runJSC<jscmain(int, char**)::$_10>(CommandLine const&, bool, jscmain(int, char**)::$_10 const&)
    16  0x104f38d24 jscmain(int, char**)
    17  0x104f38808 main
    18  0x18ac2bf28 start

[Dan Hecht]

Running the test case with --dumpSimulatedThrows=1 produces:

ERROR: Unchecked JS exception:
    This scope can throw a JS exception: toStringSlowCase @ ./runtime/JSCJSValue.cpp:376
        (ExceptionScope::m_recursionDepth was 4)
    But the exception was unchecked as of this scope: matchInline @ ./runtime/RegExpObjectInlines.h:106
        (ExceptionScope::m_recursionDepth was 4)

The simulated exception was thrown at:
    1   0x10cee85e4 JSC::ThrowScope::simulateThrow()
    2   0x10cee84a4 JSC::ThrowScope::~ThrowScope()
    3   0x10cee8638 JSC::ThrowScope::~ThrowScope()
    4   0x10cb2d960 JSC::JSValue::toStringSlowCase(JSC::JSGlobalObject*, bool) const
    5   0x10c0c9f90 JSC::JSValue::toStringOrNull(JSC::JSGlobalObject*) const
    6   0x10c0ce38c operationRegExpTest
    7   0x11696f960 6   ???                                 0x000000011696f960 0x0 + 4673960288
    8   0x116918550 7   ???                                 0x0000000116918550 0x0 + 4673602896
    9   0x1168b0068 8   ???                                 0x00000001168b0068 0x0 + 4673175656
    10  0x11690a7e0 9   ???                                 0x000000011690a7e0 0x0 + 4673546208
    11  0x11690f8e4 10  ???                                 0x000000011690f8e4 0x0 + 4673566948
    12  0x1168b0008 11  ???                                 0x00000001168b0008 0x0 + 4673175560
    13  0x1168b0428 12  ???                                 0x00000001168b0428 0x0 + 4673176616
    14  0x10c63e2a8 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*)
    15  0x10c9afcd8 JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
    16  0x1009e3164 runWithOptions(GlobalObject*, CommandLine&, bool&)
    17  0x100989f1c jscmain(int, char**)::$_10::operator()(JSC::VM&, GlobalObject*, bool&) const
    18  0x1009433b0 int runJSC<jscmain(int, char**)::$_10>(CommandLine const&, bool, jscmain(int, char**)::$_10 const&)
    19  0x1009406e8 jscmain(int, char**)
    20  0x100940178 main
    21  0x197a6e0e0 start

Unchecked exception detected at:
    1   0x10cf0dd50 JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation&)
    2   0x10cee82cc JSC::ThrowScope::ThrowScope(JSC::VM&, JSC::ExceptionEventLocation)
    3   0x10cee830c JSC::ThrowScope::ThrowScope(JSC::VM&, JSC::ExceptionEventLocation)
    4   0x10cdf9ca0 JSC::RegExpObject::matchInline(JSC::JSGlobalObject*, JSC::JSString*)
    5   0x10c0ce1f8 JSC::RegExpObject::testInline(JSC::JSGlobalObject*, JSC::JSString*)
    6   0x10c0ce3ec operationRegExpTest
    7   0x11696f960 6   ???                                 0x000000011696f960 0x0 + 4673960288
    8   0x116918550 7   ???                                 0x0000000116918550 0x0 + 4673602896
    9   0x1168b0068 8   ???                                 0x00000001168b0068 0x0 + 4673175656
    10  0x11690a7e0 9   ???                                 0x000000011690a7e0 0x0 + 4673546208
    11  0x11690f8e4 10  ???                                 0x000000011690f8e4 0x0 + 4673566948
    12  0x1168b0008 11  ???                                 0x00000001168b0008 0x0 + 4673175560
    13  0x1168b0428 12  ???                                 0x00000001168b0428 0x0 + 4673176616
    14  0x10c63e2a8 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*)
    15  0x10c9afcd8 JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
    16  0x1009e3164 runWithOptions(GlobalObject*, CommandLine&, bool&)
    17  0x100989f1c jscmain(int, char**)::$_10::operator()(JSC::VM&, GlobalObject*, bool&) const
    18  0x1009433b0 int runJSC<jscmain(int, char**)::$_10>(CommandLine const&, bool, jscmain(int, char**)::$_10 const&)
    19  0x1009406e8 jscmain(int, char**)
    20  0x100940178 main
    21  0x197a6e0e0 start

ASSERTION FAILED: !m_needExceptionCheck

In the common caller operationRegExpTest, there is no exception check between the call to toStringOrNull and testInline.

The similar method uses this invariant to avoid an explicit exception check:
   EXCEPTION_ASSERT(!!scope.exception() == !input);
which implies we will take the !input early return anyway if an exception is pending.

Appears we should be able to do the same here (though I didn't exhaustively verify that this invariant is correct for all cases inside JSValue::toStringSlowCase()).

[Dan Hecht]

Oops, meant to say: The similar method operationRegExpTestGeneric

[Dan Hecht]

Pull request: https://github.com/WebKit/WebKit/pull/28728

[EWS]

Committed 278947@main (4b7d246d6d63): <https://commits.webkit.org/278947@main>

Reviewed commits have been landed. Closing PR #28728 and removing active labels.