The following testcase crashes on mozilla-central revision d10c97627b51 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-stdcxx-compat --disable-profiling --enable-debug --enable-optimize, run with --fuzzing-safe): let m = parseModule(` throw i => { return 5; }, m-1; `); m.declarationInstantiation(); function eval(source) { return m.evaluation(); } eval(""); Backtrace: received signal SIGSEGV, Segmentation fault. 0x0000000000c10376 in intrinsic_AssertionFailed (cx=<optimized out>, argc=<optimized out>, vp=<optimized out>) at js/src/vm/SelfHosting.cpp:421 #0 0x0000000000c10376 in intrinsic_AssertionFailed (cx=<optimized out>, argc=<optimized out>, vp=<optimized out>) at js/src/vm/SelfHosting.cpp:421 #1 0x0000000000548c0b in js::CallJSNative (cx=cx@entry=0x7ffff6924000, native=0xc102e0 <intrinsic_AssertionFailed(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:293 #2 0x000000000053de6b in js::InternalCallOrConstruct (cx=0x7ffff6924000, args=..., construct=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:469 #3 0x0000000000530af3 in js::CallFromStack (args=..., cx=<optimized out>) at js/src/vm/Interpreter.cpp:520 #4 Interpret (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:3065 #5 0x000000000053da33 in js::RunScript (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:409 #6 0x000000000053df86 in js::InternalCallOrConstruct (cx=0x7ffff6924000, args=..., construct=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:487 #7 0x0000000000530af3 in js::CallFromStack (args=..., cx=<optimized out>) at js/src/vm/Interpreter.cpp:520 #8 Interpret (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:3065 #9 0x000000000053da33 in js::RunScript (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:409 #10 0x000000000053df86 in js::InternalCallOrConstruct (cx=0x7ffff6924000, args=..., construct=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:487 #11 0x00000000005394c7 in js::CallFromStack (args=..., cx=<optimized out>) at js/src/vm/Interpreter.cpp:520 #12 Interpret (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:2981 #13 0x000000000053da33 in js::RunScript (cx=0x7ffff6924000, state=...) at js/src/vm/Interpreter.cpp:409 [...] #22 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at js/src/shell/js.cpp:8592 rax 0x0 0 rbx 0x7ffff465be00 140737293696512 rcx 0x7ffff6c28a2d 140737333332525 rdx 0x0 0 rsi 0x7ffff6ef7770 140737336276848 rdi 0x7ffff6ef6540 140737336272192 rbp 0x7fffffffbb70 140737488337776 rsp 0x7fffffffbb50 140737488337744 r8 0x7ffff6ef7770 140737336276848 r9 0x7ffff7fe4740 140737354024768 r10 0x58 88 r11 0x7ffff6b9f750 140737332770640 r12 0x7ffff6ef6700 140737336272640 r13 0x7fffffffbb90 140737488337808 r14 0xc102e0 12649184 r15 0x7ffff42801d0 140737289650640 rip 0xc10376 <intrinsic_AssertionFailed(JSContext*, unsigned int, JS::Value*)+150> => 0xc10376 <intrinsic_AssertionFailed(JSContext*, unsigned int, JS::Value*)+150>: movl $0x0,0x0 0xc10381 <intrinsic_AssertionFailed(JSContext*, unsigned int, JS::Value*)+161>: ud2

JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: https://hg.mozilla.org/mozilla-central/rev/2e4748827cda user: Jon Coppeard date: Wed Aug 09 18:05:15 2017 +0100 summary: Bug 1374239 - Store and re-throw module instantiation and evaluation errors r=shu This iteration took 270.539 seconds to run.

Jon, is bug 1374239 a likely regressor?

Oh, NaN !== NaN.

Patch to use SameValue() rather than === to compare exception values.

Comment on attachment 8903531 [details] [diff] [review] bug1394492-module-errors Review of attachment 8903531 [details] [diff] [review]: ----------------------------------------------------------------- looks good :)

Pushed by jcoppeard@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/57b37489a2e3 Fix module error assertion which fails if we throw NaN r=arai