The following testcase crashes on mozilla-central revision b911a4c97fde (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-stdcxx-compat --disable-profiling --enable-debug --enable-optimize, run with --fuzzing-safe --ion-offthread-compile=off): let moduleRepo = {}; setModuleResolveHook(function(module, specifier) { throw setModuleResolveHook++; }); let c = moduleRepo['c'] = parseModule("export * from 'a'; export * from 'b';"); c.declarationInstantiation(); Backtrace: received signal SIGSEGV, Segmentation fault. 0x0000000000c0b696 in intrinsic_AssertionFailed (cx=<optimized out>, argc=<optimized out>, vp=<optimized out>) at js/src/vm/SelfHosting.cpp:377 #0 0x0000000000c0b696 in intrinsic_AssertionFailed (cx=<optimized out>, argc=<optimized out>, vp=<optimized out>) at js/src/vm/SelfHosting.cpp:377 #1 0x00000000005488db in js::CallJSNative (cx=cx@entry=0x7ffff6955000, native=0xc0b600 <intrinsic_AssertionFailed(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:293 #2 0x000000000053db3b in js::InternalCallOrConstruct (cx=0x7ffff6955000, args=..., construct=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:469 #3 0x0000000000530764 in js::CallFromStack (args=..., cx=<optimized out>) at js/src/vm/Interpreter.cpp:520 #4 Interpret (cx=0x7ffff6955000, state=...) at js/src/vm/Interpreter.cpp:3065 #5 0x000000000053d703 in js::RunScript (cx=0x7ffff6955000, state=...) at js/src/vm/Interpreter.cpp:409 #6 0x000000000053dc56 in js::InternalCallOrConstruct (cx=0x7ffff6955000, args=..., construct=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:487 #7 0x0000000000530764 in js::CallFromStack (args=..., cx=<optimized out>) at js/src/vm/Interpreter.cpp:520 #8 Interpret (cx=0x7ffff6955000, state=...) at js/src/vm/Interpreter.cpp:3065 #9 0x000000000053d703 in js::RunScript (cx=0x7ffff6955000, state=...) at js/src/vm/Interpreter.cpp:409 [...] #18 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at js/src/shell/js.cpp:8564 rax 0x0 0 rbx 0x7ffff465b920 140737293695264 rcx 0x7ffff6c28a2d 140737333332525 rdx 0x0 0 rsi 0x7ffff6ef7770 140737336276848 rdi 0x7ffff6ef6540 140737336272192 rbp 0x7fffffffce00 140737488342528 rsp 0x7fffffffcde0 140737488342496 r8 0x7ffff6ef7770 140737336276848 r9 0x7ffff7fe4740 140737354024768 r10 0x58 88 r11 0x7ffff6b9f750 140737332770640 r12 0x7ffff6ef6700 140737336272640 r13 0x7fffffffce20 140737488342560 r14 0xc0b600 12629504 r15 0x7ffff428b160 140737289695584 rip 0xc0b696 <intrinsic_AssertionFailed(JSContext*, unsigned int, JS::Value*)+150> => 0xc0b696 <intrinsic_AssertionFailed(JSContext*, unsigned int, JS::Value*)+150>: movl $0x0,0x0 0xc0b6a1 <intrinsic_AssertionFailed(JSContext*, unsigned int, JS::Value*)+161>: ud2 Might be related to the other self-hosted module assertion that I filed, but the message is different.

JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: https://hg.mozilla.org/mozilla-central/rev/2e4748827cda user: Jon Coppeard date: Wed Aug 09 18:05:15 2017 +0100 summary: Bug 1374239 - Store and re-throw module instantiation and evaluation errors r=shu This iteration took 0.896 seconds to run.

Jon, is bug 1374239 a likely regressor?