781071 - Crash [@ ExpressionDecompiler::findLetVar] or "Assertion failure: isObject(),"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

{
  let[[l]] = [[].watch(0, function() {})]
}

asserts js debug shell on m-c changeset 602c2e7ee0d2 without any CLI argument at Assertion failure: isObject(), and crashes opt shell at ExpressionDecompiler::findLetVar

This seems like a null crash.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   101243:7852a8f73313
user:        Benjamin Peterson
date:        Thu Aug 02 09:20:08 2012 -0700
summary:     Bug 767274: New expression decompiler. r=luke

Comment 1

[:Benjamin Peterson]

Attachment: account for null enclosing scope

Comment 2

[Luke Wagner [:luke]]

Why doesn't findLetVar find the let var?  It seems like it should.  I see that the loop doesn't return if !JSID_IS_ATOM(shape.propid()), even though the property at the correct depth is found: perhaps that should return emptyAtom?  Regardless, I don't see empty destructuring let in the example, so there seems to be some other problem...

Comment 3

[:Benjamin Peterson]

Having some shape where !JSID_IS_ATOM(shape.propid()) is sufficient but not necessary condition to having a destructing temporary.

Comment 4

[Luke Wagner [:luke]]

(From IRL: GETLOCAL(i) where i > nfixed does not a let-variable-access make, sometimes we emit GETLOCAL to access expression temporaries who have no variable name.)

Comment 5

[:Benjamin Peterson]

https://hg.mozilla.org/integration/mozilla-inbound/rev/abbb9f6d48dd

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/abbb9f6d48dd

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

A test was landed into the testsuite. -> VERIFIED