1057587 - Crash [@ JSString::ensureLinear] with Symbol

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision cd2acc7ab2f8 (run with --no-threads --fuzzing-safe):


"use strict";
eval('({[Symbol.iterator]:1, [Symbol()]:2})');

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Needinfo from jorendorff because it involves Symbol :)

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/7079b7552946
user:        Guptha Rajagopal
date:        Fri Aug 08 09:15:00 2014 -0400
summary:     Bug 924688 - Implement ES6 computed property names. r=jorendorff

This iteration took 428.368 seconds to run.

Comment 4

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 7bd309e55a3d).

Comment 5

[Christian Holler (:decoder)]

Still reproduces, e.g. with

environment [Symbol.iterator] = 1;

Comment 6

[Tom S [:evilpie]]

This is just specific to the environment object. This test case doesn't even include computed property name.

Comment 7

[Jason Orendorff [:jorendorff]]

Any other places where this reproduces? Otherwise it looks like this is fixed...

Comment 8

[Jason Orendorff [:jorendorff]]

D'oh. Bug 1037723 fixes the getter but not the setter.

Comment 9

[Jason Orendorff [:jorendorff]]

Attachment: bug-1057587-env_resolve-v1.patch

Comment 10

[Tom S [:evilpie]]

Comment on attachment 8486862 [details] [diff] [review]
bug-1057587-env_resolve-v1.patch

Review of attachment 8486862 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/shell/js.cpp
@@ +4957,5 @@
>  
> +    if (JSID_IS_SYMBOL(id))
> +        return true;
> +    RootedString idstring(cx, IdToString(cx, id));
> +    if (!idstring)

Good catch.

Comment 11

[Jason Orendorff [:jorendorff]]

https://tbpl.mozilla.org/?tree=Try&rev=af77bb098aef

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/9f5b055bb012