1064391 - Assertion failure: next->isOp(JSOP_INITPROP), at jsreflect.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Reflect.parse("    [{__proto__:[]}] = 0")

asserts js debug shell on m-c changeset 2255d7d187b2 with --no-threads --ion-eager at Assertion failure: next->isOp(JSOP_INITPROP), at jsreflect.cpp.

Debug configure flags:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/8acb4009398c
user:        Jeff Walden
date:        Sat Aug 30 14:27:19 2014 -0700
summary:     Bug 1061853 - Reintroduce PNK_MUTATEPROTO to distinguish ({ __proto__: v }) as mutating the [[Prototype]] from ({ __proto__() {} }) as not doing so.  r=shu

Waldo, is bug 1061853 a possible regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

Reflect.parse("[{__proto__:[]}] = 0")

Apparently the extra spaces were not necessary.

Comment 2

[Jeff Walden [:Waldo]]

Attachment: Patch

Comment 3

[Shu-yu Guo [:shu]]

Comment on attachment 8485969 [details] [diff] [review]
Patch

Review of attachment 8485969 [details] [diff] [review]:
-----------------------------------------------------------------

The fix looks fine. I'd prefer __proto__ in patterns to not be parsed as MUTATEPROTO as it can never mutate [[Prototype]], but Waldo explained on IRC that doing that would require backtracking in the parser and is a pain.

::: js/src/jsreflect.cpp
@@ +3136,4 @@
>  }
>  
>  bool
> +ASTSerializer::objectPattern(ParseNode *objPattern, VarDeclKind *pkind, MutableHandleValue dst)

Nit: For the sake of conformity I wouldn't rename the parameter name. Everything else in ASTSerializer is named pn.

Comment 4

[Jeff Walden [:Waldo]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d9089681f200

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/d9089681f200