1308745 - Assertion failure: !IsUninitializedLexical((activation.regs()).fp()->unaliasedLocal(i)), at js/src/vm/Interpreter.cpp:3402

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 313a2d049350 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

for (let x, y = [y] = [,]; x < 4; ++x) {}


Backtrace:

0   js-dbg-64-dm-clang-darwin-313a2d049350	0x00000001106b0d68 Interpret(JSContext*, js::RunState&) + 48056 (Interpreter.cpp:3402)
1   js-dbg-64-dm-clang-darwin-313a2d049350	0x00000001106a4fb4 js::RunScript(JSContext*, js::RunState&) + 452 (Interpreter.cpp:404)
2   js-dbg-64-dm-clang-darwin-313a2d049350	0x00000001106b758f js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) + 511 (Interpreter.cpp:685)
3   js-dbg-64-dm-clang-darwin-313a2d049350	0x00000001106b79f6 js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) + 438 (RootingAPI.h:802)
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/9716bcfed35d
user:        Tooru Fujisawa
date:        Tue Sep 27 13:57:00 2016 +0900
summary:     Bug 1184922 - Part 1: Do not call iter.next() if the previous iter.next().done was true in array destructuring. r=shu

Arai-san, is bug 1184922 a likely regressor?

Comment 3

[Tooru Fujisawa [:arai]]

Yes, thanks.
This means we cannot emit lexical binding pattern twice with current approach.
I'll backout bug 1184922 patches.

Comment 4

[Tooru Fujisawa [:arai]]

patch is almost ready.
will fix in bug 1184922.

Comment 5

[Fuzzing Team]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 90d8afaddf91).

Comment 6

[Tooru Fujisawa [:arai]]

fixed in bug 1184922