1314128 - Assertion failure: sc->isFunctionBox() for await expression in module code

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[André Bargull [:anba]]

Test case:
---
parseModule("await 0")
---

Triggers this assertion failure: "Assertion failure: sc->isFunctionBox()"

Back trace:
---
#0  0x00000000010560fc in js::frontend::BytecodeEmitter::emitYield (this=0x7fffffffb3b8, pn=0x7ffff69fc0e0)
    at /home/andre/hg/mozilla-inbound/js/src/frontend/BytecodeEmitter.cpp:7405
#1  0x000000000105cecb in js::frontend::BytecodeEmitter::emitTree (this=0x7fffffffb3b8, pn=0x7ffff69fc0e0, 
    emitLineNote=js::frontend::BytecodeEmitter::EMIT_LINENOTE) at /home/andre/hg/mozilla-inbound/js/src/frontend/BytecodeEmitter.cpp:9349
#2  0x00000000010570f5 in js::frontend::BytecodeEmitter::emitStatement (this=0x7fffffffb3b8, pn=0x7ffff69fc110)
    at /home/andre/hg/mozilla-inbound/js/src/frontend/BytecodeEmitter.cpp:7656
#3  0x000000000105cf1b in js::frontend::BytecodeEmitter::emitTree (this=0x7fffffffb3b8, pn=0x7ffff69fc110, 
    emitLineNote=js::frontend::BytecodeEmitter::EMIT_LINENOTE) at /home/andre/hg/mozilla-inbound/js/src/frontend/BytecodeEmitter.cpp:9359
#4  0x0000000001056e5a in js::frontend::BytecodeEmitter::emitStatementList (this=0x7fffffffb3b8, pn=0x7ffff69fc050)
    at /home/andre/hg/mozilla-inbound/js/src/frontend/BytecodeEmitter.cpp:7601
#5  0x000000000105cef3 in js::frontend::BytecodeEmitter::emitTree (this=0x7fffffffb3b8, pn=0x7ffff69fc050, 
    emitLineNote=js::frontend::BytecodeEmitter::EMIT_LINENOTE) at /home/andre/hg/mozilla-inbound/js/src/frontend/BytecodeEmitter.cpp:9354
#6  0x000000000104afd7 in js::frontend::BytecodeEmitter::emitScript (this=0x7fffffffb3b8, body=0x7ffff69fc050)
    at /home/andre/hg/mozilla-inbound/js/src/frontend/BytecodeEmitter.cpp:4189
#7  0x000000000103cb7a in BytecodeCompiler::compileModule (this=0x7fffffffb800) at /home/andre/hg/mozilla-inbound/js/src/frontend/BytecodeCompiler.cpp:414
#8  0x000000000103d882 in js::frontend::CompileModule (cx=0x7ffff6965000, optionsInput=..., srcBuf=..., alloc=..., sourceObjectOut=0x0)
    at /home/andre/hg/mozilla-inbound/js/src/frontend/BytecodeCompiler.cpp:603
#9  0x000000000103d967 in js::frontend::CompileModule (cx=0x7ffff6965000, options=..., srcBuf=...)
    at /home/andre/hg/mozilla-inbound/js/src/frontend/BytecodeCompiler.cpp:614
#10 0x00000000004481eb in ParseModule (cx=0x7ffff6965000, argc=1, vp=0x7ffff161f090) at /home/andre/hg/mozilla-inbound/js/src/shell/js.cpp:3987
...
---

Comment 1

[Tooru Fujisawa [:arai]]

TOK_AWAIT is returned in module even if it's not in async function, so we should throw error if it's |!pc->isAsync()|.

Comment 2

[Tooru Fujisawa [:arai]]

Attachment: Do not parse await expression in module.

In module, await is Future Reserved Words.
  https://tc39.github.io/ecma262/#sec-future-reserved-words
We handle it by AutoAwaitIsKeyword in moduleBody, but it means we return TOK_AWAIT outside of async function,
and unaryExpr parses await expression regardless of the context.

Now it throws SyntaxError when it founds TOK_AWAIT outside async function.

Comment 3

[Till Schneidereit [:till]]

Comment on attachment 8806148 [details] [diff] [review]
Do not parse await expression in module.

Review of attachment 8806148 [details] [diff] [review]:
-----------------------------------------------------------------

r=me

Comment 4

[Tooru Fujisawa [:arai]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d2526689ef032790ef20dd129e054b5bbc60b458
Bug 1314128 - Do not parse await expression in module. r=till

Comment 6

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/d2526689ef03