1314380 - Assertion failure: sc->isFunctionBox(), at js/src/frontend/BytecodeEmitter.cpp:7405

Status: RESOLVED DUPLICATE of bug 1314128

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 2c773b971672 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug --enable-optimize, run with --fuzzing-safe):

parseModule("await (x);");



Backtrace:

 received signal SIGSEGV, Segmentation fault.
0x0000000000d59048 in js::frontend::BytecodeEmitter::emitYield (this=this@entry=0x7fffffffb9b8, pn=pn@entry=0x7ffff69f40e0) at js/src/frontend/BytecodeEmitter.cpp:7405
#0  0x0000000000d59048 in js::frontend::BytecodeEmitter::emitYield (this=this@entry=0x7fffffffb9b8, pn=pn@entry=0x7ffff69f40e0) at js/src/frontend/BytecodeEmitter.cpp:7405
#1  0x0000000000d4fbba in js::frontend::BytecodeEmitter::emitTree (this=this@entry=0x7fffffffb9b8, pn=pn@entry=0x7ffff69f40e0, emitLineNote=emitLineNote@entry=js::frontend::BytecodeEmitter::EMIT_LINENOTE) at js/src/frontend/BytecodeEmitter.cpp:9349
#2  0x0000000000d59917 in js::frontend::BytecodeEmitter::emitStatement (this=this@entry=0x7fffffffb9b8, pn=pn@entry=0x7ffff69f4110) at js/src/frontend/BytecodeEmitter.cpp:7656
#3  0x0000000000d4f8a4 in js::frontend::BytecodeEmitter::emitTree (this=this@entry=0x7fffffffb9b8, pn=pn@entry=0x7ffff69f4110, emitLineNote=emitLineNote@entry=js::frontend::BytecodeEmitter::EMIT_LINENOTE) at js/src/frontend/BytecodeEmitter.cpp:9359
#4  0x0000000000d597de in js::frontend::BytecodeEmitter::emitStatementList (this=0x7fffffffb9b8, pn=<optimized out>) at js/src/frontend/BytecodeEmitter.cpp:7601
#5  0x0000000000d4f7ac in js::frontend::BytecodeEmitter::emitTree (this=this@entry=0x7fffffffb9b8, pn=pn@entry=0x7ffff69f4050, emitLineNote=emitLineNote@entry=js::frontend::BytecodeEmitter::EMIT_LINENOTE) at js/src/frontend/BytecodeEmitter.cpp:9354
#6  0x0000000000d55e99 in js::frontend::BytecodeEmitter::emitScript (this=0x7fffffffb9b8, body=body@entry=0x7ffff69f4050) at js/src/frontend/BytecodeEmitter.cpp:4189
#7  0x0000000000d5728b in BytecodeCompiler::compileModule (this=this@entry=0x7fffffffbe10) at js/src/frontend/BytecodeCompiler.cpp:414
#8  0x0000000000d577b4 in js::frontend::CompileModule (cx=cx@entry=0x7ffff695f000, optionsInput=..., srcBuf=..., alloc=..., sourceObjectOut=sourceObjectOut@entry=0x0) at js/src/frontend/BytecodeCompiler.cpp:603
#9  0x0000000000d57a5c in js::frontend::CompileModule (cx=cx@entry=0x7ffff695f000, options=..., srcBuf=...) at js/src/frontend/BytecodeCompiler.cpp:614
#10 0x00000000004545e9 in ParseModule (cx=cx@entry=0x7ffff695f000, argc=<optimized out>, vp=<optimized out>) at js/src/shell/js.cpp:3987
#11 0x0000000000b40ee9 in js::CallJSNative (cx=cx@entry=0x7ffff695f000, native=0x4542f0 <ParseModule(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:239
[...]
#24 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at js/src/shell/js.cpp:7928
rax	0x0	0
rbx	0x7fffffffb9b8	140737488337336
rcx	0x7ffff6c28a2d	140737333332525
rdx	0x0	0
rsi	0x7ffff6ef7770	140737336276848
rdi	0x7ffff6ef6540	140737336272192
rbp	0x7fffffffb450	140737488335952
rsp	0x7fffffffb430	140737488335920
r8	0x7ffff6ef7770	140737336276848
r9	0x7ffff7fe4740	140737354024768
r10	0x58	88
r11	0x7ffff6b9f750	140737332770640
r12	0x7ffff69f40e0	140737331020000
r13	0x7ffff69f40e0	140737331020000
r14	0x1	1
r15	0x98	152
rip	0xd59048 <js::frontend::BytecodeEmitter::emitYield(js::frontend::ParseNode*)+280>
=> 0xd59048 <js::frontend::BytecodeEmitter::emitYield(js::frontend::ParseNode*)+280>:	movl   $0x0,0x0
   0xd59053 <js::frontend::BytecodeEmitter::emitYield(js::frontend::ParseNode*)+291>:	ud2    

Marking as fuzzblocker because this keeps triggering with high frequency.

Comment 1

[Fuzzing Team]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/0f59ff767344
user:        Mariusz Kierski
date:        Sun Aug 28 23:58:29 2016 +0900
summary:     Bug 1185106 - Part 8.1: Treat await as keyword in module. r=efaust,till

This iteration took 255.811 seconds to run.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Since Mariusz and Eric might not be available, Till, is bug 1185106 a likely regressor?

Comment 3

[Tooru Fujisawa [:arai]]

Should be a dupe of bug 1314128.

Comment 4

[Julien Cristau [:jcristau]]

Updating 52 status since bug 1314128 was fixed a couple of weeks ago