1502476 - Assertion failure: false (MOZ_ASSERT_UNREACHABLE: this token was previously looked up with a different modifier, potentially making tokenization non-deterministic), at js/src/frontend/TokenStream.h:557

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 28a4562cb517 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

// Adapted from randomly chosen test: js/src/tests/test262/language/statements/class/fields-arrow-fnc-init-err-contains-super.js
class C {
    x = () =>
}

Backtrace:

#0  0x000055f6415ef08e in js::frontend::TokenStreamShared::verifyConsistentModifier (modifier=<optimized out>, lookaheadToken=...) at js/src/frontend/TokenStream.h:555
#1  js::frontend::TokenStreamSpecific<char16_t, js::frontend::ParserAnyCharsAccess<js::frontend::GeneralParser<js::frontend::FullParseHandler, char16_t> > >::getToken (this=<optimized out>, ttp=<optimized out>, modifier=<optimized out>) at js/src/frontend/TokenStream.h:2531
#2  0x000055f6415f5fae in js::frontend::GeneralParser<js::frontend::FullParseHandler, char16_t>::classDefinition (this=0x7ffddab4ae48, yieldHandling=js::frontend::YieldIsName, classContext=js::frontend::GeneralParser<js::frontend::FullParseHandler, char16_t>::ClassStatement, defaultHandling=<optimized out>) at js/src/frontend/Parser.cpp:8091
#3  0x000055f6415f0fb4 in js::frontend::GeneralParser<js::frontend::FullParseHandler, char16_t>::statementListItem (this=0x7ffddab4ae48, yieldHandling=js::frontend::YieldIsName, canHaveDirectives=true) at js/src/frontend/Parser.cpp:8678
#4  0x000055f6415eed90 in js::frontend::GeneralParser<js::frontend::FullParseHandler, char16_t>::statementList (this=0x7ffddab4ae48, yieldHandling=js::frontend::YieldIsName) at js/src/frontend/Parser.cpp:4655
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/d0b577458d53
user:        Ashley Hauck
date:        Thu Oct 25 18:25:34 2018 +0000
summary:     Bug 1499448 - Implement syntax for public and private fields. r=jorendorff

Ashley, is bug 1499448 a likely regressor?

Comment 3

[Ashley Hauck [:khyperia]]

Looks very related, yep. Looking into it now.

Comment 4

[Ashley Hauck [:khyperia]]

Attachment: Bug 1502476 - Handle failure when parsing field initializer.

Comment 5

[Natalia Csoregi [:nataliaCs]]

Land: https://hg.mozilla.org/integration/autoland/rev/d97efe78674d5ab756cde7dca20019de7db00643

Comment 6

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/d97efe78674d