1528057 - Assertion failure: name.isString() || name.isSymbol() || name.isNumber(), at js/src/vm/JSFunction.cpp:2479 with async class

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision f0ea53f47215 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --disable-profiling --enable-debug --enable-optimize, run with --fuzzing-safe --ion-offthread-compile=off --ion-offthread-compile=off):

class X {
    async ["foo"]() {
        return [eval("x")];
    }
};

Backtrace:

received signal SIGSEGV, Segmentation fault.
js::SetFunctionName (cx=<optimized out>, fun=..., name=..., prefixKind=FunctionPrefixKind::None) at js/src/vm/JSFunction.cpp:2479
#0  js::SetFunctionName (cx=<optimized out>, fun=..., name=..., prefixKind=FunctionPrefixKind::None) at js/src/vm/JSFunction.cpp:2479
#1  0x00005555558deef8 in Interpret (cx=0x7ffff5f17000, state=...) at js/src/vm/Interpreter.cpp:3660

[...]
#11 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at js/src/shell/js.cpp:10973
rax 0x555557c1f280 93825032909440
rbx 0xe5b14001 3853598721
rcx 0x555556b52660 93825015293536
rdx 0x0 0
rsi 0x7ffff6eeb770 140737336227696
rdi 0x7ffff6eea540 140737336223040
rbp 0x7fffffffc880 140737488341120
rsp 0x7fffffffc840 140737488341056
r8 0x7ffff6eeb770 140737336227696
r9 0x7ffff7fe6cc0 140737354034368
r10 0x58 88
r11 0x7ffff6b927a0 140737332717472
r12 0x7fffffffcbd0 140737488341968
r13 0x7fffffffcad0 140737488341712
r14 0x0 0
r15 0x7fffffffcd70 140737488342384
rip 0x555555b4743f <js::SetFunctionName(JSContext*, JS::Handle<JSFunction*>, JS::Handle<JS::Value>, FunctionPrefixKind)+879>
=> 0x555555b4743f <js::SetFunctionName(JSContext*, JS::Handle<JSFunction*>, JS::Handle<JS::Value>, FunctionPrefixKind)+879>: movl $0x0,0x0
0x555555b4744a <js::SetFunctionName(JSContext*, JS::Handle<JSFunction*>, JS::Handle<JS::Value>, FunctionPrefixKind)+890>: ud2

Marking s-s to be safe because the assertion indicates a potential type confusion.

Comment 1

[Tooru Fujisawa [:arai]]

Patch is ready.
will post after some more test.

Comment 2

[Tooru Fujisawa [:arai]]

regression from bug 1523791.

bug 1473796 patch needs to be rebased onto them (and hopefully it could simplify the handling).

Comment 3

[Tooru Fujisawa [:arai]]

Attachment: Bug 1528057 - Set async method name properly. r?jorendorff

Comment 4

[Tooru Fujisawa [:arai]]

given this is recent nightly-only issue, I'll land without sec-approval.

Comment 5

[Julien Cristau [:jcristau]]

https://hg.mozilla.org/mozilla-central/rev/64eed6f2cc17

Comment 6

[Fuzzing Team]

JSBugMon: This bug has been automatically verified fixed.

Comment 7

[Christian Holler (:decoder)]

Talked to :arai and confirmed this is not s-s.