1530084 - Crash [@ JSString::flags] with ES6 Classes

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 6924dd16f7b1 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

// Adapted from randomly chosen test: js/src/tests/test262/language/expressions/class/fields-init-value-defined-after-class.js
let z = class {
  [x] = 0;
}

Backtrace:

#0 JSString::flags (this=0x0) at js/src/vm/StringType.h:397
#1 JSString::isLinear (this=0x0) at js/src/vm/StringType.h:484
#2 JSString::isFlat (this=0x0) at js/src/vm/StringType.h:504
#3 JSFlatString::isIndex (this=0x0, indexp=<optimized out>) at js/src/vm/StringType.h:992
#4 JSAtom::asPropertyName (this=0x0) at js/src/vm/StringType.h:1876
#5 0x000055dee2b9eca1 in js::frontend::GeneralParser<js::frontend::FullParseHandler, char16_t>::fieldInitializer (this=0x7ffc52ebef70, yieldHandling=(unknown: 1484419736), propAtom=...) at js/src/frontend/Parser.cpp:7366
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/49fda807b7c5
user: Ashley Hauck
date: Thu Feb 21 23:48:16 2019 +0000
summary: Bug 1499448 - Implement more field functionality. r=jorendorff

Setting [fuzzblocker] as this is happening very often. Ashley, is bug 1499448 a likely regressor?

Comment 3

[Ashley Hauck [:khyperia]]

Attachment: Bug 1530084 - Don't crash on unsupported syntax when fields are disabled.

Comment 4

[Ashley Hauck [:khyperia]]

Ashley, is bug 1499448 a likely regressor?

Yeah, very likely. Just added a patch that should fix it (it's a very quick fix patch, not the proper fix, which would take much more time).

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/57f2a3550faf
Don't crash on unsupported syntax when fields are disabled. r=jorendorff

Comment 6

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/57f2a3550faf

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Can we land the testcase for this also?

Comment 8

[Ashley Hauck [:khyperia]]

Attachment: Bug 1530084 - Add testcase for unimplemented fields not crashing.

Comment 9

[Ashley Hauck [:khyperia]]

(Clearing needinfo due to patch above)

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/eb9d835ce817
Add testcase for unimplemented fields not crashing. r=jorendorff

Comment 12

[Oana Pop-Rus]

https://hg.mozilla.org/mozilla-central/rev/eb9d835ce817