Closed Bug 1593415 Opened 4 months ago Closed 4 months ago

Assertion failure: false, at js/src/builtin/ReflectParse.cpp:3092 with nullish coalescing

Categories

(Core :: JavaScript Engine, defect, P1, critical)

x86_64
Linux
defect

Tracking

()

RESOLVED FIXED
mozilla72
Tracking Status
firefox-esr68 --- unaffected
firefox70 --- unaffected
firefox71 --- unaffected
firefox72 --- fixed

People

(Reporter: gkw, Assigned: yulia)

References

(Blocks 2 open bugs, Regression)

Details

(4 keywords, Whiteboard: [jsbugmon:update])

Attachments

(3 files)

The following testcase crashes on mozilla-central revision 518df4329a20 (build with --enable-debug --disable-optimize, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

// Adapted from randomly chosen test: js/src/tests/test262/language/expressions/coalesce/short-circuit-number-string.js
Reflect.parse("x ?? x");

Backtrace:

#0  0x0000555be8d09e53 in (anonymous namespace)::ASTSerializer::expression (this=0x7fff44862a10, pn=0x7f440431a0c0, dst=...) at js/src/builtin/ReflectParse.cpp:3092
#1  0x0000555be8d01fdc in (anonymous namespace)::ASTSerializer::statement (this=0x7fff44862a10, pn=0x7f440431a100, dst=...) at js/src/builtin/ReflectParse.cpp:2281
#2  0x0000555be8d01c6a in (anonymous namespace)::ASTSerializer::sourceElement (this=0x7fff44862a10, pn=0x7f440431a100, dst=...) at js/src/builtin/ReflectParse.cpp:1896
#3  0x0000555be8d01add in (anonymous namespace)::ASTSerializer::statements (this=0x7fff44862a10, stmtList=0x7f440431a020, elts=...) at js/src/builtin/ReflectParse.cpp:1846
#4  0x0000555be8d00f8b in (anonymous namespace)::ASTSerializer::program (this=0x7fff44862a10, node=0x7f440431a020, dst=...) at js/src/builtin/ReflectParse.cpp:1891
#5  0x0000555be8cdcd40 in reflect_parse (cx=0x7f4404527000, argc=1, vp=0x7f44042fd0a0) at js/src/builtin/ReflectParse.cpp:3692
/snip

For detailed crash information, see attachment.

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/28aa763e7834
user: yulia
date: Thu Oct 31 17:16:31 2019 +0000
summary: Bug 1566141 - Nullish coalesce operator tokens r=jorendorff

Yulia, is bug 1566141 a likely regressor?

Flags: needinfo?(ystartsev)
Regressed by: 1566141
Summary: Assertion failure: false, at js/src/builtin/ReflectParse.cpp:3092 → Assertion failure: false, at js/src/builtin/ReflectParse.cpp:3092 with nullish coalescing

Yes, bug 1566141 is the regressor here, thanks for the catch.

Flags: needinfo?(ystartsev)
Priority: -- → P1
Pushed by ystartsev@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/f004d41231db
fix reflection for nullish coalescing; r=jorendorff
Status: NEW → RESOLVED
Closed: 4 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla72
Assignee: nobody → ystartsev

Can we land a test for this?

Flags: needinfo?(ystartsev)
Flags: in-testsuite?

I am at a conference this week but i will look into that once I am back.

I added a patch with the test.

Flags: needinfo?(ystartsev)
Pushed by ystartsev@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/b35b1431e4e2
add test and refine reflection for nullish coalescing r=jorendorff
You need to log in before you can comment on or make changes to this bug.