1593415 - Assertion failure: false, at js/src/builtin/ReflectParse.cpp:3092 with nullish coalescing

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 518df4329a20 (build with --enable-debug --disable-optimize, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

// Adapted from randomly chosen test: js/src/tests/test262/language/expressions/coalesce/short-circuit-number-string.js
Reflect.parse("x ?? x");

Backtrace:

#0  0x0000555be8d09e53 in (anonymous namespace)::ASTSerializer::expression (this=0x7fff44862a10, pn=0x7f440431a0c0, dst=...) at js/src/builtin/ReflectParse.cpp:3092
#1  0x0000555be8d01fdc in (anonymous namespace)::ASTSerializer::statement (this=0x7fff44862a10, pn=0x7f440431a100, dst=...) at js/src/builtin/ReflectParse.cpp:2281
#2  0x0000555be8d01c6a in (anonymous namespace)::ASTSerializer::sourceElement (this=0x7fff44862a10, pn=0x7f440431a100, dst=...) at js/src/builtin/ReflectParse.cpp:1896
#3  0x0000555be8d01add in (anonymous namespace)::ASTSerializer::statements (this=0x7fff44862a10, stmtList=0x7f440431a020, elts=...) at js/src/builtin/ReflectParse.cpp:1846
#4  0x0000555be8d00f8b in (anonymous namespace)::ASTSerializer::program (this=0x7fff44862a10, node=0x7f440431a020, dst=...) at js/src/builtin/ReflectParse.cpp:1891
#5  0x0000555be8cdcd40 in reflect_parse (cx=0x7f4404527000, argc=1, vp=0x7f44042fd0a0) at js/src/builtin/ReflectParse.cpp:3692
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/28aa763e7834
user: yulia
date: Thu Oct 31 17:16:31 2019 +0000
summary: Bug 1566141 - Nullish coalesce operator tokens r=jorendorff

Yulia, is bug 1566141 a likely regressor?

Comment 3

[Yulia Startsev [:yulia]]

Yes, bug 1566141 is the regressor here, thanks for the catch.

Comment 4

[Yulia Startsev [:yulia]]

Attachment: Bug 1593415 - fix reflection for nullish coalescing; r=jorendorff

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f004d41231db
fix reflection for nullish coalescing; r=jorendorff

Comment 6

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/f004d41231db

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Can we land a test for this?

Comment 8

[Yulia Startsev [:yulia]]

I am at a conference this week but i will look into that once I am back.

Comment 9

[Yulia Startsev [:yulia]]

Attachment: Bug 1593415 - add test and refine reflection for nullish coalescing

Comment 10

[Yulia Startsev [:yulia]]

I added a patch with the test.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b35b1431e4e2
add test and refine reflection for nullish coalescing r=jorendorff

Comment 12

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/b35b1431e4e2