1617168 - Assertion failure: isMemberExpression || isCallExpression (Unknown ParseNodeKind for OptionalChain), at frontend/BytecodeEmitter.cpp:7801

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 5f2e62175414+ (build with --disable-jemalloc --enable-address-sanitizer --enable-gczeal --enable-optimize="-O2 -g" --enable-fuzzing --enable-debug --without-intl-api, run with --fuzzing-safe):

delete[1]?.r[delete[1]?.r1]

Backtrace:

==20276==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55d616faeffd bp 0x7ffe775bcc70 sp 0x7ffe775bcac0 T0)
==20276==The signal is caused by a WRITE memory access.
==20276==Hint: address points to the zero page.
    #0 0x55d616faeffc in js::frontend::BytecodeEmitter::emitOptionalTree(js::frontend::ParseNode*, js::frontend::OptionalEmitter&, js::frontend::ValueUsage) js/src/frontend/BytecodeEmitter.cpp:7800:7
    #1 0x55d616fad74e in js::frontend::BytecodeEmitter::emitDeleteElementInOptChain(js::frontend::PropertyByValueBase*, js::frontend::OptionalEmitter&) js/src/frontend/BytecodeEmitter.cpp:6885:8
    #2 0x55d616facf7c in js::frontend::BytecodeEmitter::emitDeleteOptionalChain(js::frontend::UnaryNode*) js/src/frontend/BytecodeEmitter.cpp:6783:12
    #3 0x55d616f65457 in js::frontend::BytecodeEmitter::emitTree(js::frontend::ParseNode*, js::frontend::ValueUsage, js::frontend::BytecodeEmitter::EmitLineNumberNote, bool) js/src/frontend/BytecodeEmitter.cpp:10089:12
    #4 0x55d616faa339 in js::frontend::BytecodeEmitter::emitExpressionStatement(js::frontend::UnaryNode*) js/src/frontend/BytecodeEmitter.cpp:6608:10
    #5 0x55d616f66468 in js::frontend::BytecodeEmitter::emitTree(js::frontend::ParseNode*, js::frontend::ValueUsage, js::frontend::BytecodeEmitter::EmitLineNumberNote, bool) js/src/frontend/BytecodeEmitter.cpp:9933:12
    #6 0x55d616f6579e in js::frontend::BytecodeEmitter::emitStatementList(js::frontend::ListNode*) js/src/frontend/BytecodeEmitter.cpp:6552:10
    #7 0x55d616f6579e in js::frontend::BytecodeEmitter::emitTree(js::frontend::ParseNode*, js::frontend::ValueUsage, js::frontend::BytecodeEmitter::EmitLineNumberNote, bool) js/src/frontend/BytecodeEmitter.cpp:9924:12
    #8 0x55d616f73f4c in js::frontend::BytecodeEmitter::emitScript(js::frontend::ParseNode*) js/src/frontend/BytecodeEmitter.cpp:2461:10
    #9 0x55d616ffdfdc in js::frontend::ScriptCompiler<mozilla::Utf8Unit>::compileScript(js::frontend::CompilationInfo&, JS::Handle<JSObject*>, js::frontend::SharedContext*) js/src/frontend/BytecodeCompiler.cpp:512:21
    #10 0x55d616f31dbf in JSScript* CreateGlobalScript<mozilla::Utf8Unit>(js::frontend::CompilationInfo&, js::frontend::GlobalSharedContext&, JS::SourceText<mozilla::Utf8Unit>&) js/src/frontend/BytecodeCompiler.cpp:204:17
    #11 0x55d616f31dbf in js::frontend::CompileGlobalScript(js::frontend::CompilationInfo&, js::frontend::GlobalSharedContext&, JS::SourceText<mozilla::Utf8Unit>&) js/src/frontend/BytecodeCompiler.cpp:223:10
    #12 0x55d6159febc7 in JSScript* CompileSourceBuffer<mozilla::Utf8Unit>(JSContext*, JS::ReadOnlyCompileOptions const&, JS::SourceText<mozilla::Utf8Unit>&) js/src/vm/CompilationAndEvaluation.cpp:78:10
    #13 0x55d6159ff975 in JS::CompileUtf8FileDontInflate(JSContext*, JS::ReadOnlyCompileOptions const&, _IO_FILE*) js/src/vm/CompilationAndEvaluation.cpp:150:10
    #14 0x55d615316e4e in RunFile(JSContext*, char const*, _IO_FILE*, CompileUtf8, bool) js/src/shell/js.cpp:887:16
    #15 0x55d615314b13 in Process(JSContext*, char const*, bool, FileKind) js/src/shell/js.cpp:1529:14
    #16 0x55d615285084 in ProcessArgs(JSContext*, js::cli::OptionParser*) js/src/shell/js.cpp:10085:10
    #17 0x55d615285084 in Shell(JSContext*, js::cli::OptionParser*, char**) js/src/shell/js.cpp:10697:10
    #18 0x55d61527145e in main js/src/shell/js.cpp:11381:12
    #19 0x7f51c52a2b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    #20 0x55d6151b1029 in _start (js/src/debug64asan/dist/bin/js+0x2185029)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV js/src/frontend/BytecodeEmitter.cpp:7800:7 in js::frontend::BytecodeEmitter::emitOptionalTree(js::frontend::ParseNode*, js::frontend::OptionalEmitter&, js::frontend::ValueUsage)
==20276==ABORTING

This was found by libFuzzer \o/

Comment 1

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 2

[Steven DeTar [:sdetar]]

Jason, does this make sense for Yulia to look at? It seems it could be Optional Chaining related.

Comment 3

[Yulia Startsev [:yulia] OOO until July 2026]

Attachment: Bug 1617168 - handle DeleteOptionalChainExpr and OptionalExpr in emitOptionalTree; r=jorendorff

Comment 4

[Jens Stutte [:jstutte]]

Can someone else take care of the patch/review since Yulia is on PTO?

Comment 5

[Jan de Mooij [:jandem]]

(In reply to Jens Stutte [:jstutte] from comment #4)

Can someone else take care of the patch/review since Yulia is on PTO?

Hey Jens, I see you're the FF 75 REO. This is a corner case that affects only debug builds, so it doesn't affect actual browser builds in any way. I'll set the status to unaffected to hide it from release tracking dashboards.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1b366cf1e157
handle DeleteOptionalChainExpr and OptionalExpr in emitOptionalTree; r=jorendorff

Comment 7

[Bogdan Tara[:bogdan_tara | bogdant]]

Backed out changeset 1b366cf1e157 (Bug 1617168) for bustages complaining about optional-chain.js

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=success%2Ctestfailed%2Cbusted%2Cexception&classifiedState=unclassified&fromchange=fb90c9d681983e815377955166855f659b510005&searchStr=spidermonkey%2Cbuilds&tochange=956f705663758405f2c027b1f3dba82f60f90589&selectedJob=293294756

Backout link: https://hg.mozilla.org/integration/autoland/rev/cce6671e42ecb21ea0029ee0d2adaeaa83083e07

Failure log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=293294756&repo=autoland&lineNumber=254751

...
[task 2020-03-16T10:15:45.669Z] TEST-PASS | non262/expressions/optional-chain-super-elem.js | (args: "--dll /builds/worker/workspace/breakpad-tools/libbreakpadinjector.so --baseline-eager") [0.1 s]
[task 2020-03-16T10:15:45.669Z] TEST-PASS | non262/expressions/optional-chain-super-elem.js | (args: "--dll /builds/worker/workspace/breakpad-tools/libbreakpadinjector.so --no-blinterp --no-baseline --no-ion --more-compartments") [0.1 s]
[task 2020-03-16T10:15:45.669Z] TEST-PASS | non262/expressions/optional-chain.js | (args: "--dll /builds/worker/workspace/breakpad-tools/libbreakpadinjector.so") [0.1 s]
[task 2020-03-16T10:15:45.669Z] ## non262/expressions/optional-chain.js: rc = 3, run time = 0.072253
[task 2020-03-16T10:15:45.669Z] 1566143: Implement the Optional Chain operator (?.) proposal
[task 2020-03-16T10:15:45.669Z] /builds/worker/workspace/build/src/js/src/tests/non262/expressions/optional-chain.js:49:15 Error: TypeError has wrong message!, expected can't access property "undefined", [...].r is undefined but got can't access property "undefined" of undefined
[task 2020-03-16T10:15:45.669Z] Stack:
[task 2020-03-16T10:15:45.669Z]   shouldThrowTypeError@/builds/worker/workspace/build/src/js/src/tests/non262/expressions/optional-chain.js:49:15
[task 2020-03-16T10:15:45.669Z]   @/builds/worker/workspace/build/src/js/src/tests/non262/expressions/optional-chain.js:223:21
[task 2020-03-16T10:15:45.669Z] TEST-UNEXPECTED-FAIL | non262/expressions/optional-chain.js | (args: "--dll /builds/worker/workspace/breakpad-tools/libbreakpadinjector.so --ion-eager --ion-offthread-compile=off --more-compartments") [0.1 s]
[task 2020-03-16T10:15:45.669Z] ## non262/expressions/optional-chain.js: rc = 3, run time = 0.062321
[task 2020-03-16T10:15:45.669Z] 1566143: Implement the Optional Chain operator (?.) proposal
[task 2020-03-16T10:15:45.669Z] /builds/worker/workspace/build/src/js/src/tests/non262/expressions/optional-chain.js:49:15 Error: TypeError has wrong message!, expected can't access property "undefined", [...].r is undefined but got can't access property "undefined" of undefined
[task 2020-03-16T10:15:45.669Z] Stack:
[task 2020-03-16T10:15:45.670Z]   shouldThrowTypeError@/builds/worker/workspace/build/src/js/src/tests/non262/expressions/optional-chain.js:49:15
[task 2020-03-16T10:15:45.670Z]   @/builds/worker/workspace/build/src/js/src/tests/non262/expressions/optional-chain.js:223:21
[task 2020-03-16T10:15:45.670Z] TEST-UNEXPECTED-FAIL | non262/expressions/optional-chain.js | (args: "--dll /builds/worker/workspace/breakpad-tools/libbreakpadinjector.so --baseline-eager") [0.1 s]
[task 2020-03-16T10:15:45.670Z] TEST-PASS | non262/expressions/optional-chain.js | (args: "--dll /builds/worker/workspace/breakpad-tools/libbreakpadinjector.so --no-blinterp --no-baseline --no-ion --more-compartments") [0.1 s]
[task 2020-03-16T10:15:45.670Z] TEST-PASS | non262/expressions/primitive-this-boxing-behavior.js | (args: "--dll /builds/worker/workspace/breakpad-tools/libbreakpadinjector.so") [0.0 s]
[task 2020-03-16T10:15:45.749Z] TEST-PASS | non262/expressions/primitive-this-boxing-behavior.js | (args: "--dll /builds/worker/workspace/breakpad-tools/libbreakpadinjector.so --ion-eager --ion-offthread-compile=off --more-compartments") [0.1 s]
[task 2020-03-16T10:15:45.750Z] TEST-PASS | non262/expressions/primitive-this-boxing-behavior.js | (args: "--dll /builds/worker/workspace/breakpad-tools/libbreakpadinjector.so --baseline-eager") [0.1 s]
[task 2020-03-16T10:15:45.750Z] TEST-PASS | non262/expressions/primitive-this-boxing-behavior.js | (args: "--dll /builds/worker/workspace/breakpad-tools/libbreakpadinjector.so --no-blinterp --no-baseline --no-ion --more-compartments") [0.1 s]
...

Comment 8

[Jan de Mooij [:jandem]]

https://phabricator.services.mozilla.com/D66977 fixes the test failures for me.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/03ace54e7250
handle DeleteOptionalChainExpr and OptionalExpr in emitOptionalTree; r=jorendorff

Comment 10

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/03ace54e7250