1640487 - Crash with RegExp named capture groups, likely missing typeset information

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P1)

Description

[André Bargull [:anba]]

The following test case crashes when run with --ion-offthread-compile=off:

var re = /(?<x>a)|b/;

function f(j) {
    for (var i = 0; i <= 10_000; ++i) {
        var s = String.fromCharCode(0x61 + (i === 10_000 && j === 2));
        var e = re.exec(s);
        if (e.groups.x !== "a") print(i,j);
    }
}

for (var i = 0; i <= 2; ++i) print(f(i));

I suspect bad type-set information comes into play here.

Comment 1

[André Bargull [:anba]]

Adding AddTypePropertyId(cx, templateObject, id, UndefinedValue()); after NativeDefineDataProperty in RegExpShared::initializeNamedCaptures could be a likely fix.

Comment 2

[Iain Ireland [:iain]]

Good catch!

Comment 3

[Iain Ireland [:iain]]

Attachment: Bug 1640487: Fix initializedNamedCaptures r=tcampbell

Comment 4

[Iain Ireland [:iain]]

This bug was introduced when we added named captures in bug 1362154 and is only present in Nightly.

Comment 5

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/integration/autoland/rev/3c8d8a1bb961096c9f2e2e6a5642ce580b60e62b
https://hg.mozilla.org/mozilla-central/rev/3c8d8a1bb961

Comment 6

[Iain Ireland [:iain]]

Attachment: Bug 1640487: Add testcase r=tcampbell

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Add testcase:
https://hg.mozilla.org/integration/autoland/rev/457f22865596486f79d5f8bee6cc046569a422c3
https://hg.mozilla.org/mozilla-central/rev/457f22865596