1657835 - Assertion failure: false, at js/src/builtin/ReflectParse.cpp:3168

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

Reflect.parse("\ndelete [] ?. [1]");

Compiled using GCC 9.3.0 and Clang 9 with:

AR=ar sh ./configure --enable-debug --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

Run with:

--fuzzing-safe --no-threads --no-baseline --no-ion

Tested on m-c rev d51942b1e2d8.

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/35b55a5b0e4d
user:        yulia
date:        Mon Jan 20 16:03:46 2020 +0000
summary:     Bug 1566143 - Update parser for optional chaining r=arai

Yulia, is bug 1566143 a likely regressor? I doubt this is s-s but setting it just-in-case.

Comment 1

[Yulia Startsev [:yulia]]

Attachment: Bug 1657835 - Update Reflect.parse to include Optional Element deletion; r=jorendorff

Comment 2

[Yulia Startsev [:yulia]]

It looks like this isn't security sensitive. It causes an error message in regular builds but shouldn't have any further reaching consequences than that. I think we can remove the s-s rating.

Comment 3

[Yulia Startsev [:yulia]]

ah, i think i can't change that field! :gkw can you update the security status of this bug?

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Yulia Startsev [:yulia] from comment #3)

ah, i think i can't change that field! :gkw can you update the security status of this bug?

Thanks Jan! Nope, I don't think I can, either, as I am now community.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1c4baf6c4aac
Update Reflect.parse to include Optional Element deletion; r=jorendorff

Comment 6

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/1c4baf6c4aac