1934367 - Assertion failure: state_ == State::Iteration, at frontend/UsingEmitter.cpp:1080

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20241129-1d6f0bc3f416 (debug build, run with --fuzzing-safe --ion-offthread-compile=off --enable-explicit-resource-management test.js):

for (using a of b)
    for (c of []);

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x5ec7abb6 in js::frontend::ForOfDisposalEmitter::emitEnd() ()
#1  0x5ebbff72 in js::frontend::ForOfLoopControl::emitEndCodeNeedingIteratorClose(js::frontend::BytecodeEmitter*) ()
#2  0x5ebbfcd3 in js::frontend::ForOfEmitter::emitEnd(unsigned int) ()
#3  0x5eb943f9 in js::frontend::BytecodeEmitter::emitForOf(js::frontend::ForNode*, js::frontend::EmitterScope const*) ()
#4  0x5eb923d7 in js::frontend::BytecodeEmitter::emitLexicalScope(js::frontend::LexicalScopeNode*) ()
#5  0x5eb8141e in js::frontend::BytecodeEmitter::emitTree(js::frontend::ParseNode*, js::frontend::ValueUsage, js::frontend::BytecodeEmitter::EmitLineNumberNote) ()
#6  0x5eb97dfb in js::frontend::BytecodeEmitter::emitStatementList(js::frontend::ListNode*) ()
#7  0x5eb81286 in js::frontend::BytecodeEmitter::emitTree(js::frontend::ParseNode*, js::frontend::ValueUsage, js::frontend::BytecodeEmitter::EmitLineNumberNote) ()
#8  0x5eb84efd in js::frontend::BytecodeEmitter::emitScript(js::frontend::ParseNode*) ()
#9  0x5ebae624 in ScriptCompiler<mozilla::Utf8Unit>::compile(JSContext*, js::frontend::SharedContext*) ()
#10 0x5ebadfb9 in bool CompileGlobalScriptToStencilAndMaybeInstantiate<mozilla::Utf8Unit>(JSContext*, js::FrontendContext*, js::LifoAlloc&, js::frontend::CompilationInput&, js::frontend::ScopeBindingCache*, JS::SourceText<mozilla::Utf8Unit>&, js::ScopeKind, mozilla::Vector<js::frontend::ExtraBindingInfo, 0u, js::SystemAllocPolicy>*, mozilla::Variant<RefPtr<js::frontend::CompilationStencil>, js::frontend::CompilationGCOutput*>&) ()
#11 0x5eb73188 in js::frontend::CompileGlobalScript(JSContext*, js::FrontendContext*, JS::ReadOnlyCompileOptions const&, JS::SourceText<mozilla::Utf8Unit>&, js::ScopeKind) ()
#12 0x5e4fd7c8 in JSScript* CompileSourceBuffer<mozilla::Utf8Unit>(JSContext*, JS::ReadOnlyCompileOptions const&, JS::SourceText<mozilla::Utf8Unit>&) ()
#13 0x5e4fdddc in JS::CompileUtf8File(JSContext*, JS::ReadOnlyCompileOptions const&, _IO_FILE*) ()
#14 0x5e27f89a in RunFile(JSContext*, char const*, _IO_FILE*, CompileUtf8, bool, bool) ()
#15 0x5e27eef5 in Process(JSContext*, char const*, bool, FileKind) ()
#16 0x5e219c62 in Shell(JSContext*, js::cli::OptionParser*) ()
#17 0x5e21040a in main ()
eax	0x5cc38933	1556318515
ebx	0x5fc45d3c	1606704444
ecx	0x5fc4bc7c	1606728828
edx	0xe998c9a8	-375862872
esi	0xffc10e34	-4125132
edi	0xffc10c90	-4125552
ebp	0xffc10b78	4290841464
esp	0xffc10b50	4290841424
eip	0x5ec7abb6 <js::frontend::ForOfDisposalEmitter::emitEnd()+294>
=> 0x5ec7abb6 <_ZN2js8frontend20ForOfDisposalEmitter7emitEndEv+294>:	movl   $0x438,0x0
   0x5ec7abc0 <_ZN2js8frontend20ForOfDisposalEmitter7emitEndEv+304>:	call   0x5e2a4df0 <abort>

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20241201095257-4df19decbcec.
The bug appears to have been introduced in the following build range:

Start: c1acf137ed794e8b553c1f40512d21090d1a9b7c (20241114072145)
End: e299ddd844812c1cd97440fd74eb94e0736fbbe9 (20241114100954)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=c1acf137ed794e8b553c1f40512d21090d1a9b7c&tochange=e299ddd844812c1cd97440fd74eb94e0736fbbe9

Comment 4

[Iain Ireland [:iain]]

This is another explicit resource management bug. Debadree, please take a look at this one too.

Comment 5

[Debadree Chatterjee]

on it aswell!

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1927195

Comment 7

[Debadree Chatterjee]

Attachment: Bug 1934367 - Move ForOfDisposalEmitter allocation into ForOfLoopControl. r?arai

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b38314ae3fa4
Move ForOfDisposalEmitter allocation into ForOfLoopControl. r=arai

Comment 9

[pstanciu]

https://hg.mozilla.org/mozilla-central/rev/b38314ae3fa4

Comment 10

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20241210093052-b16c09f16ef5.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.