2011802 - Assertion failure: input.options.lineno != 0 (Module cannot be compiled with lineNumber == 0), at frontend/BytecodeCompiler.cpp:1161

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug stack

Debugger().addDebuggee(newGlobal({ newCompartment: true }))["createSource"](
    function () {},
)["reparse"]("z");

(gdb) bt
#0  0x00005555577c9b9b in MOZ_CrashSequence (aAddress=0x0, aLine=1161)
    at /home/msf2/shell-cache/js-dbg-64-linux-x86_64-39adebd6b3ce-604771/objdir-js/dist/include/mozilla/Assertions.h:237
#1  ParseModuleToStencilAndMaybeInstantiate<char16_t> (maybeCx=maybeCx@entry=0x7ffff5e38200, fc=fc@entry=0x7fffffffc410, tempLifoAlloc=..., input=...,
    scopeCache=scopeCache@entry=0x7fffffffc218, srcBuf=..., output=...) at /home/msf2/trees/firefox/js/src/frontend/BytecodeCompiler.cpp:1160
#2  0x000055555779a2a8 in CompileModuleImpl<char16_t> (cx=0x7ffff5e38200, fc=0x7fffffffc410, optionsInput=..., srcBuf=...)
    at /home/msf2/trees/firefox/js/src/frontend/BytecodeCompiler.cpp:1316
#3  js::frontend::CompileModule (cx=cx@entry=0x7ffff5e38200, fc=fc@entry=0x7fffffffc410, options=..., srcBuf=...)
    at /home/msf2/trees/firefox/js/src/frontend/BytecodeCompiler.cpp:1329
#4  0x000055555868aad2 in CompileModuleHelper<char16_t> (cx=0x7ffff5e38200, options=..., srcBuf=...) at /home/msf2/trees/firefox/js/src/vm/Modules.cpp:217
#5  JS::CompileModule (cx=cx@entry=0x7ffff5e38200, options=..., srcBuf=...) at /home/msf2/trees/firefox/js/src/vm/Modules.cpp:225
/snip

e54ad129dfd2-603689
e54ad129dfd27009f11adcd7973e85345e7636ed is the first interesting commit
commit e54ad129dfd27009f11adcd7973e85345e7636ed
Author: Bryan Thrall
Date:   Wed Jan 14 21:52:47 2026 +0000

    Bug 1605686 - Reparse scripts as modules r=nchevobbe,devtools-reviewers,arai

    I merged Brian Hackett's original patch (D59955) with Alex's test improvements
    (D207243) and rebased ontocentral.

    Note that the original evaluated script in Source-parse.js is not using strict
    mode, so the test already demonstrated that reparsing non-strict mode succeeds.

    Differential Revision: https://phabricator.services.mozilla.com/D213690

Run with --fuzzing-safe --no-threads --no-baseline --no-ion, compile with AR=ar sh ~/trees/firefox/js/src/configure --enable-debug --enable-debug-symbols --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests, tested on gh rev 39adebd6b3cee38e86c853df0ab2b01322a37f97.

Bryan, is bug 1605686 a likely regressor?

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1605686

Comment 2

[Bryan Thrall [:bthrall]]

Yes, this is related to bug 1605686. A clearer test case is:

let g = newGlobal({ newCompartment: true });
Debugger().addDebuggee(g).createSource({}).reparse(true);

Basically, because the options object passed to createSource() doesn't have any source and doesn't set a line number, then reparsing as a module triggers the assertion.

This isn't a security risk; forbidding 0 as a line number is a convention that doesn't change behavior.

I'll draft a patch that throws an error when the line number is 0 instead of crashing (like bug 1848417 did).

Comment 3

[Bryan Thrall [:bthrall]]

Attachment: Bug 2011802 - Throw error if trying to reparse module with lineno == 0 r=arai

Line number > 0 is required for compiling modules so we can report useful
information in the errors (see bug 1362098).

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/91618b93c70f
https://hg.mozilla.org/integration/autoland/rev/c098abfaf39e
Throw error if trying to reparse module with lineno == 0 r=arai

Comment 5

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/c098abfaf39e