434906 - [1.8 branch] Crash [@ js_Interpret] or [@ js_FindProperty]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack trace 1

for (x = 0; x < 3; ++x) let([] = []) (function(){});

crashes js 1.8 branch shell at js_FindProperty at null, and triggers the following assertion:

Assertion failure: OBJ_GET_CLASS(cx, obj)->flags & JSCLASS_HAS_PRIVATE, at jsapi.c:2293

===

A slight variation of that line,

for(let x in [0,0,0,0]) let([]=[]) (function(){});

crashes js 1.8 branch shell at js_Interpret at (almost) null and triggers the following assertion:

Assertion failure: op == JSOP_LEAVEBLOCKEXPR ? fp->spbase + OBJ_BLOCK_DEPTH(cx, obj) == sp - 1 : fp->spbase + OBJ_BLOCK_DEPTH(cx, obj) == sp, at jsinterp.c:5894

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack trace 2

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Jesse Ruderman helped to reduce the above testcases.

Not sure if I should nominate since they crash at null or almost null.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Now both testcases WORKSFORME. Resolving as appropriate.

Sample console output:

$ ./js-moz181-intelmac
js> for (x = 0; x < 3; ++x) let([] = []) (function(){});
typein:1: ReferenceError: let is not defined
js> for(let x in [0,0,0,0]) let([]=[]) (function(){});
typein:2: SyntaxError: missing ; after for-loop initializer:
typein:2: for(let x in [0,0,0,0]) let([]=[]) (function(){});
typein:2: ........^
js>