484769 - "Assertion failure: pn->pn_type != TOK_DEFSHARP, at ../jsemit.cpp:3575"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

[] = [, #1=x]

Assertion failure: pn->pn_type != TOK_DEFSHARP, at ../jsemit.cpp:3575

(Debug js shell, without -j, feed it in via a file, i.e. ./js file.js to reproduce)

Assigning to Igor as requested. The last Sharp-related assertion just fixed is bug 369696, which is [sg:critical?], so keeping this security-sensitive just-in-case.

Comment 1

[Igor Bukanov]

The assert comes from the bug 368213 and is supposed to ensure that EmitGroupAssignment is not called when the array literal has a sharp variable definition. For that the assert checks that none of children nodes for the array is a DEFSHARP parse node.

But this is not the right assert. The sharp definition for the array is signaled just by the first element of the children list, the rest of sharps are unrelated.

The bottom line: the assert should be fixed and there is no consequences of its violation for non-debug code.

Comment 2

[Igor Bukanov]

The incorrect assert was introduced in the bug 368213.

Comment 3

[Igor Bukanov]

Attachment: v1

The fix checks that any TOK_SHARPDEF node among array elements has a kid and, as such, is unrelated to the array itself.

Comment 4

[Brendan Eich [:brendan]]

Comment on attachment 369262 [details] [diff] [review]
v1

D'oh! Thanks,

/be

Comment 5

[Igor Bukanov]

landed to TM - http://hg.mozilla.org/tracemonkey/rev/b893df7318c5

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/b893df7318c5

Comment 7

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/4a26207507e6

Comment 8

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Verified fixed with testcase given in comment 0 on trunk and 1.9.1 with the
following debug builds:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre)
Gecko/20090422 Minefield/3.6a1pre ID:20090422224452

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4pre)
Gecko/20090422 Shiretoko/3.5b4pre ID:20090422122043