496682 - Crash [@ FindPropertyValue] or "Assertion failure: right->pn_arity != PN_LIST || !(right->pn_xflags & PNX_DESTRUCT), at ../jsparse.cpp"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

const{0:[]}=

crashes both opt and debug js shell on TM without -j at FindPropertyValue.

Probably because pn in pn->pn_type is null, so it's probably a null-dereference.

js> const{0:[]}=

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000000
0x000daab6 in FindPropertyValue (pn=0x0, pnid=0x811b20, data=0xbffff2bc) at ../jsparse.cpp:3560
3560        if (pn->pn_type != TOK_RC)
(gdb) bt
#0  0x000daab6 in FindPropertyValue (pn=0x0, pnid=0x811b20, data=0xbffff2bc) at ../jsparse.cpp:3560
#1  0x000db748 in UndominateInitializers (left=0x811af0, right=0x0) at ../jsparse.cpp:3844
#2  0x000ea947 in Variables (cx=0x30bc40, ts=0xbffff60c, tc=0xbffff548, inLetHead=false) at ../jsparse.cpp:5591
#3  0x000e5ab3 in Statement (cx=0x30bc40, ts=0xbffff60c, tc=0xbffff548) at ../jsparse.cpp:5222
#4  0x000e6832 in Statements (cx=0x30bc40, ts=0xbffff60c, tc=0xbffff548) at ../jsparse.cpp:2903
#5  0x000ec565 in JSCompiler::parse (this=0xbffff5ec, chain=0x2c0000) at ../jsparse.cpp:740
#6  0x00024547 in JS_BufferIsCompilableUnit (cx=0x30bc40, obj=0x2c0000, bytes=0x30d390 "const{0:[]}=", length=12) at ../jsapi.cpp:4742
#7  0x00008c91 in Process (cx=0x30bc40, obj=0x2c0000, filename=0x0, forceTTY=0) at ../../shell/js.cpp:436
#8  0x0000a202 in ProcessArgs (cx=0x30bc40, obj=0x2c0000, argv=0xbffff958, argc=0) at ../../shell/js.cpp:806
#9  0x0000b6ac in main (argc=0, argv=0xbffff958, envp=0xbffff95c) at ../../shell/js.cpp:4750
(gdb) frame 0
#0  0x000daab6 in FindPropertyValue (pn=0x0, pnid=0x811b20, data=0xbffff2bc) at ../jsparse.cpp:3560
3560        if (pn->pn_type != TOK_RC)
(gdb) l
3555                    JS_DHashTableOperate(&data->table, pnid, JS_DHASH_LOOKUP);
3556            return JS_DHASH_ENTRY_IS_BUSY(&entry->hdr) ? entry->pnval : NULL;
3557        }
3558
3559        /* If pn is not an object initialiser node, we can't do anything here. */
3560        if (pn->pn_type != TOK_RC)
3561            return NULL;
3562
3563        /*
3564         * We must search all the way through pn's list, to handle the case of an
(gdb) p pn
$1 = (JSParseNode *) 0x0
(gdb)

Comment 1

[Boris Zbarsky [:bzbarsky]]

Bisect sez this was introduced on t-m by changeset 2e6025415fb3:

  Fix destructuring binding to follow the cheezy dominance relation rules of the
  upvar analysis (496134, r=mrbkap).

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(Hurray to mid-airs)

autoBisect shows this is probably related to bug 496134 :

The first bad revision is:
changeset:   28945:2e6025415fb3
user:        Brendan Eich
date:        Fri Jun 05 16:14:00 2009 -0700
summary:     Fix destructuring binding to follow the cheezy dominance relation rules of the upvar analysis (496134, r=mrbkap).

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Proposed fix

Going to land this on t-m right now so Gary can fuzz more.

The curlies are there to make it clear that we do want to call UndominateInitializers(pn, rhs); even if !right.  I could add a comment to that effect instead of preferred.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

let {}={y:[],0}

This same bug _might_ also have caused this assertion:

Assertion failure: right->pn_arity != PN_LIST || !(right->pn_xflags & PNX_DESTRUCT), at ../jsparse.cpp:3811

(debug TM js shell without -j)

Though I haven't checked to be sure...

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #4)
> let {}={y:[],0}
> 
> This same bug _might_ also have caused this assertion:
> 
> Assertion failure: right->pn_arity != PN_LIST || !(right->pn_xflags &
> PNX_DESTRUCT), at ../jsparse.cpp:3811
> 
> (debug TM js shell without -j)
> 
> Though I haven't checked to be sure...

Just checked, and this assertion is indeed the same cause.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This bug has been fixed by the backout in bug 496134.

Comment 7

[Brendan Eich [:brendan]]

Comment on attachment 381903 [details] [diff] [review]
Proposed fix

Fixed by back-out, real fix is in bug 496134.

/be

Comment 8

[Brendan Eich [:brendan]]

See comment 6.

/be