The default bug view has changed. See this FAQ.

Crash [@ ExpressionDecompiler::findLetVar] or "Assertion failure: isObject(),"

VERIFIED FIXED in mozilla17

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Assigned: Benjamin)

Tracking

(Blocks: 1 bug, 4 keywords)

Trunk
mozilla17
assertion, crash, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 649918 [details]
stack

{
  let[[l]] = [[].watch(0, function() {})]
}

asserts js debug shell on m-c changeset 602c2e7ee0d2 without any CLI argument at Assertion failure: isObject(), and crashes opt shell at ExpressionDecompiler::findLetVar

This seems like a null crash.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   101243:7852a8f73313
user:        Benjamin Peterson
date:        Thu Aug 02 09:20:08 2012 -0700
summary:     Bug 767274: New expression decompiler. r=luke
(Assignee)

Comment 1

5 years ago
Created attachment 649934 [details] [diff] [review]
account for null enclosing scope
Assignee: general → bpeterson
Attachment #649934 - Flags: review?(luke)

Comment 2

5 years ago
Why doesn't findLetVar find the let var?  It seems like it should.  I see that the loop doesn't return if !JSID_IS_ATOM(shape.propid()), even though the property at the correct depth is found: perhaps that should return emptyAtom?  Regardless, I don't see empty destructuring let in the example, so there seems to be some other problem...
(Assignee)

Comment 3

5 years ago
Having some shape where !JSID_IS_ATOM(shape.propid()) is sufficient but not necessary condition to having a destructing temporary.

Updated

5 years ago
Attachment #649934 - Flags: review?(luke) → review+

Comment 4

5 years ago
(From IRL: GETLOCAL(i) where i > nfixed does not a let-variable-access make, sometimes we emit GETLOCAL to access expression temporaries who have no variable name.)
(Assignee)

Comment 5

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/abbb9f6d48dd
https://hg.mozilla.org/mozilla-central/rev/abbb9f6d48dd
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla17
(Reporter)

Comment 7

5 years ago
A test was landed into the testsuite. -> VERIFIED
Status: RESOLVED → VERIFIED
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.