Last Comment Bug 781071 - Crash [@ ExpressionDecompiler::findLetVar] or "Assertion failure: isObject(),"
: Crash [@ ExpressionDecompiler::findLetVar] or "Assertion failure: isObject(),"
: assertion, crash, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
-- critical (vote)
: mozilla17
Assigned To: :Benjamin Peterson
: general
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: jsfunfuzz 767274
  Show dependency treegraph
Reported: 2012-08-07 18:37 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2012-08-10 00:41 PDT (History)
4 users (show)
gary: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

stack (8.92 KB, text/plain)
2012-08-07 18:37 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
account for null enclosing scope (1.81 KB, patch)
2012-08-07 19:31 PDT, :Benjamin Peterson
luke: review+
Details | Diff | Splinter Review

Description User image Gary Kwong [:gkw] [:nth10sd] 2012-08-07 18:37:10 PDT
Created attachment 649918 [details]

  let[[l]] = [[].watch(0, function() {})]

asserts js debug shell on m-c changeset 602c2e7ee0d2 without any CLI argument at Assertion failure: isObject(), and crashes opt shell at ExpressionDecompiler::findLetVar

This seems like a null crash.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   101243:7852a8f73313
user:        Benjamin Peterson
date:        Thu Aug 02 09:20:08 2012 -0700
summary:     Bug 767274: New expression decompiler. r=luke
Comment 1 User image :Benjamin Peterson 2012-08-07 19:31:57 PDT
Created attachment 649934 [details] [diff] [review]
account for null enclosing scope
Comment 2 User image Luke Wagner [:luke] 2012-08-07 23:02:49 PDT
Why doesn't findLetVar find the let var?  It seems like it should.  I see that the loop doesn't return if !JSID_IS_ATOM(shape.propid()), even though the property at the correct depth is found: perhaps that should return emptyAtom?  Regardless, I don't see empty destructuring let in the example, so there seems to be some other problem...
Comment 3 User image :Benjamin Peterson 2012-08-08 09:28:07 PDT
Having some shape where !JSID_IS_ATOM(shape.propid()) is sufficient but not necessary condition to having a destructing temporary.
Comment 4 User image Luke Wagner [:luke] 2012-08-08 10:54:38 PDT
(From IRL: GETLOCAL(i) where i > nfixed does not a let-variable-access make, sometimes we emit GETLOCAL to access expression temporaries who have no variable name.)
Comment 6 User image Ryan VanderMeulen [:RyanVM] 2012-08-08 18:23:43 PDT
Comment 7 User image Gary Kwong [:gkw] [:nth10sd] 2012-08-10 00:41:27 PDT
A test was landed into the testsuite. -> VERIFIED

Note You need to log in before you can comment on or make changes to this bug.