842884 - "Assertion failure: 0,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

var [] = [x, ...d]

asserts js debug shell on m-c changeset 401b967b2dfc without any CLI arguments at Assertion failure: 0,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   96029:34476c720f8f
user:        Benjamin Peterson
date:        Wed Jun 06 21:53:07 2012 -0500
summary:     Bug 574130: JavaScript spread array initializers, r=jorendorff.

Comment 1

[:Benjamin Peterson]

Attachment: don't assign optimize arrays with spread

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Assigning to Benjamin since he has a patch.

Comment 3

[Jason Orendorff [:jorendorff]]

Comment on attachment 715829 [details] [diff] [review]
don't assign optimize arrays with spread

Review of attachment 715829 [details] [diff] [review]:
-----------------------------------------------------------------

Nice.

Comment 4

[:Benjamin Peterson]

https://hg.mozilla.org/integration/mozilla-inbound/rev/534b246aa51b

Comment 5

[:Benjamin Peterson]

Comment on attachment 715829 [details] [diff] [review]
don't assign optimize arrays with spread

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Bug 574130
User impact if declined: The bug causes us to take "unreachable" paths in the JS compiler just through weird JS syntax. It would probably be hard to exploit, but I wouldn't be surprised if malformed bytecode caused horrible memory corruption bugs in the interpreter.
Testing completed (on m-c, etc.): On m-i now
Risk to taking this patch (and alternatives if risky): Very straightforward, safe patch.
String or UUID changes made by this patch: N/A

Comment 6

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 702d2814efbf).

Comment 7

[:Benjamin Peterson]

Fixed just not resolved yet.

Comment 8

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 702d2814efbf).

Comment 9

[Christian Holler (:decoder)]

Don't fight with the automation! ;) It's perfectly ok if the bug isn't resolved yet. JSBugMon is just indicating that the test doesn't reproduce anymore.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/534b246aa51b

Comment 11

[Alex Keybl [:akeybl]]

Comment on attachment 715829 [details] [diff] [review]
don't assign optimize arrays with spread

Given the very low risk evaluation, how early we are in the beta cycle, and the fact that we've been seeing memory corruption issues in Firefox recently, approving for aurora/beta.

Comment 12

[:Benjamin Peterson]

https://hg.mozilla.org/releases/mozilla-aurora/rev/ff02d442b93f
https://hg.mozilla.org/releases/mozilla-beta/rev/2b3c9a266df0