862228 - Crash [@ JSFlatString::isIndex] or [@ js::frontend::Parser] or Assertion failure: JSString::isLinear(), at vm/String.h or Assertion failure: !isIndex(&dummy), at vm/String.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

({"":y=""}=

crashes js debug shell on m-c changeset 1d9c510b3742 without any CLI arguments at JSFlatString::isIndex with js::frontend::Parser on the stack.

Fuzzblocker since this just broke the fuzzers.

Tested on a 32-bit non-deterministic non-threadsafe build.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   128791:bd17606091d2
parent:      128764:53c2e7b9753b
user:        Brian Hackett
date:        Mon Apr 15 06:02:16 2013 -0600
summary:     Bug 845596 - Keep track of free variables during syntax parsing, r=jorendorff.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack for assertion

({x:/x/}=

Assertion failure: JSString::isLinear(), at vm/String.h

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

({y:"7"}=

Assertion failure: !isIndex(&dummy), at vm/String.h

Comment 3

[Brian Hackett [Laid off!]]

Attachment: patch

One of the name roots added was derived from a node that might not always be a property name.

Comment 4

[Brian Hackett [Laid off!]]

Since this seems to be affecting the fuzzers a lot and the fix is trivial, pushing to inbound pending review:

https://hg.mozilla.org/integration/mozilla-inbound/rev/1347f8fd9726

Comment 5

[Jason Orendorff [:jorendorff]]

Comment on attachment 737904 [details] [diff] [review]
patch

Review of attachment 737904 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit-test/tests/basic/bug862228.js
@@ +1,1 @@
> +// |jit-test| error: ReferenceError

Shouldn't it be a SyntaxError?

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> Shouldn't it be a SyntaxError?

I checked with older builds and they seem to show the following error with the testcases:

ReferenceError: invalid assignment left-hand side

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/1347f8fd9726