867466 - Assertion failure: false (unexpected statement type), at jsreflect.cpp:2178 or Crash on Heap with invalid memory executed

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-aurora revision 4cf75b25cdc3 (run with --ion-eager):


var node = Reflect.parse("module 'foo' {}");

Comment 1

[Christian Holler (:decoder)]

gkw made bisects for this:

The first bad revision is:
changeset:   128914:ec8547a266b7
user:        Eddy Bruel
date:        Wed Feb 20 20:49:41 2013 +0100
summary:     Bug 568953 - Parser support for module declarations; r=jorendorff

The first good revision is:
changeset:   126958:172651edb28e
user:        Eddy Bruel
date:        Tue Apr 02 18:00:49 2013 +0200
summary:     Bug 568953 - Added reflection support for module declarations; r=jorendorff 


The necessary changes need to be backported to mozilla-aurora.

Comment 2

[Christian Holler (:decoder)]

This bug is aurora only.

Comment 3

[Eddy Bruel [:ejpbruel]]

Can somebody backport this?

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

172651edb28e seems to apply nicely to mozilla-beta (this fix is present on aurora and central), so Eddy, I guess you'll need to fill out the approval-mozilla-beta questionaire to nominate that patch for backport, reproduced here:

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 
User impact if declined: 
Testing completed (on m-c, etc.): 
Risk to taking this patch (and alternatives if risky): 
String or IDL/UUID changes made by this patch:

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Oops, set checkin-needed too early.

Comment 6

[Eddy Bruel [:ejpbruel]]

Bug caused by (feature/regressing bug #): 568953 
User impact if declined: Makes it possible to crash Firefox by using module syntax
Testing completed (on m-c, etc.): m-c
Risk to taking this patch (and alternatives if risky): Very low
String or IDL/UUID changes made by this patch: None

Gary, what flag should I set to complete the process?

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Due to the patch already being in bugzilla (where the flag is set), I've nominated the flag in bug 568953 comment 104 and duplicated Eddy's comments there.

Thanks! Now to wait for approval, then someone can land it on beta.

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Please land 172651edb28e to mozilla-beta, approval has already been given in bug 568953 comment 105

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/4ec769a499fc