885219 - Assertion failure: !exprBody, at jsfun.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

disassemble("-r", Function("()=>e,d"))

asserts js debug shell on m-c changeset 8ea92aeab783 without any CLI arguments at Assertion failure: !exprBody, at jsfun.cpp

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/bf3ce88c6ea3
user:        Jason Orendorff
date:        Sun Mar 17 20:42:36 2013 -0700
summary:     Bug 846406 - Implement arrow functions. r=bhackett. Changes to Y.js r=brendan.

This iteration took 11.746 seconds to run.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

jorendorff, is bug 846406 a possible regressor?

Comment 3

[Jason Orendorff [:jorendorff]]

Yes.

Comment 4

[Jason Orendorff [:jorendorff]]

Attachment: v1

This is a cute bug.

disassemble() is special because it calls FunctionToString on the function ()=>e, nested within the other function. I don't think anything else can get a reference to that nested function to stringify it.

FunctionToString contains some code that determines whether the function being stringified was created with the Function() constructor, and that code was correct pre-arrows. Arrows broke it. The fuzzer found the amazingly specific bug.

Comment 5

[Jason Orendorff [:jorendorff]]

Eddy, Jim, is it important to get this into FF24? The new Debugger.Source stuff never calls FunctionToString, does it?

Comment 6

[Jim Blandy :jimb]

No, we only ask for substrings of the ScriptSource object directly; we don't deal with functions much.

Comment 7

[Till Schneidereit [:till]]

Comment on attachment 765474 [details] [diff] [review]
v1

Review of attachment 765474 [details] [diff] [review]:
-----------------------------------------------------------------

Stealing

::: js/src/jsfun.cpp
@@ +632,4 @@
>          // The source data for functions created by calling the Function
> +        // constructor is only the function's body.  This depends on the fact,
> +        // asserted below, that in Function("function x() {}"), the inner
> +        // function's sourceStart points to the '(', not the 'f'.

Nit: s/f/x/ here, or s/x/f/ above

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/bcc823a6bca8

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This had previously landed on inbound in:

http://hg.mozilla.org/integration/mozilla-inbound/rev/bcc823a6bca8

Comment 10

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 11

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 12

[Jason Orendorff [:jorendorff]]

Christian, this isn't still happening, is it?

We're not going to backport this fix unless it would help you.

Comment 13

[Christian Holler (:decoder)]

(In reply to Jason Orendorff [:jorendorff] from comment #12)
> Christian, this isn't still happening, is it?

Just on beta :)

> We're not going to backport this fix unless it would help you.

No, that's fine. I am just marking this as "affected" on beta, and attach a signature, so the fuzzer knows that this bug still affects beta and can be ignored.