The following testcase crashes on mozilla-central revision 2c773b971672 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug --enable-optimize, run with --fuzzing-safe): parseModule("await (x);"); Backtrace: received signal SIGSEGV, Segmentation fault. 0x0000000000d59048 in js::frontend::BytecodeEmitter::emitYield (this=this@entry=0x7fffffffb9b8, pn=pn@entry=0x7ffff69f40e0) at js/src/frontend/BytecodeEmitter.cpp:7405 #0 0x0000000000d59048 in js::frontend::BytecodeEmitter::emitYield (this=this@entry=0x7fffffffb9b8, pn=pn@entry=0x7ffff69f40e0) at js/src/frontend/BytecodeEmitter.cpp:7405 #1 0x0000000000d4fbba in js::frontend::BytecodeEmitter::emitTree (this=this@entry=0x7fffffffb9b8, pn=pn@entry=0x7ffff69f40e0, emitLineNote=emitLineNote@entry=js::frontend::BytecodeEmitter::EMIT_LINENOTE) at js/src/frontend/BytecodeEmitter.cpp:9349 #2 0x0000000000d59917 in js::frontend::BytecodeEmitter::emitStatement (this=this@entry=0x7fffffffb9b8, pn=pn@entry=0x7ffff69f4110) at js/src/frontend/BytecodeEmitter.cpp:7656 #3 0x0000000000d4f8a4 in js::frontend::BytecodeEmitter::emitTree (this=this@entry=0x7fffffffb9b8, pn=pn@entry=0x7ffff69f4110, emitLineNote=emitLineNote@entry=js::frontend::BytecodeEmitter::EMIT_LINENOTE) at js/src/frontend/BytecodeEmitter.cpp:9359 #4 0x0000000000d597de in js::frontend::BytecodeEmitter::emitStatementList (this=0x7fffffffb9b8, pn=<optimized out>) at js/src/frontend/BytecodeEmitter.cpp:7601 #5 0x0000000000d4f7ac in js::frontend::BytecodeEmitter::emitTree (this=this@entry=0x7fffffffb9b8, pn=pn@entry=0x7ffff69f4050, emitLineNote=emitLineNote@entry=js::frontend::BytecodeEmitter::EMIT_LINENOTE) at js/src/frontend/BytecodeEmitter.cpp:9354 #6 0x0000000000d55e99 in js::frontend::BytecodeEmitter::emitScript (this=0x7fffffffb9b8, body=body@entry=0x7ffff69f4050) at js/src/frontend/BytecodeEmitter.cpp:4189 #7 0x0000000000d5728b in BytecodeCompiler::compileModule (this=this@entry=0x7fffffffbe10) at js/src/frontend/BytecodeCompiler.cpp:414 #8 0x0000000000d577b4 in js::frontend::CompileModule (cx=cx@entry=0x7ffff695f000, optionsInput=..., srcBuf=..., alloc=..., sourceObjectOut=sourceObjectOut@entry=0x0) at js/src/frontend/BytecodeCompiler.cpp:603 #9 0x0000000000d57a5c in js::frontend::CompileModule (cx=cx@entry=0x7ffff695f000, options=..., srcBuf=...) at js/src/frontend/BytecodeCompiler.cpp:614 #10 0x00000000004545e9 in ParseModule (cx=cx@entry=0x7ffff695f000, argc=<optimized out>, vp=<optimized out>) at js/src/shell/js.cpp:3987 #11 0x0000000000b40ee9 in js::CallJSNative (cx=cx@entry=0x7ffff695f000, native=0x4542f0 <ParseModule(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:239 [...] #24 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at js/src/shell/js.cpp:7928 rax 0x0 0 rbx 0x7fffffffb9b8 140737488337336 rcx 0x7ffff6c28a2d 140737333332525 rdx 0x0 0 rsi 0x7ffff6ef7770 140737336276848 rdi 0x7ffff6ef6540 140737336272192 rbp 0x7fffffffb450 140737488335952 rsp 0x7fffffffb430 140737488335920 r8 0x7ffff6ef7770 140737336276848 r9 0x7ffff7fe4740 140737354024768 r10 0x58 88 r11 0x7ffff6b9f750 140737332770640 r12 0x7ffff69f40e0 140737331020000 r13 0x7ffff69f40e0 140737331020000 r14 0x1 1 r15 0x98 152 rip 0xd59048 <js::frontend::BytecodeEmitter::emitYield(js::frontend::ParseNode*)+280> => 0xd59048 <js::frontend::BytecodeEmitter::emitYield(js::frontend::ParseNode*)+280>: movl $0x0,0x0 0xd59053 <js::frontend::BytecodeEmitter::emitYield(js::frontend::ParseNode*)+291>: ud2 Marking as fuzzblocker because this keeps triggering with high frequency.

JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: https://hg.mozilla.org/mozilla-central/rev/0f59ff767344 user: Mariusz Kierski date: Sun Aug 28 23:58:29 2016 +0900 summary: Bug 1185106 - Part 8.1: Treat await as keyword in module. r=efaust,till This iteration took 255.811 seconds to run.

Since Mariusz and Eric might not be available, Till, is bug 1185106 a likely regressor?

Should be a dupe of bug 1314128.

Updating 52 status since bug 1314128 was fixed a couple of weeks ago