1032067 - Assertion failure: mLength + insLength <= mReserved, at dist/include/mozilla/Vector.h or Assertion failure: mLength + 1 <= mReserved, at dist/include/mozilla/Vector.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

''.match(/(:[cR\cC

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: testcase

The attached testcase asserts js debug shell on m-c changeset b6408c32a170 with --latin1-strings --ion-offthread-compile=off --ion-eager at Assertion failure: mLength + insLength <= mReserved, at dist/include/mozilla/Vector.h

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --with-ccache --enable-threadsafe <other NSPR options>

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/5c88c5b4fe07
user:        Jan de Mooij
date:        Wed Jun 25 10:12:20 2014 +0200
summary:     Bug 1028867 - Add a --latin1-strings shell flag. r=luke

Jan, bug 1028867 seems to have caused this fuzzblocker. I'm not sure if this assert is benign or not, so s-s to be safe first. Please feel free to open up if it isn't.

(This is interesting, b.m.o ate the rest of the message when I put in a monkey unicode character. http://www.fileformat.info/info/unicode/char/1f435/index.htm )

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This testcase may be related:

Function("print(/(        \\\uB0DA        (        )})/);\
function c(){}")()

$ ./js-dbg-opt-64-prof-ts-darwin-b6408c32a170 --latin1-strings --ion-offthread-compile=off --ion-eager testcase.js

Assertion failure: mLength + 1 <= mReserved, at dist/include/mozilla/Vector.h

Configuration parameters:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --with-ccache --enable-threadsafe <other NSPR options>

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Stack for testcase in comment 2

Comment 4

[Jan de Mooij [:jandem]]

Gary is it possible the testcase in comment 0 was truncated?

Patch coming up.

Comment 5

[Jan de Mooij [:jandem]]

Oh you also attached it, got it :)

Comment 6

[Jan de Mooij [:jandem]]

Attachment: Patch

Some places where we called sb.reserve() and then appended a TwoByte string so that we lost our reserved space.

I checked the callers of StringBuffer.reserve and these are the only ones that need this I think.

Comment 7

[Jan de Mooij [:jandem]]

Not s-s; requires --latin1-strings.

Comment 8

[Luke Wagner [:luke]]

When latin1->twobyte inflation happens, can we preserve mCapacity so that reserve() just works?

Comment 9

[Jan de Mooij [:jandem]]

Attachment: Patch v2

Ah right, preserving the capacity is much nicer and less error-prone. Somehow I thought it was hard to get a Vector's capacity or something.

Comment 10

[Luke Wagner [:luke]]

Comment on attachment 8449638 [details] [diff] [review]
Patch v2

Review of attachment 8449638 [details] [diff] [review]:
-----------------------------------------------------------------

Great!

Comment 11

[Jan de Mooij [:jandem]]

Comment on attachment 8449638 [details] [diff] [review]
Patch v2

This patch has a subtle perf issue; new patch coming up.

Comment 12

[Jan de Mooij [:jandem]]

Attachment: Patch v3

Comment 13

[Luke Wagner [:luke]]

Comment on attachment 8449719 [details] [diff] [review]
Patch v3

Review of attachment 8449719 [details] [diff] [review]:
-----------------------------------------------------------------

Nice job identifying this problem.

Comment 14

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4e28ce23f4e0

Comment 15

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/4e28ce23f4e0