1273432 - Assertion failure: count <= JSString::MAX_LENGTH, at js/src/vm/String.cpp:947

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision d0be57e84807 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

try {
    x = '';
    for (var y in this) {
        x += x + 'z';
    };
} catch (e) {}
evaluate('', ({
    sourceMapURL: x
}));

Backtrace:

0   js-dbg-64-dm-clang-darwin-d0be57e84807	0x000000010e2abac9 char16_t* js::AutoStableStringChars::allocOwnChars<char16_t>(JSContext*, unsigned long) + 233 (String.cpp:947)
1   js-dbg-64-dm-clang-darwin-d0be57e84807	0x000000010e29e24e js::AutoStableStringChars::copyAndInflateLatin1Chars(JSContext*, JS::Handle<JSLinearString*>) + 30 (String.cpp:963)
2   js-dbg-64-dm-clang-darwin-d0be57e84807	0x000000010e29e0cb js::AutoStableStringChars::initTwoByte(JSContext*, JSString*) + 139 (String.cpp:915)
3   js-dbg-64-dm-clang-darwin-d0be57e84807	0x000000010d9de3b4 Evaluate(JSContext*, unsigned int, JS::Value*) + 3668 (js.cpp:1510)
4   js-dbg-64-dm-clang-darwin-d0be57e84807	0x000000010e1cab6e js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) + 222 (jscntxtinlines.h:236)
/snip

For detailed crash information, see attachment.

Assertion failures about lengths of strings scare me, setting s-s pending further analysis.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/41aa5d56a722
user:        Jon Coppeard
date:        Mon Apr 25 13:41:25 2016 +0100
summary:     Bug 1259021 - Use in-place storage in AutoStableStringChars to avoid allocation for short strings r=jandem r=Waldo

Jon, is bug 1259021 a likely regressor?

Comment 3

[Jon Coppeard (:jonco)]

This is just an off-by-one in the assertion.

Comment 4

[Jon Coppeard (:jonco)]

Attachment: bug1273432-string-length

Update the assertion to take into account space for the null terminator.

Comment 5

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e113053408b6

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

Backed out for bustage: https://treeherder.mozilla.org/logviewer.html#?job_id=28169364&repo=mozilla-inbound

https://hg.mozilla.org/integration/mozilla-inbound/rev/486da9da5b8a

Comment 7

[Jon Coppeard (:jonco)]

The test creates the longest possible string and for some reason this makes the test timeout on Win XP only.

I can't immediately see how to get around this, so I'm going to land the fix without the test.

Comment 8

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/666bfc7f00ff

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/666bfc7f00ff