"Assertion failure: start >= largestStartSeen"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
7 years ago
4 years ago

People

(Reporter: Jesse Ruderman, Assigned: cdleary)

Tracking

(Blocks: 2 bugs, 4 keywords)

Trunk
x86
All
assertion, dogfood, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(blocking2.0 betaN+)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

7 years ago
/(?!()m)/.exec("m");

Assertion failure: start >= largestStartSeen, at js/src/jsregexpinlines.h:234

The first bad revision is:
changeset:   cbd2053aa825
user:        Chris Leary
date:        Wed Nov 10 17:02:08 2010 -0800
summary:     Encapsulate RegExpStatics more. (r=gal, bug 610223)
(Reporter)

Comment 1

7 years ago
Clicking the green EV button on paypal.com also triggers this assertion failure.
(Reporter)

Updated

7 years ago
blocking2.0: --- → ?
I seem to have hit this here as well:

http://www.foxnews.com/scitech/2010/11/26/secret-agent-crippled-irans-nuclear-ambitions/

The reduced testcase for the particular time I hit the assertion comes down to this:

js> var r = new RegExp('^(\\"(\\\\.|[^' +
                       '\\"\\\\\\n\\r]' +
                       ')*?\\"|[,:{}\\' +
                       '[\\]0-9.\\-+Ea' +
                       'eflnr-u \\n\\r' +
                       '\\t])+?$');
js> var s =
  '{"guide":{"fmt":"results2","ok":tru' +
  'e},"baynoteObserver":{"dt":60,"so":' +
  'true,"uhd":false,"cds":true,"eec":t' +
  'rue,"cdt":true,"hn":"handler2.js","' +
  'ec":true,"uca":"315360000000","alt"' +
  ':true,"ub":false,"ep":50,"om":2,"sv' +
  '":true,"sdl":false,"ok":true,"st":t' +
  'rue},"search":{"ok":true},"customSc' +
  'ript":{"hn":"custom-script.js"},"tr' +
  'ail":{"tl":5,"so":false,"ok":false}' +
  ',"GuideSet":{"eids":["baynote-recs-' +
  'js"]},"inf":{"dt":"Mon Nov 29 19:19' +
  ':17 PST 2010","exp":86400,"u":"ANON' +
  'YMOUS","cn":"foxnews","ve":"V1","cc' +
  '":"news","cd":"d&g&s&r=0.01"},"bayn' +
  'oteGuide":{"ok":true},"guidePro":{"' +
  'ok":true}}';
js> r.test(s)
Assertion failure: start >= largestStartSeen, at /home/jwalden/moz/shell-js/js/src/jsregexpinlines.h:235
Aborted (core dumped)
http://support.dell.com/support/edocs/systems/wsm6500/en/sm/TD_Memory.htm
Keywords: dogfood
OS: Mac OS X → All

Comment 4

7 years ago
also http://jp.msn.com/
Blocks: 532972
Created attachment 494820 [details] [diff] [review]
Remove zealous assertion.

This assertion was just added as a sanity check (note that the regexps produce correct results). I looked into this a little bit and I'm not convinced the assertion is faulty, but I'm going to remove it for now and open another bug to see if we can add it back in without causing a slowdown.
Assignee: general → cdleary
Status: NEW → ASSIGNED
Attachment #494820 - Flags: review?(dmandelin)
Created attachment 494822 [details] [diff] [review]
Remove zealous assertion.

Sorry, some other cruft got in that patch.
Attachment #494820 - Attachment is obsolete: true
Attachment #494822 - Flags: review?(dmandelin)
Attachment #494820 - Flags: review?(dmandelin)
Attachment #494822 - Flags: review?(dmandelin) → review+
Filed bug 616297.

http://hg.mozilla.org/tracemonkey/rev/40df94b2d600
Whiteboard: fixed-in-tracemonkey

Comment 8

7 years ago
http://hg.mozilla.org/mozilla-central/rev/40df94b2d600
Status: ASSIGNED → RESOLVED
blocking2.0: ? → betaN+
Last Resolved: 7 years ago
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.