613400 - "Assertion failure: start >= largestStartSeen"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

/(?!()m)/.exec("m");

Assertion failure: start >= largestStartSeen, at js/src/jsregexpinlines.h:234

The first bad revision is:
changeset:   cbd2053aa825
user:        Chris Leary
date:        Wed Nov 10 17:02:08 2010 -0800
summary:     Encapsulate RegExpStatics more. (r=gal, bug 610223)

Comment 1

[Jesse Ruderman]

Clicking the green EV button on paypal.com also triggers this assertion failure.

Comment 2

[Jeff Walden [:Waldo]]

I seem to have hit this here as well:

http://www.foxnews.com/scitech/2010/11/26/secret-agent-crippled-irans-nuclear-ambitions/

The reduced testcase for the particular time I hit the assertion comes down to this:

js> var r = new RegExp('^(\\"(\\\\.|[^' +
                       '\\"\\\\\\n\\r]' +
                       ')*?\\"|[,:{}\\' +
                       '[\\]0-9.\\-+Ea' +
                       'eflnr-u \\n\\r' +
                       '\\t])+?$');
js> var s =
  '{"guide":{"fmt":"results2","ok":tru' +
  'e},"baynoteObserver":{"dt":60,"so":' +
  'true,"uhd":false,"cds":true,"eec":t' +
  'rue,"cdt":true,"hn":"handler2.js","' +
  'ec":true,"uca":"315360000000","alt"' +
  ':true,"ub":false,"ep":50,"om":2,"sv' +
  '":true,"sdl":false,"ok":true,"st":t' +
  'rue},"search":{"ok":true},"customSc' +
  'ript":{"hn":"custom-script.js"},"tr' +
  'ail":{"tl":5,"so":false,"ok":false}' +
  ',"GuideSet":{"eids":["baynote-recs-' +
  'js"]},"inf":{"dt":"Mon Nov 29 19:19' +
  ':17 PST 2010","exp":86400,"u":"ANON' +
  'YMOUS","cn":"foxnews","ve":"V1","cc' +
  '":"news","cd":"d&g&s&r=0.01"},"bayn' +
  'oteGuide":{"ok":true},"guidePro":{"' +
  'ok":true}}';
js> r.test(s)
Assertion failure: start >= largestStartSeen, at /home/jwalden/moz/shell-js/js/src/jsregexpinlines.h:235
Aborted (core dumped)

Comment 3

[Karl Tomlinson (:karlt)]

http://support.dell.com/support/edocs/systems/wsm6500/en/sm/TD_Memory.htm

Comment 4

[Bob Clary [:bc] (inactive)]

also http://jp.msn.com/

Comment 5

[Chris Leary [:cdleary] (not checking bugmail)]

Attachment: Remove zealous assertion.

This assertion was just added as a sanity check (note that the regexps produce correct results). I looked into this a little bit and I'm not convinced the assertion is faulty, but I'm going to remove it for now and open another bug to see if we can add it back in without causing a slowdown.

Comment 6

[Chris Leary [:cdleary] (not checking bugmail)]

Attachment: Remove zealous assertion.

Sorry, some other cruft got in that patch.

Comment 7

[Chris Leary [:cdleary] (not checking bugmail)]

Filed bug 616297.

http://hg.mozilla.org/tracemonkey/rev/40df94b2d600

Comment 8

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/40df94b2d600

Comment 9

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929