Closed Bug 613400 Opened 9 years ago Closed 9 years ago

"Assertion failure: start >= largestStartSeen"

Categories

(Core :: JavaScript Engine, defect, critical)

x86
All
defect
Not set
critical

Tracking

()

RESOLVED FIXED
Tracking Status
blocking2.0 --- betaN+

People

(Reporter: jruderman, Assigned: cdleary)

References

(Blocks 1 open bug)

Details

(4 keywords, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file, 1 obsolete file)

/(?!()m)/.exec("m");

Assertion failure: start >= largestStartSeen, at js/src/jsregexpinlines.h:234

The first bad revision is:
changeset:   cbd2053aa825
user:        Chris Leary
date:        Wed Nov 10 17:02:08 2010 -0800
summary:     Encapsulate RegExpStatics more. (r=gal, bug 610223)
Clicking the green EV button on paypal.com also triggers this assertion failure.
blocking2.0: --- → ?
I seem to have hit this here as well:

http://www.foxnews.com/scitech/2010/11/26/secret-agent-crippled-irans-nuclear-ambitions/

The reduced testcase for the particular time I hit the assertion comes down to this:

js> var r = new RegExp('^(\\"(\\\\.|[^' +
                       '\\"\\\\\\n\\r]' +
                       ')*?\\"|[,:{}\\' +
                       '[\\]0-9.\\-+Ea' +
                       'eflnr-u \\n\\r' +
                       '\\t])+?$');
js> var s =
  '{"guide":{"fmt":"results2","ok":tru' +
  'e},"baynoteObserver":{"dt":60,"so":' +
  'true,"uhd":false,"cds":true,"eec":t' +
  'rue,"cdt":true,"hn":"handler2.js","' +
  'ec":true,"uca":"315360000000","alt"' +
  ':true,"ub":false,"ep":50,"om":2,"sv' +
  '":true,"sdl":false,"ok":true,"st":t' +
  'rue},"search":{"ok":true},"customSc' +
  'ript":{"hn":"custom-script.js"},"tr' +
  'ail":{"tl":5,"so":false,"ok":false}' +
  ',"GuideSet":{"eids":["baynote-recs-' +
  'js"]},"inf":{"dt":"Mon Nov 29 19:19' +
  ':17 PST 2010","exp":86400,"u":"ANON' +
  'YMOUS","cn":"foxnews","ve":"V1","cc' +
  '":"news","cd":"d&g&s&r=0.01"},"bayn' +
  'oteGuide":{"ok":true},"guidePro":{"' +
  'ok":true}}';
js> r.test(s)
Assertion failure: start >= largestStartSeen, at /home/jwalden/moz/shell-js/js/src/jsregexpinlines.h:235
Aborted (core dumped)
Attached patch Remove zealous assertion. (obsolete) — Splinter Review
This assertion was just added as a sanity check (note that the regexps produce correct results). I looked into this a little bit and I'm not convinced the assertion is faulty, but I'm going to remove it for now and open another bug to see if we can add it back in without causing a slowdown.
Assignee: general → cdleary
Status: NEW → ASSIGNED
Attachment #494820 - Flags: review?(dmandelin)
Sorry, some other cruft got in that patch.
Attachment #494820 - Attachment is obsolete: true
Attachment #494822 - Flags: review?(dmandelin)
Attachment #494820 - Flags: review?(dmandelin)
Attachment #494822 - Flags: review?(dmandelin) → review+
http://hg.mozilla.org/mozilla-central/rev/40df94b2d600
Status: ASSIGNED → RESOLVED
blocking2.0: ? → betaN+
Closed: 9 years ago
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.