649761 - TM: Assertion failure: from < *limit, at ./jscntxtinlines.h:212

Status: RESOLVED DUPLICATE of bug 644074

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: shell testcase, unpack, chdir and run main.js with options "-j -m -a"

The attached testcase causes the assertion on TM rev eee087772f45 (unpack, chdir and run main.js with options -j -m -a), tested on 32 and 64 bit.

There is so far no sign of a memory corruption here but I looked at the code and the assertion seems to be a range protection and would cause an integer overflow in the next line so I assume this could get critical.

The test files are not syntax minimized yet, I was not able to condense this into one file.

Comment 1

[Luke Wagner [:luke]]

Hah, incredible! I just simplified the limit code in bug 644074 and removed what I thought was a very rare/hard-to-hit bug and indeed, toggling the one line that fixes the bug toggles whether the assert hits.