761396 - "Assertion failure: offset < script->length,"

Status: RESOLVED DUPLICATE of bug 759719

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

The upcoming attached testcase asserts 64-bit (tested on Windows 7, but assert also seems to show up in Mac OS X 10.7) js debug shell on m-c changeset 0e4f8e1a141b with -m and -n at Assertion failure: offset < script->length,

I'd be cautious about this TI bug and mark it s-s pending further analysis.

The first bad revision is:
changeset:   94968:de141e924806
user:        Brian Hackett
date:        Fri May 25 08:20:33 2012 -0700
summary:     Move JIT handles in scripts to a separate structure, bug 758613. r=
dvander

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: fragile testcase

s/TI bug/JIT bug

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: another Valgrind testcase

Put this testcase in a subfolder and pass it into the shell with -m and -n:

./js -m -n subfolder/testcase.js

Valgrind errors should show up.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

Valgrind stack for previous testcase.

This testcase seems like a similar bug because autoBisect points to the same regressing changeset in comment 0.

Comment 4

[Christian Holler (:decoder)]

Very likely a dup of bug 759719 based on the Valgrind stack.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Seems to be a dupe. I just checked that the patch in that bug fixes the issues in this bug.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Large fragile testcase, resolved DUPE -> in-testsuite-