785094 - "Assertion failure: ptrdiff_t(column) + colspan >= 0,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

Function("for(let b; true; x) \nfalse");

asserts js debug shell on m-c changeset 198ca6edd0ae with -D at Assertion failure: ptrdiff_t(column) + colspan >= 0, when the testcase is passed in as a CLI argument.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   103052:753d5e8c8064
user:        Alex Crichton
date:        Wed Aug 08 11:39:40 2012 -0700
summary:     Bug 568142 - Part 1: Add column numbers to error reports. r=jorendorff

Comment 1

[u443197]

Attachment: Reset lastColumn when currentLine is reset

Two spots were resetting currentLine without resetting lastColumn, so updated them to reset the last column to 0 so we don't get unnecessary negative colspans.

Comment 2

[u443197]

Attachment: Reset lastColumn when currentLine is reset (with test)

Added the test which triggered the failure to the jit-tests folder

Comment 3

[Jason Orendorff [:jorendorff]]

Comment on attachment 654693 [details] [diff] [review]
Reset lastColumn when currentLine is reset (with test)

Review of attachment 654693 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/frontend/BytecodeEmitter.cpp
@@ +5262,5 @@
>          }
>      } else if (!pn->isDirectivePrologueMember()) {
>          /* Don't complain about directive prologue members; just don't emit their code. */
>          bce->current->currentLine = pn2->pn_pos.begin.lineno;
> +        bce->current->lastColumn  = 0;

Nit: just one space after `->lastColumn`, not two

Comment 4

[u443197]

https://hg.mozilla.org/integration/mozilla-inbound/rev/43b106855cbb

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/43b106855cbb

Comment 6

[Saurabh Anand [:sawrubh]]

I am so sorry. While cc'ing myself, I changed some flags accidentally. Resetting them back again.

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug785094.js.