Last Comment Bug 785094 - "Assertion failure: ptrdiff_t(column) + colspan >= 0,"
: "Assertion failure: ptrdiff_t(column) + colspan >= 0,"
Status: RESOLVED FIXED
[jsbugmon:update]
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Mac OS X
: -- critical (vote)
: mozilla17
Assigned To: u443197
: general
Mentors:
Depends on:
Blocks: jsfunfuzz 568142
  Show dependency treegraph
 
Reported: 2012-08-23 08:34 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-14 07:39 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack (2.91 KB, text/plain)
2012-08-23 08:34 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
Reset lastColumn when currentLine is reset (1.64 KB, patch)
2012-08-23 10:14 PDT, u443197
no flags Details | Diff | Splinter Review
Reset lastColumn when currentLine is reset (with test) (1.92 KB, patch)
2012-08-23 10:59 PDT, u443197
jorendorff: review+
Details | Diff | Splinter Review

Description Gary Kwong [:gkw] [:nth10sd] 2012-08-23 08:34:45 PDT
Created attachment 654633 [details]
stack

Function("for(let b; true; x) \nfalse");

asserts js debug shell on m-c changeset 198ca6edd0ae with -D at Assertion failure: ptrdiff_t(column) + colspan >= 0, when the testcase is passed in as a CLI argument.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   103052:753d5e8c8064
user:        Alex Crichton
date:        Wed Aug 08 11:39:40 2012 -0700
summary:     Bug 568142 - Part 1: Add column numbers to error reports. r=jorendorff
Comment 1 u443197 2012-08-23 10:14:58 PDT
Created attachment 654677 [details] [diff] [review]
Reset lastColumn when currentLine is reset

Two spots were resetting currentLine without resetting lastColumn, so updated them to reset the last column to 0 so we don't get unnecessary negative colspans.
Comment 2 u443197 2012-08-23 10:59:29 PDT
Created attachment 654693 [details] [diff] [review]
Reset lastColumn when currentLine is reset (with test)

Added the test which triggered the failure to the jit-tests folder
Comment 3 Jason Orendorff [:jorendorff] 2012-08-23 12:02:45 PDT
Comment on attachment 654693 [details] [diff] [review]
Reset lastColumn when currentLine is reset (with test)

Review of attachment 654693 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/frontend/BytecodeEmitter.cpp
@@ +5262,5 @@
>          }
>      } else if (!pn->isDirectivePrologueMember()) {
>          /* Don't complain about directive prologue members; just don't emit their code. */
>          bce->current->currentLine = pn2->pn_pos.begin.lineno;
> +        bce->current->lastColumn  = 0;

Nit: just one space after `->lastColumn`, not two
Comment 5 Ryan VanderMeulen [:RyanVM] 2012-08-23 19:17:36 PDT
https://hg.mozilla.org/mozilla-central/rev/43b106855cbb
Comment 6 Saurabh Anand [:sawrubh] 2012-08-24 23:59:40 PDT
I am so sorry. While cc'ing myself, I changed some flags accidentally. Resetting them back again.
Comment 7 Christian Holler (:decoder) 2013-01-14 07:39:04 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug785094.js.

Note You need to log in before you can comment on or make changes to this bug.