The default bug view has changed. See this FAQ.

"Assertion failure: ptrdiff_t(column) + colspan >= 0,"

RESOLVED FIXED in mozilla17

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
4 years ago

People

(Reporter: gkw, Assigned: u443197)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla17
x86_64
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(2 attachments, 1 obsolete attachment)

(Reporter)

Description

5 years ago
Created attachment 654633 [details]
stack

Function("for(let b; true; x) \nfalse");

asserts js debug shell on m-c changeset 198ca6edd0ae with -D at Assertion failure: ptrdiff_t(column) + colspan >= 0, when the testcase is passed in as a CLI argument.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   103052:753d5e8c8064
user:        Alex Crichton
date:        Wed Aug 08 11:39:40 2012 -0700
summary:     Bug 568142 - Part 1: Add column numbers to error reports. r=jorendorff
(Assignee)

Comment 1

5 years ago
Created attachment 654677 [details] [diff] [review]
Reset lastColumn when currentLine is reset

Two spots were resetting currentLine without resetting lastColumn, so updated them to reset the last column to 0 so we don't get unnecessary negative colspans.
Attachment #654677 - Flags: review?(jorendorff)
(Assignee)

Comment 2

5 years ago
Created attachment 654693 [details] [diff] [review]
Reset lastColumn when currentLine is reset (with test)

Added the test which triggered the failure to the jit-tests folder
Attachment #654677 - Attachment is obsolete: true
Attachment #654677 - Flags: review?(jorendorff)
Attachment #654693 - Flags: review?(jorendorff)
Comment on attachment 654693 [details] [diff] [review]
Reset lastColumn when currentLine is reset (with test)

Review of attachment 654693 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/frontend/BytecodeEmitter.cpp
@@ +5262,5 @@
>          }
>      } else if (!pn->isDirectivePrologueMember()) {
>          /* Don't complain about directive prologue members; just don't emit their code. */
>          bce->current->currentLine = pn2->pn_pos.begin.lineno;
> +        bce->current->lastColumn  = 0;

Nit: just one space after `->lastColumn`, not two
Attachment #654693 - Flags: review?(jorendorff) → review+
(Assignee)

Comment 4

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/43b106855cbb
https://hg.mozilla.org/mozilla-central/rev/43b106855cbb
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla17
(Assignee)

Updated

5 years ago
Assignee: general → alex
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Target Milestone: mozilla17 → ---
I am so sorry. While cc'ing myself, I changed some flags accidentally. Resetting them back again.
Status: REOPENED → RESOLVED
Last Resolved: 5 years ago5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla17
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug785094.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.