Closed Bug 785094 Opened 7 years ago Closed 7 years ago

"Assertion failure: ptrdiff_t(column) + colspan >= 0,"

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla17

People

(Reporter: gkw, Assigned: u443197)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])

Attachments

(2 files, 1 obsolete file)

Attached file stack
Function("for(let b; true; x) \nfalse");

asserts js debug shell on m-c changeset 198ca6edd0ae with -D at Assertion failure: ptrdiff_t(column) + colspan >= 0, when the testcase is passed in as a CLI argument.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   103052:753d5e8c8064
user:        Alex Crichton
date:        Wed Aug 08 11:39:40 2012 -0700
summary:     Bug 568142 - Part 1: Add column numbers to error reports. r=jorendorff
Two spots were resetting currentLine without resetting lastColumn, so updated them to reset the last column to 0 so we don't get unnecessary negative colspans.
Attachment #654677 - Flags: review?(jorendorff)
Added the test which triggered the failure to the jit-tests folder
Attachment #654677 - Attachment is obsolete: true
Attachment #654677 - Flags: review?(jorendorff)
Attachment #654693 - Flags: review?(jorendorff)
Comment on attachment 654693 [details] [diff] [review]
Reset lastColumn when currentLine is reset (with test)

Review of attachment 654693 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/frontend/BytecodeEmitter.cpp
@@ +5262,5 @@
>          }
>      } else if (!pn->isDirectivePrologueMember()) {
>          /* Don't complain about directive prologue members; just don't emit their code. */
>          bce->current->currentLine = pn2->pn_pos.begin.lineno;
> +        bce->current->lastColumn  = 0;

Nit: just one space after `->lastColumn`, not two
Attachment #654693 - Flags: review?(jorendorff) → review+
https://hg.mozilla.org/mozilla-central/rev/43b106855cbb
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla17
Assignee: general → alex
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Target Milestone: mozilla17 → ---
I am so sorry. While cc'ing myself, I changed some flags accidentally. Resetting them back again.
Status: REOPENED → RESOLVED
Closed: 7 years ago7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla17
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug785094.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.