808478 - "Assertion failure: (&term - term.atom.parenthesesWidth)->inputPosition == term.inputPosition,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

"h".match(RegExp("()??t()*"))

asserts js debug shell on m-c changeset 2937fd8e35a1 without any CLI arguments at Assertion failure: (&term - term.atom.parenthesesWidth)->inputPosition == term.inputPosition,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   112142:8bf2f8cb5e73
user:        David Anderson
date:        Thu Nov 01 21:35:25 2012 -0700
summary:     Update Yarr to WebKit rev 130234 (bug 740015, r=dmandelin).

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Setting fuzzblocker because this is triggered quite often by jsfunfuzz.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

dvander, is this a bug in our YARR adaptation, or is this an upstream bug?

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

dvander, is this a bug in our YARR adaptation, or is this an upstream bug?

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Turns out this is upstream. I filed WebKit bug https://bugs.webkit.org/show_bug.cgi?id=104846.

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: a fix

I don't know if we should take this or not, but probably, if it will help fuzzing. It disables the assert, and uses the value which is sensible (I don't think -1 is supposed to leak into inputPosition).

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

Err, ignore the non-Yarr stuff in that patch :)

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

dvander mentioned to add [leave open].

https://hg.mozilla.org/integration/mozilla-inbound/rev/cd2eb9705765

Comment 8

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/cd2eb9705765

Comment 9

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision dd277d439d31).

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Unfortunately in changeset cd2eb9705765 I forgot to set dvander as the author of the patch, sorry for that.

Comment 11

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

dvander is unlikely to be working on this in the future.

Comment 12

[Till Schneidereit [:till]]

I don't see a good reason to leave this open, anymore. The crash is fixed and we haven't seen any obvious regressions caused by the new behavior.