876642 - Assertion failure: s <= end, at ../jsstrinlines.h:98

Status: RESOLVED DUPLICATE of bug 875804

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision c190422547ed (no options required):


function my_iterator_next() { return my_iterator_next; }
function testCustomIterator() {
  var o = {
    __iterator__: function () {
      return {
        next: my_iterator_next,
      };
    }
  };
  for(var j in o) {
    unescape(1 + (j >> 0));
    // Use this line instead to get a straight unsafe crash
    //unescape(j);
  }
}
testCustomIterator();

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

This range assertion can be turned quickly into a non-safe crash:


Program received signal SIGSEGV, Segmentation fault.
0x0831cab5 in str_unescape (cx=0x92693c8, argc=1, vp=0xffffc654) at js/src/jsstr.cpp:290
290             jschar c = chars[k];
(gdb) bt
#0  0x0831cab5 in str_unescape (cx=0x92693c8, argc=1, vp=0xffffc654) at js/src/jsstr.cpp:290
#1  0xf7fd2784 in ?? ()
Cannot access memory at address 0xffffff8b
(gdb) info register
edx            0xf7600000       -144703488
(gdb) x /i $pc
=> 0x831cab5 <str_unescape(JSContext*, unsigned int, JS::Value*)+245>:  movzwl (%edx),%edi


I assume this is some form of confusion between a string and something else. Bug 876458 might be pointing to the same problem, but I'll wait for the bisect result to confirm that they both have the same regressor.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   132801:4370f503d69f
user:        Brian Hackett
date:        Thu May 23 13:25:19 2013 -0600
summary:     Bug 875276 - Don't profile types in scripts until they are compiled by baseline, r=jandem.

This iteration took 9.865 seconds to run.

Comment 4

[Christian Holler (:decoder)]

Needinfo from Brian based on comment 3 :)