880529 - Assertion failure: rangeStart <= rangeEnd, at mozilla/RangedPtr.h:75 or Crash [@ leftChild] or Opt-Crash [@ JSRope::flattenInternal]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 204de5b7e0a6 (run with --ion-eager):


function startTest() {}
function writeHeaderToLog( string ) {
  unescape(string);
}
writeHeaderToLog("");
writeHeaderToLog("");
evaluate('writeHeaderToLog(startTest.prototype);', { noScriptRval : true });

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

This reduced test crashes with a null-deref, but previous stages also showed the mentioned assert and dangerous crashes. Assuming there's something wrong with strings and marking as sec-high therefore.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 9ca690835a5e).
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/e1bca8b56470
user:        Jan de Mooij
date:        Fri May 24 14:03:31 2013 +0200
summary:     Bug 868431 - Disable Ion when Baseline is disabled, remove bailout-to-interpreter code. r=djvj

This iteration took 20.086 seconds to run.

Comment 4

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/7df36088f645
user:        Kannan Vijayan
date:        Wed Jun 05 16:42:23 2013 -0400
summary:     Bug 877287. r=h4writer

This iteration took 0.649 seconds to run.

Comment 5

[Christian Holler (:decoder)]

Djvj, is comment 4 likely a fix?

Comment 6

[Kannan Vijayan [:djvj]]

I can't reproduce this even when I back out my changes.  Looking at the code and crash signature, I don't think comment 4 fixes this issue.

Comment 7

[Jan de Mooij [:jandem]]

I can't reproduce this.

decoder does the fuzzer still hit this? The testcase is very small so if the bug is still there it should still show up I think.

Comment 8

[Christian Holler (:decoder)]

Talked to jandem on IRC. This test doesn't reproduce anymore and we don't have the fixing changeset (because comment 4 doesn't seem to be right), but the test is very simple and we're confident that this is either gone, or it will pop up in the fuzzers again.