916511 - Assertion failure: i < mLength, at dist/include/mozilla/Vector.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

/.?(?:).*/.exec()

asserts js debug shell on m-c changeset 9366ee039645 without any CLI arguments at Assertion failure: i < mLength, at dist/include/mozilla/Vector.h

My configure flags are:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin11.4.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --with-ccache

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/8bf2f8cb5e73
user:        David Anderson
date:        Thu Nov 01 21:35:25 2012 -0700
summary:     Update Yarr to WebKit rev 130234 (bug 740015, r=dmandelin).

This iteration took 95.862 seconds to run.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Sean, is this likely related to bug 895660 as well?

Comment 3

[Sean Stangl [:sstangl]]

Attachment: Prevent YARR underflow.

This issue is separate: an underflow caused by a careless subtraction attempted to index quite a bit into a vector. This patch detects the case of an empty alternative and avoids the underflow.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

nbp mentioned to me in-person that sstangl is going to be busy for a few days, so setting checkin-needed (inbound is closed), or probably later I could land this if the tree opens up.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/fa67c55da0d5

Can we land a test for this?

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/fa67c55da0d5