Bug 158572 – fix "ASSERTION FAILED: currentOffset() >= currentLineStartOffset()"

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Saam Barati]

Segmentation fault
ASSERTION FAILED: currentOffset() >= currentLineStartOffset()
../../Source/JavaScriptCore/parser/Lexer.h(100) : void JSC::Lexer<unsigned char>::setOffset(int, int) [T = unsigned char]
1   0xc11b73 JSC::Parser<JSC::Lexer<unsigned char> >::restoreSavePointWithError(JSC::Parser<JSC::Lexer<unsigned char> >::SavePointWithError const&)
2   0xcbdabd JSC::ASTBuilder::Expression JSC::Parser<JSC::Lexer<unsigned char> >::parseAssignmentExpression<JSC::ASTBuilder>(JSC::ASTBuilder&, JSC::Parser<JSC::Lexer<unsigned char> >::ExpressionErrorClassifier&)
3   0xc49524 JSC::ASTBuilder::Expression JSC::Parser<JSC::Lexer<unsigned char> >::parseExpression<JSC::ASTBuilder>(JSC::ASTBuilder&)
4   0xcdb71f JSC::ASTBuilder::Statement JSC::Parser<JSC::Lexer<unsigned char> >::parseExpressionOrLabelStatement<JSC::ASTBuilder>(JSC::ASTBuilder&, bool)
5   0xcd07af JSC::ASTBuilder::Statement JSC::Parser<JSC::Lexer<unsigned char> >::parseStatementListItem<JSC::ASTBuilder>(JSC::ASTBuilder&, JSC::Identifier const*&, unsigned int*)
6   0xc0473e JSC::ASTBuilder::SourceElements JSC::Parser<JSC::Lexer<unsigned char> >::parseSourceElements<JSC::ASTBuilder>(JSC::ASTBuilder&, JSC::SourceElementsMode)
7   0xbfbb74 JSC::Parser<JSC::Lexer<unsigned char> >::parseInner(JSC::Identifier const&, JSC::SourceParseMode)
8   0xdf84e9 std::unique_ptr<JSC::ProgramNode, std::default_delete<JSC::ProgramNode> > JSC::Parser<JSC::Lexer<unsigned char> >::parse<JSC::ProgramNode>(JSC::ParserError&, JSC::Identifier const&, JSC::SourceParseMode)
9   0xde921e std::unique_ptr<JSC::ProgramNode, std::default_delete<JSC::ProgramNode> > JSC::parse<JSC::ProgramNode>(JSC::VM*, JSC::SourceCode const&, JSC::Identifier const&, JSC::JSParserBuiltinMode, JSC::JSParserStrictMode, JSC::SourceParseMode, JSC::SuperBinding, JSC::ParserError&, JSC::JSTextPosition*, JSC::ConstructorKind, JSC::DerivedContextType, JSC::EvalContextType)
10  0xde2972 JSC::UnlinkedProgramCodeBlock* JSC::CodeCache::getGlobalCodeBlock<JSC::UnlinkedProgramCodeBlock, JSC::ProgramExecutable>(JSC::VM&, JSC::ProgramExecutable*, JSC::SourceCode const&, JSC::JSParserBuiltinMode, JSC::JSParserStrictMode, JSC::DebuggerMode, JSC::ParserError&, JSC::EvalContextType, JSC::VariableEnvironment const*)
11  0xddff71 JSC::CodeCache::getProgramCodeBlock(JSC::VM&, JSC::ProgramExecutable*, JSC::SourceCode const&, JSC::JSParserBuiltinMode, JSC::JSParserStrictMode, JSC::DebuggerMode, JSC::ParserError&)
12  0x1020607 JSC::JSGlobalObject::createProgramCodeBlock(JSC::ExecState*, JSC::ProgramExecutable*, JSC::JSObject**)
13  0xfa701a JSC::ProgramExecutable::initializeGlobalProperties(JSC::VM&, JSC::ExecState*, JSC::JSScope*)
14  0xa02519 JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*)
15  0xf5e843 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
16  0x68d7b0
17  0x689f33 jscmain(int, char**)
18  0x689be5 main
19  0x7fa97a1b15f0 __libc_start_main
20  0x6844d9 _start

[Saam Barati]

Created attachment 280931 [details]
crashing program

[Radar WebKit Bug Importer]

<rdar://problem/26884092>

[Saam Barati]

Created attachment 282579 [details]
patch

[WebKit Commit Bot]

Attachment 282579 [details] did not pass style-queue:


ERROR: Source/JavaScriptCore/parser/Lexer.cpp:1786:  Place brace on its own line for function definitions.  [whitespace/braces] [4]
Total errors found: 1 in 6 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Saam Barati]

Created attachment 282581 [details]
patch

[WebKit Commit Bot]

Attachment 282581 [details] did not pass style-queue:


ERROR: Source/JavaScriptCore/parser/Lexer.cpp:1786:  Place brace on its own line for function definitions.  [whitespace/braces] [4]
Total errors found: 1 in 7 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Build Bot]

Comment on attachment 282581 [details]
patch

Attachment 282581 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/1609227

New failing tests:
js/parser-syntax-check.html

[Build Bot]

Created attachment 282587 [details]
Archive of layout-test-results from ews106 for mac-yosemite-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews106  Port: mac-yosemite-wk2  Platform: Mac OS X 10.10.5

[Saam Barati]

Created attachment 282588 [details]
patch

[WebKit Commit Bot]

Attachment 282588 [details] did not pass style-queue:


ERROR: Source/JavaScriptCore/parser/Lexer.cpp:1786:  Place brace on its own line for function definitions.  [whitespace/braces] [4]
Total errors found: 1 in 7 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Build Bot]

Comment on attachment 282588 [details]
patch

Attachment 282588 [details] did not pass mac-ews (mac):
Output: http://webkit-queues.webkit.org/results/1609383

New failing tests:
js/parser-syntax-check.html

[Build Bot]

Created attachment 282597 [details]
Archive of layout-test-results from ews103 for mac-yosemite

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: ews103  Port: mac-yosemite  Platform: Mac OS X 10.10.5

[Build Bot]

Comment on attachment 282588 [details]
patch

Attachment 282588 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/1609387

New failing tests:
js/parser-syntax-check.html

[Build Bot]

Created attachment 282598 [details]
Archive of layout-test-results from ews104 for mac-yosemite-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews104  Port: mac-yosemite-wk2  Platform: Mac OS X 10.10.5

[Build Bot]

Comment on attachment 282588 [details]
patch

Attachment 282588 [details] did not pass mac-debug-ews (mac):
Output: http://webkit-queues.webkit.org/results/1609396

New failing tests:
js/parser-syntax-check.html

[Build Bot]

Comment on attachment 282588 [details]
patch

Attachment 282588 [details] did not pass ios-sim-ews (ios-simulator-wk2):
Output: http://webkit-queues.webkit.org/results/1609398

New failing tests:
js/parser-syntax-check.html

[Build Bot]

Created attachment 282600 [details]
Archive of layout-test-results from ews113 for mac-yosemite

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews113  Port: mac-yosemite  Platform: Mac OS X 10.10.5

[Build Bot]

Created attachment 282601 [details]
Archive of layout-test-results from ews124 for ios-simulator-wk2

The attached test failures were seen while running run-webkit-tests on the ios-sim-ews.
Bot: ews124  Port: ios-simulator-wk2  Platform: Mac OS X 10.11.4

[Saam Barati]

interestingly, the tests succeed on my machine.
Let me try removing weird characters from the source.

[Saam Barati]

Created attachment 282603 [details]
patch

[WebKit Commit Bot]

Attachment 282603 [details] did not pass style-queue:


ERROR: Source/JavaScriptCore/parser/Lexer.cpp:1786:  Place brace on its own line for function definitions.  [whitespace/braces] [4]
Total errors found: 1 in 7 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Mark Lam]

Comment on attachment 282603 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=282603&action=review

r=me with revised ChangeLog per our offline conversation.

> Source/JavaScriptCore/parser/Lexer.cpp:1786
> +    auto prepareToReturnToken = [&] (int lineNumber, int endOffset, int lineStartOffset, JSTextPosition endPosition) {

Let's call this lambda "fillTokenInfo" instead,  I think that would be more descriptive of what it does than "prepareToReturnToken".

[Saam Barati]

landed in:
http://trac.webkit.org/changeset/202768