878495 - Crash [@ js_DisassembleAtPC] with "use asm"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

disassemble("-r", (function() {
    (function() {
        "use asm"
        return {}
    })()
}))

crashes js debug shell on m-c changeset 18fc62fd8dcc without any CLI arguments at js_DisassembleAtPC

Comment 1

[Jesse Ruderman]

Regression from bug 851421?

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Yep.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/30b977b2b911
user:        Nicholas Nethercote
date:        Thu Mar 14 18:44:03 2013 -0700
summary:     Bug 851421 (part 2) - Don't emit bytecode for asm.js functions unless linking fails.  r=luke.

Comment 3

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: proposed fix + test case

The script is set to NULL if the function is native; in this case, there is no need to recursively apply the function.

Comment 4

[Luke Wagner [:luke]]

Comment on attachment 759390 [details] [diff] [review]
proposed fix + test case

Thanks!  Do you suppose you could change this so that, in the !script case, we Sprint something like "[native code]"?

Comment 5

[Benjamin Bouvier [:bbouvier] (inactive)]

The current behaviour of dis() and disassemble() is to throw an error if there is no script: "typein:2:0 Error: only works on scripts".
So this is doable, but this would change dis / disassemble (and similar functions) behaviours.

Comment 6

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: print "native code" instead of nothing, as discussed

Comment 7

[Luke Wagner [:luke]]

Comment on attachment 759525 [details] [diff] [review]
print "native code" instead of nothing, as discussed

Thanks!

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d6db31e46b02

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Backed out for test failures (see the comments in bug 878435).
https://hg.mozilla.org/integration/mozilla-inbound/rev/a15f36c774a8

Comment 10

[Luke Wagner [:luke]]

Ugh, I should have caught this; some shell functions are only available in debug builds (like dis and disassemble).  Try "if (disassemble)" (but double check me that this fixes the problem ;)

Comment 11

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: patch + test case that runs even in opt builds

if (disassemble) was not enough as "disassemble" was not defined. This test case passes in debug and opt builds and does what we expect. One can check by printing the result of disassemble: in debug mode, it will print the disassembled bytecode; in opt mode it won't print anything.

Comment 12

[Luke Wagner [:luke]]

Comment on attachment 759831 [details] [diff] [review]
patch + test case that runs even in opt builds

Thanks!

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5860d85b0006

Comment 14

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/5860d85b0006