Closed Bug 1204468 Opened 4 years ago Closed 2 years ago

ARMv6: asm.js atomics do not throw RangeError on OOB access

Categories

(Core :: JavaScript Engine: JIT, defect, P5)

ARM
All
defect

Tracking

()

RESOLVED WONTFIX

People

(Reporter: lth, Unassigned)

References

(Blocks 1 open bug)

Details

This should have been fixed by bug 1178793 but was not, very likely because the ARMv6 code uses call-outs that were not updated and we're not actually testing on ARMv6.

On a Raspberry Pi model 1:

pi@raspberrypi:~/moz/js/src/jit-test$ ./jit_test.py ~/js testAtomics.js
/home/pi/moz/js/src/jit-test/lib/asserts.js:85:15 Error: Assertion failed: expected exception RangeError, no exception thrown
Exit code: 3
FAIL - asm.js/testAtomics.js
Reproduce on simulator with ARMHWCAP=hardfp,vfp, which forces the ARMv6 path.

The problem is that Lowering-arm.cpp lowers to special "Callout" LIR nodes, and these need to have range checking logic as well.  The C++ methods do contain range checks but return 0.  The code generated for the callout can either explicitly check the range and throw, or it can perhaps check the result of the callout.
Priority: -- → P3
Assignee: lhansen → nobody
Status: ASSIGNED → NEW
ARMv6 is Tier-3.
Priority: P3 → P5
We ripped out the ARMv6 callout support some time ago.  We're no longer supporting that architecture, and MIPS generates in-line machine code for similar cases and does not use the callout support.
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.