416354 - Missing SAVE_SP_AND_PC in JSOP_NEG

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Igor Bukanov]

JSOP_NEG in the interpreter calls js_NewNumberValue without calling SAVE_SP_AND_PC when the top of the stack is a double value. This leads to a GC hazard as the following example demonstrates:

~/m/ff/mozilla/js/src $ cat ~/m/y.js
function f(a, b, c)
{
    return (-a) * ((-b) * (-c));
}

var expect = f(1.5, 1.25, 1.125);
gczeal(2);
var actual = f(1.5, 1.25, 1.125);
if (actual !== expect)
    throw "GC hazard, expect="+expect+" actual="+actual;
~/m/ff/mozilla/js/src $ ./Linux_All_DBG.OBJ/js ~/m/y.js
uncaught exception: GC hazard, expect=-2.109375 actual=-1.58203125

Comment 1

[Igor Bukanov]

Attachment: v1

The fix makes sure that SAVE_SP_AND_PC is called at the right moment.

Comment 2

[Igor Bukanov]

Asking for blocking flags as this is a GC hazard on the trunk and 1.8.1 branch.

Comment 3

[Igor Bukanov]

I checked in the patch from comment 1 to the trunk:

http://bonsai.mozilla.org/cvsquery.cgi?module=PhoenixTinderbox&branch=HEAD&cvsroot=%2Fcvsroot&date=explicit&mindate=1202507940&maxdate=1202508086&who=igor%25mir2.org

Comment 4

[Igor Bukanov]

Comment on attachment 302122 [details] [diff] [review]
v1

The patch applies to the 181 branch as is.

Comment 5

[Daniel Veditz [:dveditz]]

Comment on attachment 302122 [details] [diff] [review]
v1

approved for 1.8.1.13, a=dveditz for release-drivers

Comment 6

[Bob Clary [:bc] (inactive)]

Attachment: js1_5/extensions/regress-416354.js

Comment 7

[Bob Clary [:bc] (inactive)]

v

Comment 8

[Igor Bukanov]

I checked in the patch from comment 1 to MOZILLA_1_8_BRANCH:

Checking in jsinterp.c;
/cvsroot/mozilla/js/src/jsinterp.c,v  <--  jsinterp.c
new revision: 3.181.2.96; previous revision: 3.181.2.95
done

Comment 9

[Bob Clary [:bc] (inactive)]

v 1.8.1 linux|mac 10.5

Comment 10

[Alexander Sack]

igor, what should we do with these SAVE_SP_AND_PC on the 1.8.0 branch?

Comment 11

[Igor Bukanov]

(In reply to comment #10)
> igor, what should we do with these SAVE_SP_AND_PC on the 1.8.0 branch?

The bug does not exist on 1.8.0 branch.

Comment 12

[Alexander Sack]

thanks. not a 1.8.0 branch bug.

Comment 13

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/extensions/regress-416354.js,v  <--  regress-416354.js
initial revision: 1.1