433950 - Verification error (Stack Overflow) due to VM calling method on null reference; ASC?

Status: RESOLVED INVALID

(Tamarin Graveyard :: Virtual Machine, defect)

Description

[Chris Peyer]

Unfortunately, I haven't been able to narrow this bug down to a VM only case.  Here's the report from Jeff Mott:

The attached FLA generates the errors below in test movie.  The exception dialog in the standalone player just gives the final stack overflow error.  The VM seems to be confused by the code, and is trying to call a method on a null reference.  Tweaking the code in any of several ways allows the VM to figure out that the reference is null, at which point it throws a null error instead of a stack overflow.  Here’s the code:


import flash.text.engine.*

var normalFD:FontDescription = new FontDescription("Arial","normal")
var normalEF:ElementFormat = new ElementFormat(normalFD, 16)
var te1:TextElement = new TextElement ("Hello World", normalEF);

var group1:Vector.<ContentElement> = new Vector.<ContentElement>()
group1.push(te1)
var ge1:GroupElement = new GroupElement(group1)

var tb1:TextBlock = new TextBlock(ge1)
var line:TextLine = tb1.createTextLine();
line.y = 50;
line.x = 50;
addChild(line);
checkMetrics(line);

function checkMetrics(line:TextLine)
{
            var tb:TextBlock = line.textBlock;
            // If we use tb1 directly here, no stack overflow
            var ce:ContentElement = tb.content ;
            var ef:ElementFormat = ce.elementFormat;
            // ef is null.  But inside this function the vm tries to call getFontMetrics anyway.
            // Duplicating this code outside this function we get a null exception.  If we examine ef in any way
            // with an if test or even a trace, the VM realizes it is null and we get a null exception.
            //trace (ef)
            var metrics = ef.getFontMetrics();
}

Comment 1

[Chris Peyer]

Attachment: Stack overflow error.

Comment 2

[Chris Peyer]

Attachment: Fla file that causes stack overflow

Comment 3

[Chris Peyer]

Attachment: swf (created from attached fla) that causes stack overflow

Comment 4

[Lars T Hansen]

The error is a verification error, not a run-time error, and is in the current flashruntime-redux as well (tested standalone-debug-debugger).  Stepping through it we find that max_stack is 1, so the DUP instruction fails.  Looks like an ASC bug (though it could, at a stretch, be a verifier bug - computing the wrong value for max_stack).  To Jeff for triage.

Comment 5

[Jeff Dyer]

This bug is caused by the optimizer turned on by the -optimize switch. It is replacing a setlocal/getlocal pair with a dup without checking the max stack to make sure there is room for the extra operand.

The bug is real, but I'm not familiar enough with the optimizer to know the risk involved in attempting a fix. I would think fairly low, but then with Falcon, the optimizers life expectancy may be short.

Reassigning to Default for review.

Comment 6

[Lars T Hansen]

Jeff, please file an ASC bug and cross-reference that bug here, then close this bug.

Comment 7

[Jeff Dyer]

Moved to Jira: https://bugs.adobe.com/jira/browse/ASC-4338. Closing.