464645 - endless loop in javascript for-in when compiling with Sun Studio 12 with -xO0 -g

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Ginn Chen]

a simple test case take from trace-test.js

     var falsies  = [null, undefined, false, NaN, 0, ""];
     var j;
     for (j in falsies) {
                print (j);
     }

The problem is at
http://mxr.mozilla.org/mozilla-central/source/js/src/jsinterp.cpp#3207

3201           BEGIN_CASE(JSOP_NEXTITER)
3202             JS_ASSERT(regs.sp - 2 >= StackBase(fp));
3203             JS_ASSERT(!JSVAL_IS_PRIMITIVE(regs.sp[-2]));
3204             if (!js_CallIteratorNext(cx, JSVAL_TO_OBJECT(regs.sp[-2]), &regs.sp[-1]))
3205                 goto error;
3206             LOAD_INTERRUPT_HANDLER(cx);
3207             PUSH(BOOLEAN_TO_JSVAL(regs.sp[-1] != JSVAL_HOLE));
3208             TRACE_0(IteratorNextComplete);
3209           END_CASE(JSOP_NEXTITER)

LINE 3207 is as same as
( * regs.sp ++ = BOOLEAN_TO_JSVAL(regs.sp[-1] != JSVAL_HOLE));

The behavior is undefined to compiler.
It can be
temp = BOOLEAN_TO_JSVAL(regs.sp[-1] != JSVAL_HOLE);
*regs.sp++ = temp;
or
temp = regs.sp++;
*temp = BOOLEAN_TO_JSVAL(regs.sp[-1] != JSVAL_HOLE);

Comment 1

[Ginn Chen]

Attachment: patch

Comment 2

[Brendan Eich [:brendan]]

Comment on attachment 347948 [details] [diff] [review]
patch

Whoops! Thanks very much, Ginn. I will commit this to the tracemonkey repo right away, so it will get into m-c soon (for beta 2 of Firefox 3.1).

/be

Comment 3

[Brendan Eich [:brendan]]

Fixed in tracemonkey:

http://hg.mozilla.org/tracemonkey/rev/5804f5597d3d

/be

Comment 4

[Brendan Eich [:brendan]]

This bug should be closed when we sync tracemonkey with mozilla-central.

/be

Comment 5

[Bob Clary [:bc] (inactive)]

test covered in js1_8_1/trace/trace-test.js

Comment 6

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2