465366 - TM: Can't make payment on Capital One credit card with jit on

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Boris Zbarsky [:bzbarsky]]

Attachment: Testcase

The problem is that the date validator on the site fails to validate the date "11/17/2008", but only when the jit is enabled.  This prevents me from paying my credit card bill (well, until I disable jit, which is not something users will think of).

JS shell testcase attached.  It's not as minimal as it could perhaps be, but it's 2 orders of magnitude smaller than the site.  ;)  It exercises what look like several different bustages.  Basically, it looks like we bail out of the loop in VAM_ParseInt way too early (sometimes after 0 iterations) even though the length is correct.

Not sure whether this needs to block beta.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Er, the |x = ...| should be |global.x = ...|.  Not that this affects the
testcase.

Comment 2

[Andreas Gal :gal]

Attachment: simplified testcase

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Even simpler

Comment 4

[Andreas Gal :gal]

Attachment: further reduced

Comment 5

[Andreas Gal :gal]

Attachment: further reduced

Comment 6

[Andreas Gal :gal]

Attachment: patch

Comment 7

[Andreas Gal :gal]

Nasty bug. Nice catch bz. Your shell test cases rock as usual.

Comment 8

[Bob Clary [:bc] (inactive)]

nom for b2.

Comment 9

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 348602 [details] [diff] [review]
patch

Whoops, nice bug.  

JS_ASSERT(cx->fp->regs->pc == f->ip);

in js_RecordTree is a good idea

Comment 10

[Andreas Gal :gal]

Pushed to TM.

http://hg.mozilla.org/tracemonkey/rev/b8f6e95832c6

Comment 11

[Damon Sicore (:damons)]

reopening, marking blocking beta2, will close once landed on m-c.

Comment 12

[Boris Zbarsky [:bzbarsky]]

I pushed the original test here into trace-tests too.

Comment 13

[Bob Clary [:bc] (inactive)]

bug 463956 also covers this with ecma/GlobalObject/15.1.2.5-1.js, ecma/GlobalObject/15.1.2.4.js

Comment 14

[Mike Beltzner [:beltzner, not reading bugmail]]

Fixed in the merge pushed by vlad on Nov 18 14:11:14 2008 -0800:
http://hg.mozilla.org/mozilla-central/rev/e8ed5d4bf531

Comment 15

[Bob Clary [:bc] (inactive)]

added test in http://hg.mozilla.org/mozilla-central/rev/79a5db81b187 and cvs

Comment 16

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2