477228 - Attempting to modify read-only Number.NEGATIVE_INFINITY crashes vm

Status: VERIFIED FIXED

(Tamarin Graveyard :: Baseline JIT (CodegenLIR), defect, P3)

Description

[Brent Baker]

ecma3/Number/e15_7_3_5_3_rt should produce a runtime error that you can't write to a ready-only property but instead is now crashing the VM.

This is a nanojit issue as it produces the proper error when running in -Dinterp

Number.NEGATIVE_INFINITY=0;

Comment 1

[Brent Baker]

Added expectedfail to the acceptance/testconfig.txt (1407:0c0f3cf40ad0)

Comment 2

[Trevor Baker]

not a blocking issue for 469836; arm nanojit is new so this is not a regression for this platform.

Comment 3

[Rick Reitmaier]

not easy to isolate out of test scripts...

Comment 4

[Brent Baker]

Agreed, issue is NOT with Number.NEGATIVE_INFINITY=0; but is some combination in the entire abc file. I can run chunks of the test no problem, but running the entire thing on ARM with the JIT is crashing, but using -Dinterp will execute properly....

Comment 5

[Rick Reitmaier]

Attachment: ver 1 - fix for bug

Turns out that we were releasing the stack slot prior to obtaining the temp register for the load portion of asm_mmq().   A subsequent findRegFor() triggered a spill (since all regs were used in this example; hence we now see why it was hard to repro) and the same stack slot was given for the spill instruction.  Blamo! 

Moving the release of the stack slot to the bottom of the method clears up the issue, although technically we can probably just free the used register.  Better to be more conservative for now.

Comment 6

[Rick Reitmaier]

Attachment: ver 1 - debugging support

In the course of debugging this issue, I cleaned up printActivationState() so it actually works and also tweaked the jitmax code so that it takes an optional range of methods to be jit'd.   So you can now specify things like -jitmax 2- or -jitmax 5-6 or -jitmax -5.  

Both of which proved quite handy in tracking the bug down.

Comment 7

[Edwin Smith]

Comment on attachment 367139 [details] [diff] [review]
ver 1 - fix for bug

please add your comments for the attachment into the code (adjusted so a month from now we'll know whats going on in the code)

Comment 8

[Rick Reitmaier]

pushed dbb0fa875f22: bug 477228 (ARM jit) and jitmax enhancements - rev 1593

Comment 9

[Brent Baker]

Removed the expected fail, pushed as 1596:74e23e3686ef