508146 - TM: Fix stack arithmetic for deeply nested closures

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[David Mandelin [:dmandelin]]

Attachment: Patch

While reading code to fix another bug, I noticed that the stack navigation arithmetic GetUpvarOnTrace had not been updated for the inclusion of |arguments| in the native stack area (see bug 453730). It fails on this test case:

function f(a, b) {
  function g(x, y) {
    function h(m, n) {
      function k(u, v) {
	for (var i = 0; i < 5; ++i) {
	  print(a + ' ' + b + ' ' + x + ' ' + y + ' ' + m + ' ' + n + ' ' + u + ' ' + v);
	}
      }
      k(m+1, n+1);
    }
    h(x+1, y+1);
  }
  g(a+1, b+1);
}

for (var i = 0; i < 5; ++i) {
  f(i, i+i);
}

It's really only m and n that get the wrong value, but I figure testing more rigorously isn't bad. 

The solution is simply to adjust the formulas to account for the presence of |arguments| on the trace stack right after the arguments and before the local slots.

Comment 1

[David Mandelin [:dmandelin]]

Pushed to TM as 691a47bca2ae.

Note that as of today, this doesn't affect release branch, as the patch that caused the problem (c76558a87dd9) hasn't been taken on branch.

Comment 2

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/691a47bca2ae

Comment 3

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/6ca5523844b0

Comment 4

[Bob Clary [:bc] (inactive)]

js/src/trace-test.js

Comment 5

[Bob Clary [:bc] (inactive)]

testNestedClosures
v 1.9.3, 1.9.2