533298 - line table mapping of PC to line number incorrect

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[John J. Barton]

Original report on Firebug site:
http://code.google.com/p/fbug/issues/detail?id=496
Test case online:
https://fbug.googlecode.com/svn/tests/issues/496/test.html

The test case function maps PC 134 to line 18, but it should be the exit point of the function I guess.

Comment 1

[James Ross]

Use http://fbug.googlecode.com/svn/tests/issues/496/test.html (no SSL) to avoid the login. Also, I'd guess this is a SpiderMonkey bug if the PC/line map data is buggy, since JSD gets it through public APIs IIRC.

Comment 2

[timeless]

Attachment: file

Comment 3

[timeless]

timeless-mbp-2:bin timeless$ ./js -f /tmp/533298.js -f -
js> dissrc(test)
;-------------------------   6: function test() {
00000:   6  trace
;-------------------------   7:     var v10 = 10;
00001:   7  int8 10
00003:   7  setlocal 0
00006:   7  pop
;-------------------------   8:     var v20 = 20;
00007:   8  int8 20
00009:   8  setlocal 1
00012:   8  pop
;-------------------------   9:     var v30 = 30;
00013:   9  int8 30
00015:   9  setlocal 2
00018:   9  pop
;-------------------------  10: 
;-------------------------  11:     if (v10 >= v20) {
00019:  11  getlocal 0
00022:  11  getlocal 1
00025:  11  ge
00026:  11  ifeq 78 (52)
;-------------------------  12:         if (v10 >= v30)
00029:  12  getlocal 0
00032:  12  getlocal 2
00035:  12  ge
00036:  12  ifeq 75 (39)
;-------------------------  13:             console.log(v10+">="+v20+" and "+v10+">="+v30);
00039:  13  name "console"
00042:  13  callprop "log"
00045:  13  getlocal 0
00048:  13  string ">="
00051:  13  getlocal 1
00054:  13  string " and "
00057:  13  getlocal 0
00060:  13  string ">="
00063:  13  getlocal 2
00066:  13  concatn 6
00069:  13  add
00070:  13  call 1
00073:  13  trace
00074:  13  pop
00075:  13  goto 193 (118)
;-------------------------  14:     }
;-------------------------  15:     else {
;-------------------------  16:       if (v20 >= v10) {
00078:  16  getlocal 1
00081:  16  getlocal 0
00084:  16  ge
00085:  16  ifeq 137 (52)
;-------------------------  17:         if (v20 >= v30) {  // pc = 94, line 17, then pc jumps to 134, but reports line 18 BUG
00088:  17  getlocal 1
00091:  17  getlocal 2
00094:  17  ge
00095:  17  ifeq 134 (39)
;-------------------------  18:             console.log(v20+">="+v10+" and "+v20+">="+v30);  // line 18
00098:  18  name "console"
00101:  18  callprop "log"
00104:  18  getlocal 1
00107:  18  string ">="
00110:  18  getlocal 0
00113:  18  string " and "
00116:  18  getlocal 1
00119:  18  string ">="
00122:  18  getlocal 2
00125:  18  concatn 6
00128:  18  add
00129:  18  call 1
00132:  18  trace
00133:  18  pop
00134:  18  goto 193 (59)
;-------------------------  19:         }
;-------------------------  20:       }
;-------------------------  21:       else if (v30 >= v10) {
00137:  21  getlocal 2
00140:  21  getlocal 0
00143:  21  ge
00144:  21  ifeq 193 (49)
;-------------------------  22:           if (v30 >= v20) {
00147:  22  getlocal 2
00150:  22  getlocal 1
00153:  22  ge
00154:  22  ifeq 193 (39)
;-------------------------  23:               console.log(v30+">="+v10+" and "+v30+">="+v20);
00157:  23  name "console"
00160:  23  callprop "log"
00163:  23  getlocal 2
00166:  23  string ">="
00169:  23  getlocal 0
00172:  23  string " and "
00175:  23  getlocal 2
00178:  23  string ">="
00181:  23  getlocal 1
00184:  23  concatn 6
00187:  23  add
00188:  23  call 1
00191:  23  trace
00192:  23  pop
;-------------------------  24:         }
;-------------------------  25:       }
;-------------------------  26:     }
00193:  26  stop

This is what spidermonkey says. I'm not certain there's a bug at all, but if there is, it isn't in jsd.

Comment 4

[John J. Barton]

(In reply to comment #3)
...
> ;-------------------------  17:         if (v20 >= v30) {  // pc = 94, line 17,
> then pc jumps to 134, but reports line 18 BUG
> 00088:  17  getlocal 1
> 00091:  17  getlocal 2
> 00094:  17  ge
> 00095:  17  ifeq 134 (39)
^^^^^^^^^^^^^^note PC 134
> ;-------------------------  18:             console.log(v20+">="+v10+" and
> "+v20+">="+v30);  // line 18
> 00098:  18  name "console"
> 00101:  18  callprop "log"
> 00104:  18  getlocal 1
> 00107:  18  string ">="
> 00110:  18  getlocal 0
> 00113:  18  string " and "
> 00116:  18  getlocal 1
> 00119:  18  string ">="
> 00122:  18  getlocal 2
> 00125:  18  concatn 6
> 00128:  18  add
> 00129:  18  call 1
> 00132:  18  trace
> 00133:  18  pop
> 00134:  18  goto 193 (59)
----------^^----------------- This is a bug.
...
> 
> This is what spidermonkey says. I'm not certain there's a bug at all, but if
> there is, it isn't in jsd.

Thanks! The problem here is that PC 134 is assigned to line 18, but it should be assigned to line 19. When the branch is taken to PC 134, the closing brace should be shown.

Comment 5

[Ye Yan]

Hi John, it seems to me that the issue here is not really that PC 134 is assigned to line 18, but rather that PC 95 is jumping to PC 134 instead of directly to PC 193 (the stop).  The reason I think PC 134 should be assigned line 18 is that, had line 17 been "if (v20 <= 30)", program flow would have gone to line 18, and PC 134 would have been executed as part of line 18.  Do you agree?

Comment 6

[John J. Barton]

Could be, comment 4 was just a guess on my part. I know its a bug, but I don't know how to get it fixed.

Comment 7

[Sebastian Zartner [:sebo]]

I just wanted to note, that this is still an issue when I try the test case on FF 11.0a1 and FB 1.9.0b2.

Comment 8

[Sebastian Zartner [:sebo]]

This seems to be working correctly now using FF 25.0.1 + FB 1.12.5 on Win8.1.

Sebastian

Comment 9

[André Bargull [:anba]]

Closing per comment #8.