Verifier and jit-Debugger don't always agree about variable types

VERIFIED FIXED in flash10.1

Status

P2
normal
VERIFIED FIXED
9 years ago
9 years ago

People

(Reporter: edwsmith, Assigned: edwsmith)

Tracking

unspecified
flash10.1
Bug Flags:
flashplayer-qrb +

Details

(Whiteboard: verifier-cleanup)

Attachments

(1 attachment, 1 obsolete attachment)

(Assignee)

Description

9 years ago
The basic flow through the code is:

1. verifier models the types of an operator
2. verifier calls CodeWriter interface, sometimes passing type information
3. jit genertates code, and saves result Traits* for debugger to use later
4. verifier calls FrameState.setType with the modelled result type

The types from step (3) and (4) sometimes are different, which will cause the debugger to be confusing, best, or possibly crash.  Moreover, sometimes the jit must recompute or guess a type and assert it's guess, because information in the verifier is not passed through the codeWriter interface in step 2.
(Assignee)

Updated

9 years ago
Blocks: 413522
(Assignee)

Comment 1

9 years ago
The jit has class DebuggerCheck for sanity checking that the expressions in each variable slot have compatible LIR instruction types with the saved Traits*, but it runs in step 3 before the verifier has called FrameState.setType().
(Assignee)

Comment 2

9 years ago
Created attachment 427241 [details] [diff] [review]
Pass verifier-determined result types down into CodeWriter, and use them in the jit.
Assignee: nobody → edwsmith
Status: NEW → ASSIGNED
(Assignee)

Updated

9 years ago
Target Milestone: --- → Future

Updated

9 years ago
Flags: flashplayer-qrb+
Priority: -- → P2
Whiteboard: verifier-cleanup
Target Milestone: Future → flash10.1
(Assignee)

Comment 3

9 years ago
Created attachment 428608 [details] [diff] [review]
(v2) Pass verifier-determined result types down into CodeWriter, and use them in the jit.

Pass verifier type information to CodeWriter so the jit can use it directly instead of second guessing.

In a handful of cases, the JIT was not marking the result of an opcode with the same type as the verifier.  This will cause confusion and crashes when debugging, at best.

This patch is slightly bigger than necessary, for consistency's sake: several additional opcodes were updated to pass type to CodeWriter, even though the jit already was using the correct type.
Attachment #428608 - Flags: review?(rreitmai)
(Assignee)

Updated

9 years ago
Attachment #427241 - Attachment is obsolete: true

Updated

9 years ago
Attachment #428608 - Flags: review?(rreitmai) → review+
(Assignee)

Comment 4

9 years ago
pushed
http://hg.mozilla.org/tamarin-redux/rev/431a693e1689
Status: ASSIGNED → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED

Comment 5

9 years ago
verified in argo
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.