617712 - TypeInference: crash in debug and release builds

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

---
for(var i=0; i<25; i++) {
    var a, b;
    function f() { 
    }
    a = f();
    b = (123 ^ 1) / 1234;
}
---
Looks like it crashes in PIC-like code.

Comment 1

[Jan de Mooij [:jandem]]

(In reply to comment #0)
> Looks like it crashes in PIC-like code.

On closer look, it's "just" crashing in the loop body.
Btw, why do we generate an OOL call to stubs::Div here?

Comment 2

[Brian Hackett [Laid off!]]

One tricky thing is that the inference doesn't constant fold, and it thinks (int / int) produces an int.  So when the compiler comes along and constant folds, it triggers an overflow which would normally require updating the type pushed by the division.  That can't happen during compilation, as updating the pushed type could flow anywhere and trigger type changes in the code already compiled in the script.

This is currently addressed by not constant-folding binops which overflow, which breaks the property described in bug 617592 comment 1 (a recompilation could mark the result as a double and allow the constant fold, leading to future constant folding).  This needs to get fixed (it's also causing bug 617670), but might not happen for some time as I've just been retasked to work on blockers.

Comment 3

[Brian Hackett [Laid off!]]

This was fixed by the patch in bug 617670.

http://hg.mozilla.org/projects/jaegermonkey/rev/c247104a1499