Closed Bug 625718 Opened 9 years ago Closed 9 years ago

Crash in mjit generated code

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set

Tracking

()

RESOLVED FIXED
Tracking Status
blocking2.0 --- betaN+

People

(Reporter: jandem, Assigned: cdleary)

References

Details

(Whiteboard: fixed-in-tracemonkey, hardblocker)

Attachments

(3 files)

Attached file Testcase
Attached file crashes with -m in mjit-generated code.
Attached file Stacktrace
Attachment #503809 - Attachment mime type: application/octet-stream → text/plain
Reduced to this:
---
var o3 = new String("foobarbaz");
var o10 = Math;
var o11 = function() {};

function f3(o) { return o; };
function f4(o) { o.g4 = function() {}; };

for(var i=0; i<20; i++) {
    o11[3] = undefined;
    f4(o3);
    f3(o3);
    f4(o11);
    f4(o10);
}
Further reduced:
--
function f3() { return 2; };
function f4(o) { o.g4 = function() {}; };

var f = function() {};
f.x = undefined;
f4(new String("x"));
f3();
f4(f);

for(var i=0; i<20; i++) {
    f4(Math);
}
I had another testcase that crashed with -m -j  but not with -m. After reducing, it crashes also with -m and I think it's the same issue. It might be easier to debug:
---
var arr = [];
var obj = {};

function f1(o) { 
    o.x = function() {}; 
};
function f2() {};

f1(arr);
f2();
f1(obj);

for(var i=0; i<100; i++) {
    f1(arr);
}
Jacob said he could run the patch on ARM (and hopefully fix it if it's only a little broken :-) seeing as how I left my ARM board in the office.
Assignee: general → cdleary
Status: NEW → ASSIGNED
Attachment #503841 - Flags: review?(Jacob.Bramley)
Attachment #503841 - Flags: feedback?(Jacob.Bramley)
Comment on attachment 503841 [details] [diff] [review]
Correct and de-uglify setprop labels.

Giving r+ based on a code review. I'm still testing on ARM, but it doesn't look like it will cause problems.
Attachment #503841 - Flags: review?(Jacob.Bramley)
Attachment #503841 - Flags: review+
Attachment #503841 - Flags: feedback?(Jacob.Bramley)
Attachment #503841 - Flags: feedback+
http://hg.mozilla.org/tracemonkey/rev/fb2192c7b8c2
Group: core-security
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/fb2192c7b8c2
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
blocking2.0: --- → betaN+
Whiteboard: fixed-in-tracemonkey → fixed-in-tracemonkey, hardblocker
Blocks: 630996
You need to log in before you can comment on or make changes to this bug.