625757 - Crash in methodjit generated code on 64-bit

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

This crashes with -m (64-bit OS X):
--
for(var i=0; i<20; i++) {
    var x = 5e-324;
}
--

Comment 1

[Jan de Mooij [:jandem]]

I can also reproduce this with revision http://hg.mozilla.org/tracemonkey/rev/b824cec25ece, before the PIC-patches landed.

Unfortunately cdleary was unable to reproduce this on Linux/X64, but I can reproduce on OS X in release and debug builds. Will bisect this now.

Comment 2

[Jan de Mooij [:jandem]]

The first bad revision is:
changeset:   60013:f497fca35415
user:        David Anderson <[e-mail]>
date:        Sat Jan 08 16:27:48 2011 -0800
summary:     Remove unsound global optimizations (bug 618007, r=brendan).

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Whoops, PunboxAssembler wasn't using the macro assembler interface to give back patchable addresses. The problem is some instructions look like:

PREFIX MOV_BYTE MODRM ADDRESS_OFFSET IMM32
                                            ^
Here, patching from the end of the instruction won't get you the address.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Blame is a red herring, bug 618007 didn't touch this code but it did increase the occurrence of this IC.

Comment 5

[Chris Leary [:cdleary] (not checking bugmail)]

Comment on attachment 503932 [details] [diff] [review]
fix

Makes perfect sense. Should have realized this could happen.

Comment 6

[Chris Leary [:cdleary] (not checking bugmail)]

Comment on attachment 503932 [details] [diff] [review]
fix

Oh, and we should add the test case in there as well for the push.

Comment 7

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix v2

This one fixes NunboxAssembler too.

Comment 8

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/b034f8e72b2f

Comment 9

[Chris Leary [:cdleary] (not checking bugmail)]

http://hg.mozilla.org/mozilla-central/rev/4275fce7591b

Comment 10

[Chris Leary [:cdleary] (not checking bugmail)]

cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/b034f8e72b2f