ArgSetter can return false without reporting an error on trace

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
7 years ago
7 years ago

People

(Reporter: jorendorff, Assigned: jorendorff)

Tracking

Other Branch
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [fixed-in-tracemonkey])

Attachments

(1 attachment)

(Assignee)

Description

7 years ago
function f(b) {
    var a = [];
    for (var i = 0; i < 20; i++)
        a[i] = {};
    a[19] = arguments;
    for (var i = 0; i < 20; i++)
        a[i][0] = i;  // script terminates here
    assertEq(b, 19);  // we never get here
}
f(null);
print("PASSED");  // we never get here

Patch coming.
(Assignee)

Comment 1

7 years ago
Created attachment 511219 [details] [diff] [review]
v1
Assignee: general → jorendorff
Attachment #511219 - Flags: review?(dmandelin)
(Assignee)

Comment 2

7 years ago
If you apply the patch, then run the test without building, you'll notice that
the jit-test test harness doesn't actually detect this situation as an error.

That is because the js executable doesn't detect this kind of internal error. It exits normally either way. I think the solution is to assert that this never happens; see bug 633033.
Attachment #511219 - Flags: review?(dmandelin) → review+
(Assignee)

Comment 3

7 years ago
Comment on attachment 511219 [details] [diff] [review]
v1

Setting a?. This isn't a blocker but I'd like to get it in. Correctness bug.
Attachment #511219 - Flags: approval2.0?

Updated

7 years ago
Attachment #511219 - Flags: approval2.0? → approval2.0+
(Assignee)

Comment 4

7 years ago
http://hg.mozilla.org/tracemonkey/rev/1a043548af6e
Whiteboard: [fixed-in-tracemonkey]
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.