633020 - ArgSetter can return false without reporting an error on trace

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jason Orendorff [:jorendorff]]

function f(b) {
    var a = [];
    for (var i = 0; i < 20; i++)
        a[i] = {};
    a[19] = arguments;
    for (var i = 0; i < 20; i++)
        a[i][0] = i;  // script terminates here
    assertEq(b, 19);  // we never get here
}
f(null);
print("PASSED");  // we never get here

Patch coming.

Comment 1

[Jason Orendorff [:jorendorff]]

Attachment: v1

Comment 2

[Jason Orendorff [:jorendorff]]

If you apply the patch, then run the test without building, you'll notice that
the jit-test test harness doesn't actually detect this situation as an error.

That is because the js executable doesn't detect this kind of internal error. It exits normally either way. I think the solution is to assert that this never happens; see bug 633033.

Comment 3

[Jason Orendorff [:jorendorff]]

Comment on attachment 511219 [details] [diff] [review]
v1

Setting a?. This isn't a blocker but I'd like to get it in. Correctness bug.

Comment 4

[Jason Orendorff [:jorendorff]]

http://hg.mozilla.org/tracemonkey/rev/1a043548af6e

Comment 5

[Chris Leary [:cdleary] (not checking bugmail)]

cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/1a043548af6e