Beginning on October 25th, 2016, Persona will no longer be an option for authentication on BMO. For more details see Persona Deprecated.
Last Comment Bug 655505 - TI+JM: Assertion failure: checkedFreeRegs == a->freeRegs, at FrameState.cpp:1371
: TI+JM: Assertion failure: checkedFreeRegs == a->freeRegs, at FrameState.cpp:1371
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: Jan de Mooij [:jandem]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: infer-regress
  Show dependency treegraph
Reported: 2011-05-07 10:15 PDT by Jan de Mooij [:jandem]
Modified: 2011-05-09 15:07 PDT (History)
4 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Patch (7.21 KB, patch)
2011-05-07 10:58 PDT, Jan de Mooij [:jandem]
bhackett1024: review+
Details | Diff | Splinter Review
Fix fixDoubleTypes (12.63 KB, patch)
2011-05-09 02:18 PDT, Jan de Mooij [:jandem]
bhackett1024: review+
Details | Diff | Splinter Review

Description Jan de Mooij [:jandem] 2011-05-07 10:15:24 PDT
Mochitest-4 asserts with this and decoder posted a fuzz test case on IRC.
Comment 1 Jan de Mooij [:jandem] 2011-05-07 10:58:58 PDT
Created attachment 530860 [details] [diff] [review]
Comment 2 Brian Hackett (:bhackett) 2011-05-07 11:11:51 PDT
Comment on attachment 530860 [details] [diff] [review]

Review of attachment 530860 [details] [diff] [review]:

::: js/src/methodjit/Compiler.cpp
@@ +1331,4 @@
>              for (unsigned i = 0; i < fixedDoubleEntries.length(); i++) {
>                  FrameEntry *fe = frame.getOrTrack(fixedDoubleEntries[i]);
>                  frame.ensureInteger(fe);
> +                frame.assertValidRegisterState();

Not sure about these; the assertValidRegisterState before setting jumpMap should catch these shortly, and these assertions might be expensive to run.

@@ +1343,5 @@
>                      FrameEntry *fe = frame.getOrTrack(slot);
>                      JS_ASSERT(!fe->isType(JSVAL_TYPE_DOUBLE));
>                  }
>              }
> +            frame.assertValidRegisterState();

This one shouldn't be necessary, the code above it does not mutate the FS.
Comment 3 Jan de Mooij [:jandem] 2011-05-07 11:48:51 PDT
OK I removed the calls. Now we assert before and after the bytecode switch, I think that's most important to determine where it went wrong.
Comment 4 Jan de Mooij [:jandem] 2011-05-09 02:18:14 PDT
Created attachment 531000 [details] [diff] [review]
Fix fixDoubleTypes

There was another bug here, we could call fixDoubleTypes twice for the same op, causing incorrect results because the same entry is converted twice. Now fixDoubleTypes is only called from generateMethod. Mochitest-4 test_transitions is green with this patch.
Comment 5 Brian Hackett (:bhackett) 2011-05-09 06:14:31 PDT
Comment on attachment 531000 [details] [diff] [review]
Fix fixDoubleTypes

Nice factoring, this was being done in a pretty sloppy fashion.
Comment 6 Jan de Mooij [:jandem] 2011-05-09 15:07:08 PDT

Note You need to log in before you can comment on or make changes to this bug.