657975 - TI: Crash [@ js::types::TypeFailure] involving missing type at #2:00008 pushed 0: string, with trap

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f(){ "use strict"; options('strict'); }
dis(f)
trap(f, 0, '')
f()

crashes js debug shell on JM changeset 5d1cbc94bc42 with -d, -a and -n at js::types::TypeFailure with the message:

[infer failure] Missing type at #2:00008 pushed 0: string

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

flags: NULL_CLOSURE
off     op
-----   --
main:
00000:  callname "options"              <-- trap goes here
00005:  string "strict"
00008:  call 1
00011:  pop
00012:  stop

Source notes:
 ofs  line    pc  delta desc     args
---- ---- ----- ------ -------- ------
  0:    1     8 [   8] xdelta  
  1:    1     8 [   0] pcbase   offset 8

[infer failure] Missing type at #2:00008 pushed 0: string

Comment 2

[Brian Hackett [Laid off!]]

The trap at the CALLNAME caused us to process it incorrectly and not mark the result which the interpreter pushed.  Lots of possible problems with traps in analysis and inference code, for the below revision went through pc dereferences in these files and either added untraps or asserted trap-ness (in cases where the caller must untrap).

http://hg.mozilla.org/projects/jaegermonkey/rev/176ee6b37ad0

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug657975.js.