Last Comment Bug 657975 - TI: Crash [@ js::types::TypeFailure] involving missing type at #2:00008 pushed 0: string, with trap
: TI: Crash [@ js::types::TypeFailure] involving missing type at #2:00008 pushe...
Status: RESOLVED FIXED
: crash, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
: -- critical (vote)
: ---
Assigned To: general
:
Mentors:
Depends on:
Blocks: jsfunfuzz infer-regress
  Show dependency treegraph
 
Reported: 2011-05-18 10:44 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-14 08:33 PST (History)
4 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Gary Kwong [:gkw] [:nth10sd] 2011-05-18 10:44:31 PDT
function f(){ "use strict"; options('strict'); }
dis(f)
trap(f, 0, '')
f()

crashes js debug shell on JM changeset 5d1cbc94bc42 with -d, -a and -n at js::types::TypeFailure with the message:

[infer failure] Missing type at #2:00008 pushed 0: string
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2011-05-18 10:45:43 PDT
flags: NULL_CLOSURE
off     op
-----   --
main:
00000:  callname "options"              <-- trap goes here
00005:  string "strict"
00008:  call 1
00011:  pop
00012:  stop

Source notes:
 ofs  line    pc  delta desc     args
---- ---- ----- ------ -------- ------
  0:    1     8 [   8] xdelta  
  1:    1     8 [   0] pcbase   offset 8

[infer failure] Missing type at #2:00008 pushed 0: string
Comment 2 Brian Hackett (:bhackett) 2011-05-19 16:23:43 PDT
The trap at the CALLNAME caused us to process it incorrectly and not mark the result which the interpreter pushed.  Lots of possible problems with traps in analysis and inference code, for the below revision went through pc dereferences in these files and either added untraps or asserted trap-ness (in cases where the caller must untrap).

http://hg.mozilla.org/projects/jaegermonkey/rev/176ee6b37ad0
Comment 3 Christian Holler (:decoder) 2013-01-14 08:33:00 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug657975.js.

Note You need to log in before you can comment on or make changes to this bug.