682345 - TI: Crash on Heap

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on TI revision d60ffe67a13f (run with -j -m -n -a), tested on 64 bit:


for (var i = 0; i <= 0x017f; i++) {
    var U = new Unicode(i);
}
function Unicode(c) {
    u = GetUnicodeValues(c);
    this.upper = u[0];
}
function GetUnicodeValues(c) {
    u = new Array();
    if ((c >= 0x0100 && c < 0x0138) || (c > 0x0149 && c < 0x0178)) try {} finally {
        return;
    }
    return u;
}

Comment 1

[Christian Holler (:decoder)]

Note that this test does not reproduce anymore on tip. Filed at request of bhackett to investigate if it was fixed by a later revision.

Comment 2

[Brian Hackett [Laid off!]]

This bug was still on tip even though it didn't manifest, regression from bug 680951 a few days ago.  This bug added a new kind of type barrier used for accesses on undefined properties of singleton objects.  If the property was later explicitly assigned 'undefined', then a second type barrier needed to be generated for accesses on the singleton, and the presence of the first barrier incorrectly caused the second to be filtered out (the first one is less strict about the circumstances it must be observed by an opcode).  The fix corrects the detect-duplicates logic for type barriers.

http://hg.mozilla.org/projects/jaegermonkey/rev/9a0172368402

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug682345.js.