683983 - IonMonkey: Crash building SSA on mjit test

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Anderson [:dvander] - inactive, e-mail if emergency]

Crashes on jit-test/tests/jaeger/bug642198.js:

#0  0x0844029b in js::ion::MBasicBlock::getSlot (this=0x0, index=1) at /home/dvander/mozilla/ionmonkey-central/js/src/ion/MIRGraph.cpp:178
#1  0x08441ad9 in js::ion::MBasicBlock::inheritPhis (this=0x0, header=0x856fbc0) at /home/dvander/mozilla/ionmonkey-central/js/src/ion/MIRGraph.cpp:717
#2  0x0843a074 in js::ion::IonBuilder::finishLoop (this=0xffffc14c, state=..., successor=0x0) at /home/dvander/mozilla/ionmonkey-central/js/src/ion/IonBuilder.cpp:684
#3  0x0843a6cc in js::ion::IonBuilder::processForUpdateEnd (this=0xffffc14c, state=...) at /home/dvander/mozilla/ionmonkey-central/js/src/ion/IonBuilder.cpp:845

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

If a loop looks like:

  for (init; true; update) {
      if (cond)
          break;
  }

It will have no successor, but a break block, so finishLoop() needs to just check whether there is a successor.

Comment 2

[Chris Leary [:cdleary] (not checking bugmail)]

Comment on attachment 557595 [details] [diff] [review]
fix

Think I have a good understanding of this builder now. Did you mean to leave the |dis| in the test?

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/projects/ionmonkey/rev/61cd956864cc