Last Comment Bug 716895 - IonMonkey: Segmentation fault running deltablue.js
: IonMonkey: Segmentation fault running deltablue.js
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
-- normal (vote)
: ---
Assigned To: general
: Jason Orendorff [:jorendorff]
Depends on:
  Show dependency treegraph
Reported: 2012-01-10 08:06 PST by Hannes Verschore [:h4writer]
Modified: 2012-02-02 04:46 PST (History)
3 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

testcase (600 bytes, patch)
2012-02-01 13:50 PST, Hannes Verschore [:h4writer]
dvander: review+
Details | Diff | Splinter Review

Description User image Hannes Verschore [:h4writer] 2012-01-10 08:06:50 PST
I narrowed the test down to the following code:

function output(c) {
  return (c.direction == 1) ? c.v2 : c.v1;

var constraint = { 
  v1 : {},
  v2 : {},
  direction: 1

for (i=0; i<100; i++){
  constraint.direction = -1

It looks a lot like #715111, but I'm not sure.
Therefor I'm creating a new bug for this.
If it's the same feel free to mark as duplicate.

Program received signal SIGSEGV, Segmentation fault.
0x080cbe14 in Type (data=<optimized out>, this=<optimized out>)
    at /home/h4writer/Build/ionmonkey/js/src/jsinfer.h:71
71	    Type(jsuword data) : data(data) {}
Comment 1 User image Hannes Verschore [:h4writer] 2012-01-10 08:46:55 PST
I could reduce it even more to:

function output(c, dir) {
  return (dir) ? c.v1 : c.v1;

var constraint = { 
  v1 : {}

for (i=0; i<100; i++){
  output(constraint, 0)
  output(constraint, 1);
Comment 2 User image David Anderson [:dvander] 2012-01-30 17:10:09 PST
Nice work reducing this, though it looks like it reproduces bug 714727 instead. deltablue is still segfaulting though and I think it is bug 715111.
Comment 3 User image Hannes Verschore [:h4writer] 2012-02-01 13:50:31 PST
Created attachment 593598 [details] [diff] [review]

Indeed testcase succeeds now. I've created a patch for the testcase. I wasn't sure if it was needed or not.

I've also reduced the testcase again, to find why it still segfaults. Could be #715111 like you suggested, but I'm not sure. Therefor I created a new bug report #723271. That way if #715111 is fixed, we can test if it solves that test too.
Comment 4 User image David Anderson [:dvander] 2012-02-01 19:00:09 PST
Comment on attachment 593598 [details] [diff] [review]

Review of attachment 593598 [details] [diff] [review]:

No review needed for test cases, you can just checkin.
Comment 5 User image Jan de Mooij [:jandem] 2012-02-02 04:46:54 PST

Note You need to log in before you can comment on or make changes to this bug.