Last Comment Bug 716895 - IonMonkey: Segmentation fault running deltablue.js
: IonMonkey: Segmentation fault running deltablue.js
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: general
:
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-01-10 08:06 PST by Hannes Verschore [:h4writer]
Modified: 2012-02-02 04:46 PST (History)
3 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (600 bytes, patch)
2012-02-01 13:50 PST, Hannes Verschore [:h4writer]
dvander: review+
Details | Diff | Splinter Review

Description Hannes Verschore [:h4writer] 2012-01-10 08:06:50 PST
I narrowed the test down to the following code:

function output(c) {
  return (c.direction == 1) ? c.v2 : c.v1;
}

var constraint = { 
  v1 : {},
  v2 : {},
  direction: 1
}

for (i=0; i<100; i++){
  output(constraint)
  constraint.direction = -1
  output(constraint);
}

It looks a lot like #715111, but I'm not sure.
Therefor I'm creating a new bug for this.
If it's the same feel free to mark as duplicate.

Program received signal SIGSEGV, Segmentation fault.
0x080cbe14 in Type (data=<optimized out>, this=<optimized out>)
    at /home/h4writer/Build/ionmonkey/js/src/jsinfer.h:71
71	    Type(jsuword data) : data(data) {}
Comment 1 Hannes Verschore [:h4writer] 2012-01-10 08:46:55 PST
I could reduce it even more to:

function output(c, dir) {
  return (dir) ? c.v1 : c.v1;
}

var constraint = { 
  v1 : {}
}

for (i=0; i<100; i++){
  output(constraint, 0)
  output(constraint, 1);
}
Comment 2 David Anderson [:dvander] 2012-01-30 17:10:09 PST
Nice work reducing this, though it looks like it reproduces bug 714727 instead. deltablue is still segfaulting though and I think it is bug 715111.
Comment 3 Hannes Verschore [:h4writer] 2012-02-01 13:50:31 PST
Created attachment 593598 [details] [diff] [review]
testcase

Indeed testcase succeeds now. I've created a patch for the testcase. I wasn't sure if it was needed or not.

I've also reduced the testcase again, to find why it still segfaults. Could be #715111 like you suggested, but I'm not sure. Therefor I created a new bug report #723271. That way if #715111 is fixed, we can test if it solves that test too.
Comment 4 David Anderson [:dvander] 2012-02-01 19:00:09 PST
Comment on attachment 593598 [details] [diff] [review]
testcase

Review of attachment 593598 [details] [diff] [review]:
-----------------------------------------------------------------

No review needed for test cases, you can just checkin.
Comment 5 Jan de Mooij [:jandem] 2012-02-02 04:46:54 PST
http://hg.mozilla.org/projects/ionmonkey/rev/41b54805815b

Note You need to log in before you can comment on or make changes to this bug.