724872 - IonMonkey: Crash with illegal instruction (--ion-eager)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on ionmonkey revision c34398f961e7 (run with --ion -n -m --ion-eager), tested on 64 bit:


function f() {
    var x = ("1234");
    var y = 0;
    return x % y;
}
assertEq(f(), NaN);

Comment 1

[Christian Holler (:decoder)]

Fyi, I have a lot more crashes that involve --ion-eager but they all change crash signatures or asserts during minimization, so they are likely also memory corruptions. I'll be holding those back until this is fixed :)

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Simple bug - we had talked through that LOsiPoints would always be patchable without any padding, which looks true for the middle of the buffer, but not necessarily if the call is at the very end.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/projects/ionmonkey/rev/902e1b6364c4