Last Comment Bug 724944 - IonMonkey: Crash [@ JSString::isAtom]
: IonMonkey: Crash [@ JSString::isAtom]
Status: RESOLVED FIXED
: crash, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
: -- major (vote)
: ---
Assigned To: David Anderson [:dvander]
:
Mentors:
Depends on:
Blocks: langfuzz IonFuzz
  Show dependency treegraph
 
Reported: 2012-02-07 08:33 PST by Christian Holler (:decoder)
Modified: 2013-01-14 07:42 PST (History)
5 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
fix (2.64 KB, patch)
2012-02-07 19:15 PST, David Anderson [:dvander]
no flags Details | Diff | Review
better fix (3.06 KB, patch)
2012-02-07 19:29 PST, David Anderson [:dvander]
jdemooij: review+
Details | Diff | Review

Description Christian Holler (:decoder) 2012-02-07 08:33:09 PST
The following testcase crashes on ionmonkey revision c34398f961e7 (run with --ion -n), tested on 64 bit:


function TestCase(n, d, e, a)
function writeHeaderToLog( string ) {}
var SECTION = "15.1.2.5-2";
for ( var CHARCODE = 0; CHARCODE < 256; CHARCODE += 16 ) {
  new TestCase( SECTION, unescape( "%" + (ToHexString(CHARCODE)).substring(0,1) )  );
}
function ToHexString( n ) {
  var hex = new Array();
  for ( var mag = 1; Math.pow(16,mag) <= n ; mag++ ) {  }
  for ( index = 0, mag -= 1; mag > 0; index++, mag-- ) {  }
  var string ="";
    switch ( hex[index] ) {
    case 10:
      string += "A";
  }
  return string;
}
Comment 1 David Anderson [:dvander] 2012-02-07 19:15:06 PST
Created attachment 595286 [details] [diff] [review]
fix

The bug is that MTableSwitch cached its default case successor as an MBasicBlock *, but in this example we split a critical edge around that case, and thus the pointer wasn't updated. We hoisted a move up the edge, and then emitted a jump over it.

Fix is to just index into the successor list instead.
Comment 2 David Anderson [:dvander] 2012-02-07 19:29:01 PST
Created attachment 595290 [details] [diff] [review]
better fix

Whoops, I forgot that we resort. Here's a better fix.
Comment 3 David Anderson [:dvander] 2012-02-08 10:22:17 PST
http://hg.mozilla.org/projects/ionmonkey/rev/c78194c6f53c
Comment 4 Christian Holler (:decoder) 2013-01-14 07:42:34 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug724944.js.

Note You need to log in before you can comment on or make changes to this bug.