724944 - IonMonkey: Crash [@ JSString::isAtom]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on ionmonkey revision c34398f961e7 (run with --ion -n), tested on 64 bit:


function TestCase(n, d, e, a)
function writeHeaderToLog( string ) {}
var SECTION = "15.1.2.5-2";
for ( var CHARCODE = 0; CHARCODE < 256; CHARCODE += 16 ) {
  new TestCase( SECTION, unescape( "%" + (ToHexString(CHARCODE)).substring(0,1) )  );
}
function ToHexString( n ) {
  var hex = new Array();
  for ( var mag = 1; Math.pow(16,mag) <= n ; mag++ ) {  }
  for ( index = 0, mag -= 1; mag > 0; index++, mag-- ) {  }
  var string ="";
    switch ( hex[index] ) {
    case 10:
      string += "A";
  }
  return string;
}

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

The bug is that MTableSwitch cached its default case successor as an MBasicBlock *, but in this example we split a critical edge around that case, and thus the pointer wasn't updated. We hoisted a move up the edge, and then emitted a jump over it.

Fix is to just index into the successor list instead.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: better fix

Whoops, I forgot that we resort. Here's a better fix.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/projects/ionmonkey/rev/c78194c6f53c

Comment 4

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug724944.js.