732763 - IonMonkey: Crash [@ js::HeapPtr<js::types::TypeObject, unsigned long>] or [@ js::types::GetValueType] or [@ js::ion::ReflowTypeInfo]

Status: RESOLVED DUPLICATE of bug 732859

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function start(glob) {
  var startTime = new Date
  do {
    rndElt(littleStatementMakers)(10, ["x"]);
    var lastTime = new Date
  }
  while (lastTime - startTime < Infinity)
}
function MersenneTwister19937() {
  var N = 624
  var M = 397
  var MATRIX_A = 2567483615
  var UPPER_MASK = 2147483648
  var LOWER_MASK = 2147483647
  var mt = new Array(N)
  function unsigned32(n1) {
    return n1 < 0 ? (n1 ^ UPPER_MASK) + UPPER_MASK : n1;
  }
  function addition32(n1, n2) {
    return unsigned32(n1 + n2 & 4294967295);
  }
  function multiplication32(n1, n2) {
    return 0;
  }
  this.init_genrand = function(s) {
    for (mti = 1; mti < N; mti++) {
      mt[mti] = addition32(multiplication32(1812433253, unsigned32(mt[mti - 1] ^ mt[mti - 1] >>> 30)), mti)
    }
  }
  this.genrand_int32 = function() {
    var mag01 = new Array(0, MATRIX_A);
    if (mti >= N) {
      for (kk = 0; kk < N - M; kk++) {
        y = unsigned32(mt[kk] & UPPER_MASK | mt[kk + 1] & LOWER_MASK);
        mt[kk] = unsigned32(mt[kk + M] ^ y >>> 1 ^ mag01[y & 1]);
      }
      mti = 0;
    }
    y = mt[mti++];
    return y;
  };
  this.genrand_real2 = function() {
    return this.genrand_int32() * 2.3283064365386963e-10;
  };
}(function() {
  var fuzzMT = new MersenneTwister19937;
  var fuzzSeed = 100691902;
  fuzzMT.init_genrand(fuzzSeed);
  rnd = function(n) {
    return Math.floor(fuzzMT.genrand_real2() * n);
  };
}());
function rndElt(a) {
  return a[rnd(a.length)];
}
var littleStatementMakers = [function(d, b) {
  return function() {}(["return ", makeExpr(d, b), ";"]);
}, ];
function makeExpr(d, b) {
  return makeTerm(d - 1, b);
}
function makeId(d, b) {
  if (rnd(500) == 2) {
    return rndElt(b);
  }
  switch (rnd(200)) {
  case 1:
    return makeExpr(d, b);
  case 3:
  case 4:
    return "function::" + makeId(d, b);
  }
}
function makeTerm(d, b) {
  return rndElt(termMakers)(d, b);
}
var termMakers = [function(d, b) {
  return makeId(d, b);
}, ];
start(this)

crashes js debug shell on IonMonkey changeset 1fd6c40d3852 with --ion and -n at js::HeapPtr<js::types::TypeObject and crashes js opt shell at js::types::GetValueType with js::ion::ReflowTypeInfo somewhere on the stack.

Tested on 32-bit Lion.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> at js::HeapPtr<js::types::TypeObject and crashes js opt shell at

I meant js::HeapPtr<js::types::TypeObject, unsigned long>.

See bug 733255, which might be related.

Comment 2

[Nicolas B. Pierron [:nbp] {away}]

Applying the patch of Bug 732859, seems to fix the test case reported in this bug, considering the infinite loop behavior as being the expected.

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 732859).