Last Comment Bug 732853 - IonMonkey: Assertion failure: spoff == js_ReconstructStackDepth(cx_, fp_->script(), pc_), at vm/Stack.cpp:1213
: IonMonkey: Assertion failure: spoff == js_ReconstructStackDepth(cx_, fp_->scr...
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
: -- major (vote)
: ---
Assigned To: Nicolas B. Pierron [:nbp]
:
: Jason Orendorff [:jorendorff]
Mentors:
: 722669 (view as bug list)
Depends on: 745360
Blocks: langfuzz IonFuzz
  Show dependency treegraph
 
Reported: 2012-03-04 17:57 PST by Christian Holler (:decoder)
Modified: 2012-04-13 15:20 PDT (History)
6 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Fix recovery of actual args. (1.25 KB, patch)
2012-03-20 11:42 PDT, Nicolas B. Pierron [:nbp]
dvander: review+
Details | Diff | Splinter Review
[2/2] Update fun_getProperty to use StackIter. (4.40 KB, patch)
2012-03-20 18:06 PDT, Nicolas B. Pierron [:nbp]
dvander: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2012-03-04 17:57:16 PST
The following testcase asserts on ionmonkey revision 1fd6c40d3852 (run with --ion -n -m --ion-eager):


var appendToActual = function(s) {
    actual += s + ',';
}
actual = '';
function test() {
    var arr = [0, 0, 0, 0, 1];
    for (var i = 0; i < arr.length; i++)
        arr[i] = new (function  (  )  function length(i, arr, i) {} )("f", arr[i]);
    appendToActual(arr);
}
Function.prototype.toString = function () f(this, true);
function f() {
  f.caller.p
}
test();
Comment 1 Nicolas B. Pierron [:nbp] 2012-03-20 11:33:15 PDT
This bug has 2 sources of errors:
1/ f.caller is null when called under ionmonkey.
2/ The overflow of arguments is not restored which cause a problem while iterating the stackFrames when it produces the exception raised by the first error.
Comment 2 Nicolas B. Pierron [:nbp] 2012-03-20 11:42:40 PDT
Created attachment 607643 [details] [diff] [review]
Fix recovery of actual args.

Fix the second problem first as it would be masked by the fix of the first error.
Comment 3 Nicolas B. Pierron [:nbp] 2012-03-20 18:06:35 PDT
Created attachment 607809 [details] [diff] [review]
[2/2] Update fun_getProperty to use StackIter.
Comment 4 David Anderson [:dvander] 2012-03-20 19:21:21 PDT
Comment on attachment 607643 [details] [diff] [review]
Fix recovery of actual args.

Review of attachment 607643 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/Bailouts.cpp
@@ +265,5 @@
>      const Value &calleeVal = regs.sp[-callerArgc - 2];
>  
>      JSFunction *fun = calleeVal.toObject().toFunction();
>      JSScript *script = fun->script();
> +    CallArgs inlineArgs = CallArgsFromSp(callerArgc, regs.sp);

Okay, this will work for inline frames, I think we're still hosed for non-inline frames but we can worry about that later.

(Fun fact, I verified this patch by looking at the old jstracer.cpp bailout code)
Comment 5 Nicolas B. Pierron [:nbp] 2012-03-20 21:11:18 PDT
(In reply to David Anderson [:dvander] from comment #4)
> ::: js/src/ion/Bailouts.cpp
> @@ +265,5 @@
> >      const Value &calleeVal = regs.sp[-callerArgc - 2];
> >  
> >      JSFunction *fun = calleeVal.toObject().toFunction();
> >      JSScript *script = fun->script();
> > +    CallArgs inlineArgs = CallArgsFromSp(callerArgc, regs.sp);
> 
> Okay, this will work for inline frames, I think we're still hosed for
> non-inline frames but we can worry about that later.

True, the first frame case is not handled with the same mechanism, but I will try to get a test case before fixing it.
Comment 6 David Anderson [:dvander] 2012-03-21 11:07:00 PDT
Comment on attachment 607809 [details] [diff] [review]
[2/2] Update fun_getProperty to use StackIter.

Review of attachment 607809 [details] [diff] [review]:
-----------------------------------------------------------------

Nice.
Comment 7 Nicolas B. Pierron [:nbp] 2012-03-23 09:51:00 PDT
part 1: https://hg.mozilla.org/projects/ionmonkey/rev/c65c9f9dfe70
part 2 is still failing some JM tests.
Comment 8 Nicolas B. Pierron [:nbp] 2012-03-23 21:42:08 PDT
part 2: https://hg.mozilla.org/projects/ionmonkey/rev/2386dfe53a85
Comment 9 Nicolas B. Pierron [:nbp] 2012-03-23 21:47:31 PDT
*** Bug 722669 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.