733248 - IonMonkey: Crash [@ PushMarkStack [inlined]]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

The upcoming attached testcase crashes js opt shell on IonMonkey changeset 1fd6c40d3852 with -m, -a, --ion and -n at PushMarkStack [inlined]

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Tested on js 64-bit opt shell in Mac OS X Lion. On further testing, only --ion and -n seem to be needed.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Bug that has bitten us since the TM days. Some x86 compilers (MSVC for sure, apparently clang too) use 8-bit register to handle "bool", and we were testing the full 32-bits, which could lead to seeing a false return value as true.

Comment 4

[Nicolas B. Pierron [:nbp]]

Comment on attachment 605211 [details] [diff] [review]
fix

Review of attachment 605211 [details] [diff] [review]:
-----------------------------------------------------------------

Apply nits and r=me.

::: js/src/assembler/assembler/X86Assembler.h
@@ +1276,5 @@
> +    void testb_rr(RegisterID src, RegisterID dst)
> +    {
> +        js::JaegerSpew(js::JSpew_Insns,
> +                       IPFX "testb      %s, %s\n", MAYBE_PAD,
> +                       nameIReg(4,src), nameIReg(4,dst));

nit: nameIReg(4,dst)  -->  nameIReg(1,dst)

::: js/src/ion/shared/Assembler-x86-shared.h
@@ +501,5 @@
>      void setCC(Condition cond, const Register &r) {
>          masm.setCC_r(static_cast<JSC::X86Assembler::Condition>(cond), r.code());
>      }
> +    void testb(const Register &lhs, const Register &rhs) {
> +        masm.testb_rr(rhs.code(), lhs.code());

nit: Make sure that registers can be interpreted as byte registers.

JS_ASSERT(GeneralRegisterSet(Registers::SingleByteRegs).has(lhs));
JS_ASSERT(GeneralRegisterSet(Registers::SingleByteRegs).has(rhs));

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/projects/ionmonkey/rev/1052d3eb7a78