765266 - IonMonkey: ARM Crash on invalid address near [@ js_NoSuchMethodClass]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on ionmonkey-arm (private branch) revision 153a2db06024 (run with --ion -n -m --ion-eager):


function f(N) {
  for (var i = 0; i != N; ++i) {
    var obj0 = {}, obj1 = {}, obj2 = {};
    obj1['a'+i] = 0;
    obj2['b'+i] = 0;
    obj2['b'+(i+1)] = 1;
    for (var repeat = 0;repeat != 2; ++repeat) {
      var count = 0;
      for (var j in obj1) {
        for (var k in obj2) {
          switch (count) {
            case 0: 
          }
          -- count;
        }
      }
    }
  }
}
var array = [function() { f(10); }, ];
for (var i = 0; i != array.length; ++i)
  array[i]();

Comment 1

[Christian Holler (:decoder)]

GDB trace:


Program received signal SIGSEGV, Segmentation fault.
0xeafffffe in ?? ()
(gdb) bt
#0  0xeafffffe in ?? ()
#1  0x005a3438 in js_NoSuchMethodClass ()
#2  0x005a3438 in js_NoSuchMethodClass ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

Comment 2

[Marty Rosenberg [:mjrosenb]]

Attachment: /home/mrosenberg/patches/nukeOpt-r0.patch

My bad, I forgot that the subtracts that I had in this code were being used both for modifying the inputs as well as doing bounds checks.

Comment 3

[Marty Rosenberg [:mjrosenb]]

landed: http://hg.mozilla.org/projects/ionmonkey/rev/b3464c3b7dfc