843285 - emscripten test_class crashes on ARM (no Ion)

Status: RESOLVED DUPLICATE of bug 843911

(Core :: JavaScript Engine, defect)

Description

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: testcase

ARM shell built with ./configure; run with "./js --no-ion testcase.js" segfaults after printing a few values.

Generated testcase is attached; the original C++ source is:

          #include <stdio.h>
          struct Random {
             enum { IM = 139968, IA = 3877, IC = 29573 };
             Random() : last(42) {}
             float get( float max = 1.0f ) {
                last = ( last * IA + IC ) % IM;
                return max * last / IM;
             }
          protected:
             unsigned int last;
          } rng1;
          int main()
          {
            Random rng2;
            int count = 0;
            for (int i = 0; i < 100; i++) {
              float x1 = rng1.get();
              float x2 = rng2.get();
              printf("%f, %f\\n", x1, x2);
              if (x1 != x2) count += 1;
            }
            printf("*%d*\\n", count);
            return 0;
          }

Comment 1

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: same testcase, no goop

Same testcase, just no emscripten preamble/postamble (removed printf call, wasn't necessary to trigger bug -- uses print instead).

Comment 2

[Sean Stangl [:sstangl]]

Reproduces without the recent typed array changes from Bug 837347. More bisection needed.

There are also long-standing ARM-only crashes in the following jit-tests, which appear to be the same issue:

basic/testTypedArrayClamping.js
basic/testTypedArrayUint32.js
ion/typed-arrays-1.js
ion/typed-arrays-3.js
jaeger/bug679666.js

Comment 3

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Why bisect? testTypedArrayClamping and testTypedArrayUint32 are very trivial; should be possible to just fix the bug directly, with bisecting being of academic interest only.

Comment 4

[Sean Stangl [:sstangl]]

JaegerMonkey is missing hardfp support. (Android uses softfp, Chromebooks use hardfp.)