861419 - Crash [@ js::ion::IonCompartment::flusher] with bug 804676 fixes

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug and opt stacks

try {
    arguments.toSource = (function() {
        __proto__.y = x
    })
    y = this
    print(x = 8)
    a = arguments
    for (v of this) {}
} catch (e) {}
function f() {
    y.a
}
f()
f()
y = 1[7]
f()

crashes js debug and opt shell on ionmonkey (where bug 804676 fixes landed for testing) changeset 79f78c194329 with --ion-eager at js::ion::IonCompartment::flusher

Comment 1

[Brian Hackett [Laid off!]]

I can't reproduce this.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Brian Hackett (:bhackett) from comment #1)
> I can't reproduce this.

I can definitely reproduce with --enable-more-deterministic. 

sh ./configure --target=x86_64-apple-darwin11.4.0 --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --with-ccache

Comment 3

[Brian Hackett [Laid off!]]

Attachment: patch

OK, that worked.  When reading global names we didn't propagate values for the property in from its prototype, so that the added freeze constraint was triggered later on during compilation and compiled code was not invalidated at the right point.

https://hg.mozilla.org/projects/ionmonkey/rev/a8d0317c24c1

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 737246 [details] [diff] [review]
patch

Review of attachment 737246 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/IonBuilder.cpp
@@ +5635,5 @@
>          // The property has been reconfigured as non-configurable, non-enumerable
>          // or non-writable.
>          return jsop_getname(name);
>      }
> +    if (!propertyTypes->hasPropagatedProperty())

Could you put a comment above explaining what this condition means?

Comment 5

[Brian Hackett [Laid off!]]

Add comment:

https://hg.mozilla.org/projects/ionmonkey/rev/c946f7a39397

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/a8d0317c24c1
https://hg.mozilla.org/mozilla-central/rev/c946f7a39397