869515 - Debugging output crash in SpewResumePoint

Status: RESOLVED FIXED

(Core :: JavaScript Engine, enhancement)

Description

[Dan Gohman [:sunfish]]

SpewResumePoint in js/src/ion/Lowering.cpp crashes when its resumePoint argument is NULL, which seems to be a valid possibility.

Comment 1

[Dan Gohman [:sunfish]]

Attachment: a patch containing a proposed fix

Handle the case where resumePoint is NULL, assuming that this is valid.

Comment 2

[Hannes Verschore [:h4writer]]

Is this in asm.js code? If that is the case, I probably introduced the regression. Can you confirm?

Comment 3

[Dan Gohman [:sunfish]]

Yes, I can confirm that the crash only happens in asm.js code. I can reduce a testcase if you want one.

Comment 4

[Hannes Verschore [:h4writer]]

No need for a testcase. Bug 862777 caused the regression. I've seen this one already come by.

I do think we need to test this a little bit higher. In Lowering.cpp:2743 we have function updateResumeState. One for MInstruction and one for MBasicBlock. In MBasicBlock we only run spewResumePoint when lastResumePoint is set. We need to do the same for MInstruction.
If you add this patch, you can add me as reviewer ;).

Comment 5

[Hannes Verschore [:h4writer]]

Attachment: Patch

When logging asm.js code we don't create/capture resumepoints. So we can't log them either.

Comment 6

[Hannes Verschore [:h4writer]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ae045b8a759b

Comment 7

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/ae045b8a759b