870539 - Incorrect behavior in IonMonkey with lots of exceptions

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Alon Zakai (:azakai)]

Attachment: Testcases

Attached are two testcases. a.out.js is the original, and 14.js an attempted reduction with lithium (not 100% sure that it is valid, so here are both).

They give different behavior when run normally and with --no-ion.

This is compiled code from emscripten, that basically hammers on throwing and catching C++ exceptions. Those are implemented using JS exceptions, so there are lots of those thrown here.

The main C++ loop looks like this:

for(int i = 0; i < 10000; ++i)
{
  try
  {
    throw std::runtime_error("Throwing an exception.");
  }
  catch(const std::exception &e)
  {
    ++numExceptions;
  }
}

Comment 1

[Alon Zakai (:azakai)]

The main compiled loop in JS is in function _main. It throws and catches using invoke, handles using some cxa__ functions.

Comment 2

[Sean Stangl [:sstangl]]

Amusingly, merely setting IONFLAGS=aborts (or any other valid value) causes correct behavior.

Comment 3

[Alon Zakai (:azakai)]

This now works.