Last Comment Bug 882514 - OdinMonkey: TryEnablingIon fails for arrow functions FFI call with --ion-eager
: OdinMonkey: TryEnablingIon fails for arrow functions FFI call with --ion-eager
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: x86_64 Linux
: -- normal (vote)
: mozilla24
Assigned To: Benjamin Bouvier [:bbouvier]
:
Mentors:
: 882843 883211 (view as bug list)
Depends on: 883626
Blocks: jsfunfuzz langfuzz 882012
  Show dependency treegraph
 
Reported: 2013-06-12 18:14 PDT by Benjamin Bouvier [:bbouvier]
Modified: 2013-06-16 03:45 PDT (History)
5 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
proposed fix (1.13 KB, patch)
2013-06-12 18:14 PDT, Benjamin Bouvier [:bbouvier]
hv1989: review+
Details | Diff | Splinter Review

Description Benjamin Bouvier [:bbouvier] 2013-06-12 18:14:50 PDT
Created attachment 761821 [details] [diff] [review]
proposed fix

(function m(a,ffi){"use asm"; var f = ffi.f; function g(){f();}return g})(this, {f: x=>x})

raises an assertion failure as the arrow function has no script, in TryEnablingIon.
Present in a test case of bug 882012.
Comment 1 Luke Wagner [:luke] 2013-06-12 18:18:01 PDT
Don't forget to add the testcase to the patch.
Comment 2 Benjamin Bouvier [:bbouvier] 2013-06-12 19:08:14 PDT
(In reply to Luke Wagner [:luke] from comment #1)
> Don't forget to add the testcase to the patch.

Should I move the test case present in the patch of bug 882012 in this patch?
Comment 3 Luke Wagner [:luke] 2013-06-12 21:28:37 PDT
That'd probably be best (for the bug/hg record).
Comment 4 Hannes Verschore [:h4writer] 2013-06-13 01:36:27 PDT
Comment on attachment 761821 [details] [diff] [review]
proposed fix

Review of attachment 761821 [details] [diff] [review]:
-----------------------------------------------------------------

Nice find. Seems like we don't have testcase testing ffi calls to natives yet! 
Please include a testcase.

::: js/src/ion/AsmJS.cpp
@@ +5231,5 @@
>  }
>  
>  static inline bool
> +TryEnablingIon(JSContext *cx, AsmJSModule::ExitDatum *exitDatum, int32_t argc, Value *argv)
> +{

Thanks for correcting the accolade.

@@ +5233,5 @@
>  static inline bool
> +TryEnablingIon(JSContext *cx, AsmJSModule::ExitDatum *exitDatum, int32_t argc, Value *argv)
> +{
> +    JSScript *script = exitDatum->fun->maybeNonLazyScript();
> +    if (script == NULL)

if (!script)
Comment 5 Benjamin Bouvier [:bbouvier] 2013-06-13 11:48:28 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/05bf9122d234
Comment 6 Hannes Verschore [:h4writer] 2013-06-13 11:49:41 PDT
*** Bug 882843 has been marked as a duplicate of this bug. ***
Comment 7 Ed Morley [:emorley] 2013-06-14 04:17:53 PDT
https://hg.mozilla.org/mozilla-central/rev/05bf9122d234
Comment 8 Luke Wagner [:luke] 2013-06-14 09:54:47 PDT
*** Bug 883211 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.