900317 - ion::IonBuilder::getPropTryConstant masks error in Ion Inline Caches

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Eric Faust [:efaust]]

If you comment out the tryConstant optimization through the TryInlineAccess optimization in jsop_getprop(), you will notice that the jit-test parallel/Array-mapPar-nested.js fails because it gets the wrong value from the IC.

Marking security as I don't know the full repercussions.

Comment 1

[Eric Faust [:efaust]]

Attachment: fix

The problem actually wasn't in the ICs. When we have a clone at a callsite, and replace the input operand with a constant, we neglect to ensure that the operand that was supposed to be used actually has a use at the callsite, and thus doesn't get removed from the resume point, where it will later be observed on an ill-timed bailout. Though reproducing this bug required commenting out some code (we don't replace constants with undefined in the resume point because it makes little sense), it should still be reproducible with a more complicated testcase.

I do not believe that there are security implications of this bug.

Comment 2

[Eric Faust [:efaust]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/25f9ed87069c

Comment 3

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/25f9ed87069c