Closed Bug 999790 Opened 6 years ago Closed 6 years ago

OdinMonkey: Differential Testing: attempting to construct (new) an asm module throws

Categories

(Core :: JavaScript Engine: JIT, defect)

defect
Not set
major

Tracking

()

RESOLVED FIXED
mozilla32

People

(Reporter: gkw, Assigned: bbouvier)

References

Details

(Keywords: regression, testcase)

Attachments

(1 file)

try {
    new(function() {
        "use asm"
        return {}
    })
    print("FOO")
} catch (e) {}

$ ./js-opt-64-dm-ts-darwin-1ab07aa4d004 --fuzzing-safe --ion-parallel-compile=off 1411.js

$ ./js-opt-64-dm-ts-darwin-1ab07aa4d004 --fuzzing-safe --no-asmjs --ion-parallel-compile=off 1411.js
FOO

(Tested this on 64-bit Mac js opt threadsafe deterministic shell off m-c rev 1ab07aa4d004, and I think it also reproduces on Linux)

My configure flags (Mac) are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

This seems to go back further than http://hg.mozilla.org/mozilla-central/rev/541248fb29e4, but I'm not sure.

Benjamin, any idea what's going on?
Flags: needinfo?(benj)
Similar to the other one, this goes back to the beginning and stems from the asm.js module and exported functions being natives.  I think the fix might just be to set NATIVE_CTOR on these native functions (which is checked by js::InvokeConstructor).
Flags: needinfo?(benj)
Also solves bug 999849. I've created a new JSFunction::flag to indicate a function
is actually an asm.js module or exported function as we need a way to distinguish
a builtin function from an asm.js, in ResolveInterpretedFunctionPrototype.
Attachment #8411159 - Flags: review?(luke)
Assignee: nobody → benj
Status: NEW → ASSIGNED
Comment on attachment 8411159 [details] [diff] [review]
Make asm.js modules and functions constructible; r=

Review of attachment 8411159 [details] [diff] [review]:
-----------------------------------------------------------------

Excellent, and great tests.

::: js/src/jsfun.h
@@ +45,5 @@
>                                         decompilable nor constructible. */
>          SELF_HOSTED_CTOR = 0x0200,  /* function is self-hosted builtin constructor and
>                                         must be constructible but not decompilable. */
>          HAS_REST         = 0x0400,  /* function has a rest (...) parameter */
> +        ASMJS            = 0x0800,  /* function is an AsmJS module or exported function */

s/AsmJS/asm.js/
Attachment #8411159 - Flags: review?(luke) → review+
Duplicate of this bug: 999849
https://hg.mozilla.org/mozilla-central/rev/a0666ad474fa
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla32
Summary: OdinMonkey: Differential Testing: Different output message involving new → OdinMonkey: Differential Testing: attempting to construct (new) an asm module throws
You need to log in before you can comment on or make changes to this bug.