999790 - OdinMonkey: Differential Testing: attempting to construct (new) an asm module throws

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

try {
    new(function() {
        "use asm"
        return {}
    })
    print("FOO")
} catch (e) {}

$ ./js-opt-64-dm-ts-darwin-1ab07aa4d004 --fuzzing-safe --ion-parallel-compile=off 1411.js

$ ./js-opt-64-dm-ts-darwin-1ab07aa4d004 --fuzzing-safe --no-asmjs --ion-parallel-compile=off 1411.js
FOO

(Tested this on 64-bit Mac js opt threadsafe deterministic shell off m-c rev 1ab07aa4d004, and I think it also reproduces on Linux)

My configure flags (Mac) are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

This seems to go back further than http://hg.mozilla.org/mozilla-central/rev/541248fb29e4, but I'm not sure.

Benjamin, any idea what's going on?

Comment 1

[Luke Wagner [:luke]]

Similar to the other one, this goes back to the beginning and stems from the asm.js module and exported functions being natives.  I think the fix might just be to set NATIVE_CTOR on these native functions (which is checked by js::InvokeConstructor).

Comment 2

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: Make asm.js modules and functions constructible; r=

Also solves bug 999849. I've created a new JSFunction::flag to indicate a function
is actually an asm.js module or exported function as we need a way to distinguish
a builtin function from an asm.js, in ResolveInterpretedFunctionPrototype.

Comment 3

[Luke Wagner [:luke]]

Comment on attachment 8411159 [details] [diff] [review]
Make asm.js modules and functions constructible; r=

Review of attachment 8411159 [details] [diff] [review]:
-----------------------------------------------------------------

Excellent, and great tests.

::: js/src/jsfun.h
@@ +45,5 @@
>                                         decompilable nor constructible. */
>          SELF_HOSTED_CTOR = 0x0200,  /* function is self-hosted builtin constructor and
>                                         must be constructible but not decompilable. */
>          HAS_REST         = 0x0400,  /* function has a rest (...) parameter */
> +        ASMJS            = 0x0800,  /* function is an AsmJS module or exported function */

s/AsmJS/asm.js/

Comment 5

[Benjamin Bouvier [:bbouvier] (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/a0666ad474fa

Comment 6

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/a0666ad474fa