OdinMonkey: Differential Testing: attempting to construct (new) an asm module throws

RESOLVED FIXED in mozilla32

Status

()

defect
--
major
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Assigned: bbouvier)

Tracking

(Blocks 3 bugs, {regression, testcase})

Trunk
mozilla32
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

try {
    new(function() {
        "use asm"
        return {}
    })
    print("FOO")
} catch (e) {}

$ ./js-opt-64-dm-ts-darwin-1ab07aa4d004 --fuzzing-safe --ion-parallel-compile=off 1411.js

$ ./js-opt-64-dm-ts-darwin-1ab07aa4d004 --fuzzing-safe --no-asmjs --ion-parallel-compile=off 1411.js
FOO

(Tested this on 64-bit Mac js opt threadsafe deterministic shell off m-c rev 1ab07aa4d004, and I think it also reproduces on Linux)

My configure flags (Mac) are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

This seems to go back further than http://hg.mozilla.org/mozilla-central/rev/541248fb29e4, but I'm not sure.

Benjamin, any idea what's going on?
Flags: needinfo?(benj)
Similar to the other one, this goes back to the beginning and stems from the asm.js module and exported functions being natives.  I think the fix might just be to set NATIVE_CTOR on these native functions (which is checked by js::InvokeConstructor).
Flags: needinfo?(benj)
Also solves bug 999849. I've created a new JSFunction::flag to indicate a function
is actually an asm.js module or exported function as we need a way to distinguish
a builtin function from an asm.js, in ResolveInterpretedFunctionPrototype.
Attachment #8411159 - Flags: review?(luke)
Assignee: nobody → benj
Status: NEW → ASSIGNED
Comment on attachment 8411159 [details] [diff] [review]
Make asm.js modules and functions constructible; r=

Review of attachment 8411159 [details] [diff] [review]:
-----------------------------------------------------------------

Excellent, and great tests.

::: js/src/jsfun.h
@@ +45,5 @@
>                                         decompilable nor constructible. */
>          SELF_HOSTED_CTOR = 0x0200,  /* function is self-hosted builtin constructor and
>                                         must be constructible but not decompilable. */
>          HAS_REST         = 0x0400,  /* function has a rest (...) parameter */
> +        ASMJS            = 0x0800,  /* function is an AsmJS module or exported function */

s/AsmJS/asm.js/
Attachment #8411159 - Flags: review?(luke) → review+
Duplicate of this bug: 999849
https://hg.mozilla.org/mozilla-central/rev/a0666ad474fa
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla32
Blocks: odinfuzz
Depends on: 1007512
Summary: OdinMonkey: Differential Testing: Different output message involving new → OdinMonkey: Differential Testing: attempting to construct (new) an asm module throws
You need to log in before you can comment on or make changes to this bug.