Open nth10sd opened 8 years ago
Here's a variant of the testcase that is very similar to what gen-asm.js can create, and still triggers the bug. In particular, the array views are created in a closure, and the loop is moved outside the function.
function asmModule(heap)
{
var i32 = new Int32Array(heap);
var f32 = new Float32Array(heap);
function f() {
var b0 = 0.0;
var b3 = 0.0;
i32[0] = 1;
b0 = f32[0];
i32[0] = 4;
b3 = f32[0];
return +b3;
}
return f;
}
var f = asmModule(new ArrayBuffer(4096));
for (let i = 0; i < 3; ++i) {
print(f());
}
Built the version just before the patch using:
~/funfuzz/autobisect-js/autobisect.py --build="--enable-more-deterministic --enable-debug --without-intl-api" -s 46178702a3ca -e 01bfa6d7d561
Tested using:
~/funfuzz/js/compareJIT.py ~/funfuzz/known/mozilla-central/ ~/shell-cache/js-dbg-64-dm-clang-intlDisabled-darwin-46178702a3ca/js-dbg-64-dm-clang-intlDisabled-darwin-46178702a3ca ~/2.js
jsfunfuzz has become slightly more complex than I can reason about :/
Things that MIGHT help uncover this kind of bug:
for (let i = 0; i < 3; ++i) { dumpln(f()); }
, or its constituent parts, more oftengen-grammar.js
and gen-type-aware-code.js
.
During the London meetup, I also mentioned to :bbouvier about jsfunfuzz (incl. the gen-asm.js part) - we might also need to start testing WebAssembly at some point. Our current coverage is only whatever randorderfuzz chooses to pull in from the tests.
This might only be tangentially related though, as I'm not sure how much independently related asm.js/wasm are. Will it be worth noting how wasm would fit in the picture above?
Hannes was wondering whether the testcase for bug 1279898 can be generated, so filing this as a start.
@jruderman, what do you think?