Closed
Bug 1338132
Opened 8 years ago
Closed 8 years ago
wasm: Intermittent invalid conversion to integer
Categories
(Core :: JavaScript Engine: JIT, defect)
Core
JavaScript Engine: JIT
Tracking
()
RESOLVED
INVALID
Tracking | Status | |
---|---|---|
firefox54 | --- | affected |
People
(Reporter: bbouvier, Unassigned)
References
Details
Attachments
(1 file)
(deleted),
application/javascript
|
Details |
See attached test case. When running under ion/rabaldr, sometimes shows a runtime error in function 4, sometimes doesn't. I suspect we might be reading a garbage value at some point and make a decision upon it.
Reporter | ||
Comment 1•8 years ago
|
||
(same thing with function 11)
Reporter | ||
Comment 2•8 years ago
|
||
Hah, this is an invalid test case:
- there's a function A that set_global 0, then calls function B
- function B also set_global 0, then calls function A, leading to a runaway recursion situation and an InternalError.
- when reaching the InternalError, the last set_global 0 that's been executed can be the one from A or from B.
- func_4 is called after function A, and it does a get_global 0.
- since the read value can be different (according to which function run last in the recursion), func_4 can have different behavior.
So that's probably a bug in the fuzzer: it should ensure a deterministic global state before calling each function. I'll reuse the initial state before each function call.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → INVALID
You need to log in
before you can comment on or make changes to this bug.
Description
•