582894 - JM: "Assertion failure: INT_FITS_IN_JSID(i),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for each(let e in [0x40000000]) {
    (0)[e]
}

asserts js debug shell on JM changeset 3700c42a8e82 with -m at Assertion failure: INT_FITS_IN_JSID(i), at ../jsapi.h:368

Comment 1

[Chris Leary [:cdleary] (not checking bugmail)]

Hits a nice corner in the GetElem stub where the id value is 32b wide but the INT_TO_JSID needs to shift it one left. Do we have to test for this high-bit-set condition everywhere we want to convert? There's also ArgSub in StubCalls.cpp and no warning on the APIs that take a jsint and convert to JSID, like JS_GetElement.

CCing lw for his unequaled fatval knowledge!

Comment 2

[Luke Wagner [:luke]]

Yes, all calls to INT_TO_JSID must dynamically test or statically know that INT_FITS_IN_JSID(i).

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Just hit this in real-world code so time to fix. I just duplicated the interpreter case, since they diverged.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/projects/jaegermonkey/rev/d2a13fb923cf

Comment 5

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug582894.js.