1401209 - Avoid UB in Interpreter's JSOP_LSH implementation

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[André Bargull [:anba]]

As reported in bug 1367146:

/home/marxin/Programming/gecko-dev/js/src/vm/Interpreter.cpp:2533:5: runtime error: left shift of negative value -172304066
/home/marxin/Programming/gecko-dev/js/src/vm/Interpreter.cpp:2533:5: runtime error: left shift of 768433401 by 6 places cannot be represented in type 'int'

the JSOP_LSH implementation in vm/Interpreter.cpp can cause UB.

Comment 1

[André Bargull [:anba]]

Attachment: bug1401209.patch

One day we should probably look into removing the duplicate implementations for the shift and bitwise operations [1-3], but today is not that day. :-)


[1] http://searchfox.org/mozilla-central/rev/1c13d5cf85f904afb8976c02a80daa252b893fca/js/src/vm/Interpreter.cpp#2520-2538
[2] http://searchfox.org/mozilla-central/rev/1c13d5cf85f904afb8976c02a80daa252b893fca/js/src/vm/Interpreter.cpp#2392-2414
[3] http://searchfox.org/mozilla-central/rev/1c13d5cf85f904afb8976c02a80daa252b893fca/js/src/vm/Interpreter-inl.h#748-796

Comment 2

[Jan de Mooij [:jandem]]

Comment on attachment 8909810 [details] [diff] [review]
bug1401209.patch

Review of attachment 8909810 [details] [diff] [review]:
-----------------------------------------------------------------

LGTM!

Comment 3

[André Bargull [:anba]]

Try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=870329d65fc96d37befc13269ffca15d95693ef1

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/0249f8e3d480
Avoid UBSan errors in Interpreter's JSOP_LSH implementation. r=jandem

Comment 5

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/0249f8e3d480