1526279 - Assertion failure: i < argc_, at dist/include/js/CallArgs.h:210 with BigInt

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 4bc31addf415 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

oomTest(BigInt.asIntN);

Backtrace:

#0 JS::detail::CallArgsBase<JS::detail::IncludeUsedRval>::operator[] (i=0, this=<optimized out>) at /home/ubuntu/shell-cache/js-dbg-64-dm-linux-x86_64-4bc31addf415/objdir-js/dist/include/js/CallArgs.h:210
#1 js::BigIntObject::asIntN (cx=0x7f5f80317000, argc=<optimized out>, vp=<optimized out>) at js/src/builtin/BigInt.cpp:195
#2 0x000055cca1dcf820 in CallJSNative (cx=0x7f5f80317000, native=0x55cca2033750 <js::BigIntObject::asIntN(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/vm/Interpreter.cpp:442
#3 0x000055cca1dbf2ed in js::InternalCallOrConstruct (cx=0x7f5f80317000, args=..., construct=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:534
#4 0x000055cca1dbfe5d in js::Call (cx=0x7f5f81459680 <_IO_2_1_stderr_>, fval=..., thisv=..., args=..., rval=...) at js/src/vm/Interpreter.cpp:605
#5 0x000055cca2379efc in JS_CallFunction (cx=0x7f5f80317000, obj=..., fun=..., args=..., rval=...) at js/src/jsapi.cpp:2576
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/4b74d76e55a8
user: Andy Wingo
date: Wed Feb 06 13:41:56 2019 +0000
summary: Bug 1522436 - Enable BigInt compilation by default r=jandem,terpri,froydnj

Andy, I'm guessing this is related to the BigInt landing?

Comment 3

[Andy Wingo [:wingo]]

Hi, yes this would be due to the bigint landing. Before, the fuzzers have not been running on BigInt API; now they will.

Just as a reminder, there's a run-time flag for BigInt which is off by default. However in the shell it's on by default, so that fuzzers and unit tests and so on can run. If I understand correctly how this QA process works, then it's OK to fix bugs of this kind as they come in, rather than rolling out the enable-bigint patch, because they pose no danger to users. If you think we should do this in some other way, let me know!

I'll take this one for now, cheers :)

Comment 4

[Andy Wingo [:wingo]]

Attachment: Bug 1526279 - Fix BigInt constructor API CallArgs usage

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c53f5b9d5a75
Fix BigInt constructor API CallArgs usage r=terpri,jorendorff

Comment 6

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/c53f5b9d5a75

Comment 7

[Robin Templeton [:terpri]]

test262 coverage added in https://github.com/tc39/test262/pull/2075