1527729 - Assertion failure in range analysis checking with BigInt

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P1)

Description

[Robin Templeton [:terpri]]

This test case crashes when the checkRangeAnalysis JIT option is enabled (run with --fuzzing-safe --no-threads --ion-eager --ion-check-range-analysis):

for (const x of [0n, 1n, 1n]) { print(((y)=>y|y)(x)); }

Comment 1

[Robin Templeton [:terpri]]

the error message is "Incorrect range for Value." which is probably from https://searchfox.org/mozilla-central/rev/01b4b3830ea3cae2e9e431019afa6391b471c6da/js/src/jit/CodeGenerator.cpp#13011

Comment 2

[Andy Wingo [:wingo]]

Related to bug 1526870, about CacheIR support for BigInt comparisons.

I think we should probably add static bool BigInt::compare(BigInt*, int32_t), like we have for doubles. It would be useful for CacheIR as well. Then we can emit calls to it to check bigint bounds. I was going to suggest just papering over the issue by passing if the value is a bigint but as we need the comparison function anyway and it's a portable callVM, we might as well go ahead and do it.

Would you mind taking this, Robin?

Comment 3

[Robin Templeton [:terpri]]

yes, i can take this one

Comment 4

[Robin Templeton [:terpri]]

Attachment: Skip range computation for non-int32 bitwise ops

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/280ab3f61c87
Skip range computation for non-int32 bitwise ops r=wingo,jandem

Comment 6

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/280ab3f61c87