1531287 - Assertion failure: Incorrect range for Value., at js/src/jit/MacroAssembler.cpp:2029 with BigInt

Status: RESOLVED DUPLICATE of bug 1527729

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 198cd4a81bf2 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --ion-eager --ion-check-range-analysis):

1n << 1n;

Backtrace:

#0 0x0000092dfda7ebfd in ?? ()
#1 0x0000092dfd95bac4 in ?? ()
#2 0x0000000000001043 in ?? ()
#3 0x00002f2b671b3a62 in ?? ()
#4 0x0000000000000000 in ?? ()
/snip

For detailed crash information, see attachment.

Not setting s-s yet because this involves BigInt. I added better support for BigInt in jsfunfuzz but then had to back it out as this was one of (possibly) several issues that came up.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Setting needinfo? from Robin and Andy as a start, also this keeps happening constantly so setting [fuzzblocker].

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(happens constantly, specifically with --ion-check-range-analysis)

Comment 4

[Andy Wingo [:wingo]]

I believe this was fixed by https://bugzilla.mozilla.org/show_bug.cgi?id=1527729. At least, since that patch landed I don't see this issue any more. Suggest to dup -> bug 1527729; wdyt gkw?

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Sure, thanks!