Closed Bug 1584006 Opened 5 months ago Closed 4 months ago

undefined shift in js/src/ctypes/CTypes.cpp:8708

Categories

(Core :: js-ctypes, defect, P1)

defect

Tracking

()

RESOLVED FIXED
mozilla71
Tracking Status
firefox71 --- fixed

People

(Reporter: tsmith, Assigned: Waldo)

References

(Blocks 2 open bugs)

Details

(Keywords: csectype-undefined, testcase)

Attachments

(1 file)

This is triggered with an UBSan build. To enable this check add the following to your mozconfig:

ac_add_options --enable-address-sanitizer
ac_add_options --enable-undefined-sanitizer="shift"
ac_add_options --disable-jemalloc
TEST-UNEXPECTED-FAIL | toolkit/components/ctypes/tests/unit/test_jsctypes.js
...
src/js/src/ctypes/CTypes.cpp:8708:28: runtime error: left shift of negative value -676923933
    #0 0x7efde3aa2ad0 in js::ctypes::Int64::Join(JSContext*, unsigned int, JS::Value*) src/js/src/ctypes/CTypes.cpp:8708:28
    #1 0x7efde3b18554 in CallJSNative src/js/src/vm/Interpreter.cpp:458:13
    #2 0x7efde3b18554 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:551
    #3 0x7efde3b1a479 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:620:10
    #4 0x7efde3b1a844 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) src/js/src/vm/Interpreter.cpp:637:8
    #5 0x7efde3cf6291 in js::ForwardingProxyHandler::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const src/js/src/proxy/Wrapper.cpp:162:10
    #6 0x7efde3cbbdf5 in js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const src/js/src/proxy/CrossCompartmentWrapper.cpp:237:19
    #7 0x7efde3cdbdd0 in js::Proxy::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) src/js/src/proxy/Proxy.cpp:504:19
    #8 0x7efde3b18bb0 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:525:14
    #9 0x7efde3b1a479 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:620:10
    #10 0x7efde498b663 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) src/js/src/jit/BaselineIC.cpp:3229:10
    #11 0x2047c6f01797  (<unknown module>)
Component: JavaScript Engine → js-ctypes
Priority: -- → P1
Pushed by jwalden@mit.edu:
https://hg.mozilla.org/integration/autoland/rev/b98968eb71d3
Construct a 64-bit value in ctypes code from two 32-bit values without potentially left-shifting a negative value.  r=jorendorff
Status: NEW → RESOLVED
Closed: 4 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla71
Assignee: nobody → jwalden
You need to log in before you can comment on or make changes to this bug.