1584006 - undefined shift in js/src/ctypes/CTypes.cpp:8708

Status: RESOLVED FIXED

(Core :: js-ctypes, defect, P1)

Description

[Tyson Smith [:tsmith]]

This is triggered with an UBSan build. To enable this check add the following to your mozconfig:

ac_add_options --enable-address-sanitizer
ac_add_options --enable-undefined-sanitizer="shift"
ac_add_options --disable-jemalloc

TEST-UNEXPECTED-FAIL | toolkit/components/ctypes/tests/unit/test_jsctypes.js
...
src/js/src/ctypes/CTypes.cpp:8708:28: runtime error: left shift of negative value -676923933
    #0 0x7efde3aa2ad0 in js::ctypes::Int64::Join(JSContext*, unsigned int, JS::Value*) src/js/src/ctypes/CTypes.cpp:8708:28
    #1 0x7efde3b18554 in CallJSNative src/js/src/vm/Interpreter.cpp:458:13
    #2 0x7efde3b18554 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:551
    #3 0x7efde3b1a479 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:620:10
    #4 0x7efde3b1a844 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) src/js/src/vm/Interpreter.cpp:637:8
    #5 0x7efde3cf6291 in js::ForwardingProxyHandler::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const src/js/src/proxy/Wrapper.cpp:162:10
    #6 0x7efde3cbbdf5 in js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const src/js/src/proxy/CrossCompartmentWrapper.cpp:237:19
    #7 0x7efde3cdbdd0 in js::Proxy::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) src/js/src/proxy/Proxy.cpp:504:19
    #8 0x7efde3b18bb0 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:525:14
    #9 0x7efde3b1a479 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:620:10
    #10 0x7efde498b663 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) src/js/src/jit/BaselineIC.cpp:3229:10
    #11 0x2047c6f01797  (<unknown module>)

Comment 1

[Jeff Walden [:Waldo]]

Attachment: Bug 1584006 - Construct a 64-bit value in ctypes code from two 32-bit values without potentially left-shifting a negative value. r=jorendorff

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b98968eb71d3
Construct a 64-bit value in ctypes code from two 32-bit values without potentially left-shifting a negative value.  r=jorendorff

Comment 3

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/mozilla-central/rev/b98968eb71d3