1952163 - A bug in JIT optimization: an exception about outputs changed of BigInt object

Status: RESOLVED DUPLICATE of bug 1947141

(Core :: JavaScript Engine: JIT, defect)

Description

[anbu]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0

Steps to reproduce:

A bug in JIT optimization, whether there are security risks or not requires further in-depth analysis.

Version:
commit 7b3f3fb5fd2cad8f348131498a35a91bef68b47b

Build options:

/bin/sh ../../gecko-dev/js/src/configure --enable-debug --disable-optimize --disable-shared-js --disable-tests --enable-gczeal

Test options:

./js --baseline-warmup-threshold=10 --ion-warmup-threshold=50 --ion-check-range-analysis --ion-extra-checks --differential-testing

Case1:

Problem Description: Execution results exhibit discrepancies.

function opt(){
  const v0 = BigInt ? 255 : 1024;
  const v1 = BigInt(v0);
  try {
    const v2 = v0();
    let v3 = RegExp;
  } catch(v0) { 
  } finally { 
  }
  const v4 = (266415.42737564375).toString();
  const v5 = [v1,...v4,...v4];
  const v6 = BigInt.asIntN(v4,v1);
  return v6;
}
  
let a = opt();
let b = opt();
for (let i = 0; i < 55; i++) {
  opt();
}
let c = opt();
print(a);
print(b);
print(c);

Actual results:

The result has changed after JIT optimization.

Case1:

a = 255
b = 255
c = -693384330629611265 (It is not a definitive number, it varies with each run.)

Comment 1

[Iain Ireland [:iain]]

This is a duplicate of bug 1947141. This test fails in the build immediately prior to the fix for that bug, and passes when the fix is included.

Please check failing tests against the latest version of mozilla-central before reporting them. It will save you time writing up the report, and save us time investigating. Thanks!