1952166 - A bug in JIT optimization: an exception about Math.clz32 and BigInt

Status: RESOLVED DUPLICATE of bug 1947141

(Core :: JavaScript Engine: JIT, defect)

Description

[anbu]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0

Steps to reproduce:

A bug in JIT optimization, whether there are security risks or not requires further in-depth analysis.

Version:
commit 7b3f3fb5fd2cad8f348131498a35a91bef68b47b

Build options:

/bin/sh ../../gecko-dev/js/src/configure --enable-debug --disable-optimize --disable-shared-js --disable-tests --enable-gczeal

Test options:

./js --baseline-warmup-threshold=10 --ion-warmup-threshold=50 --ion-check-range-analysis --ion-extra-checks --differential-testing

Case1:

Problem Description: Execution results exhibit discrepancies.

function opt(){
  let v0 = 0;
  do {
    ++v0;
  } while (v0 != 127);
  const v1 = Math.clz32(v0);
  const v2 = BigInt(v1);
  try {
    const v3 = /\D\Sg?/ugi;
    const v4 = `-2147483649${[]}unicode`.replace(v3,ArrayBuffer);
    let v5 = 0;
    let v6 = 35503;
    let v7 = Object();
    for (let v8 = 0; v8 < 8; v8 = v8 + 127) {
      ({"hasInstance":v5,"iterator":v6,"search":v7,"sticky":v8,} = v8);
    }
  } catch(v9) {
  } finally {
  }
  return v2;
}
  
let a = opt();
let b = opt();
for (let i = 0; i < 55; i++) {
  opt();
}
let c = opt();
print(a);
print(b);
print(c);

Case2:

Problem Description: Execution results of the <= operation for BigInt exhibit discrepancies.

function opt(opt_param){
  const v0 = `
    const v3 = String();
    v3.__proto__ = this;
  `;
  let v1 = eval;
  const v2 = v1(v0);
  v1 /= v0;
  let v3 = 0;
  do {
    ++v3;
  } while (v3 < 127);
  const v4 = Math.clz32(v3);
  const v5 = BigInt(v4);
  try {
    const v6 = v1.valueOf;
    const v7 = new ArrayBuffer(8);
    const v23 = new v7(v7);
    const v8 = v6.apply(v2);
  } catch(v9) {
  }
  return v5;
}
  
let a = opt();
let b = opt();
for (let i = 0; i < 55; i++) {
  opt();
}
let c = opt();
print(a);
print(b);
print(c);

Actual results:

The result has changed after JIT optimization.

Case1:

a = 25
b = 25
c = 545460846617

Case2:

a = 25
b = 25
c = 545460846617

Comment 1

[Iain Ireland [:iain]]

This is the same underlying problem as bug 1947141, and was fixed by the patch for that bug.