1971346 - Assertion failure: largestUnit <= TemporalUnit::Day, at builtin/temporal/Duration.cpp:2555

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20250610-3dcf26fdb6fd (debug build, run with --fuzzing-safe --ion-offthread-compile=off):

b = new Temporal.Duration(0, 0, 0, 0, 13);
b.round({
    relativeTo: new Temporal.PlainDateTime(1, 9, 30),
    smallestUnit: 'hours',
    roundingIncrement: 12,
    roundingMode: 'ceil'
});

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x00005555583e9807 in js::temporal::RoundRelativeDuration(JSContext*, js::temporal::InternalDuration const&, js::temporal::EpochNanoseconds const&, js::temporal::ISODateTime const&, JS::Handle<js::temporal::TimeZoneValue>, JS::Handle<js::temporal::CalendarValue>, js::temporal::TemporalUnit, js::temporal::Increment, js::temporal::TemporalUnit, js::temporal::TemporalRoundingMode, js::temporal::InternalDuration*) ()
#1  0x0000555558406162 in js::temporal::DifferencePlainDateTimeWithRounding(JSContext*, js::temporal::ISODateTime const&, js::temporal::ISODateTime const&, JS::Handle<js::temporal::CalendarValue>, js::temporal::DifferenceSettings const&, js::temporal::InternalDuration*) ()
#2  0x00005555583f7fa6 in Duration_round(JSContext*, JS::CallArgs const&) ()
#3  0x00005555583f5efd in Duration_round(JSContext*, unsigned int, JS::Value*) ()
#4  0x0000555557045285 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) ()
[...]
#15 0x0000555556ec363e in main ()
rax	0x0	0
rbx	0x7fffffffcd78	140737488342392
rcx	0x9fb	2555
rdx	0x1	1
rsi	0x0	0
rdi	0x7ffff7bee7d0	140737349871568
rbp	0x7fffffffcb60	140737488341856
rsp	0x7fffffffc940	140737488341312
r8	0x0	0
r9	0x3	3
r10	0x0	0
r11	0x0	0
r12	0x0	0
r13	0x7fffffffcbe0	140737488341984
r14	0x5	5
r15	0x4	4
rip	0x5555583e9807 <js::temporal::RoundRelativeDuration(JSContext*, js::temporal::InternalDuration const&, js::temporal::EpochNanoseconds const&, js::temporal::ISODateTime const&, JS::Handle<js::temporal::TimeZoneValue>, JS::Handle<js::temporal::CalendarValue>, js::temporal::TemporalUnit, js::temporal::Increment, js::temporal::TemporalUnit, js::temporal::TemporalRoundingMode, js::temporal::InternalDuration*)+5879>
=> 0x5555583e9807 <_ZN2js8temporal21RoundRelativeDurationEP9JSContextRKNS0_16InternalDurationERKNS0_16EpochNanosecondsERKNS0_11ISODateTimeEN2JS6HandleINS0_13TimeZoneValueEEENSD_INS0_13CalendarValueEEENS0_12TemporalUnitENS0_9IncrementESI_NS0_20TemporalRoundingModeEPS3_+5879>:	mov    %rcx,(%rax)
   0x5555583e980a <_ZN2js8temporal21RoundRelativeDurationEP9JSContextRKNS0_16InternalDurationERKNS0_16EpochNanosecondsERKNS0_11ISODateTimeEN2JS6HandleINS0_13TimeZoneValueEEENSD_INS0_13CalendarValueEEENS0_12TemporalUnitENS0_9IncrementESI_NS0_20TemporalRoundingModeEPS3_+5882>:	callq  0x555556f5e850 <abort>

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[André Bargull [:anba]]

Reported to https://github.com/tc39/proposal-temporal/issues/3121.

Comment 4

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20250610155140-9b57db0f203e.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: a1cc47ed2278fe3b16902c3b70ba4303030f17f6 (20250313102934)
End: 3dcf26fdb6fd8e8e48af0254f033df162be3e7ac (20250610090753)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Comment 5

[André Bargull [:anba]]

Attachment: Bug 1971346: Fix type assertion in BubbleRelativeDuration. r=#spidermonkey-reviewers!

Implements the changes from https://github.com/tc39/proposal-temporal/pull/3123.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/2de925702d50
https://hg.mozilla.org/integration/autoland/rev/f0b8ae09ccda
Fix type assertion in BubbleRelativeDuration. r=spidermonkey-reviewers,dminor

Comment 7

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/f0b8ae09ccda

Comment 8

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20251127213532-1d083dd7a3b0.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.