819794 - IonMonkey: Crash [@ js::ion::Range::isLowerInfinite] or [@ js::ion::LIRGenerator::visitAbs] with --ion-range-analysis=off

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

x = [];
x[2] = 1;
x.unshift(0);
x.unshift(0);
x.sort(function() {
    return Math.abs(4)
})

crashes js opt shell on IonMonkey changeset 725eb8792d27 with --ion-eager and --ion-range-analysis=off at js::ion::Range::isLowerInfinite

Although this seems like a null deref, I'm setting s-s and sec-moderate just-in-case, because I'm not sure of the meaning of --ion-range-analysis=off yet.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   114092:89e5db8cf62f
user:        Brian Hackett
date:        Fri Nov 23 23:23:03 2012 -0500
summary:     Add symbolic range analysis for loop induction variables, bug 766592. r=mjrosenb

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

js::ion::LIRGenerator::visitAbs is also on the stack.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Debug shells also crash with virtually identical stacks.

Comment 3

[Hannes Verschore [:h4writer]]

Attachment: Test if range information exists

I think we first wanted to land ion with range analysis disabled, but eventually it got enabled in all releases we ship ion. Now I think the chance that it will get disabled ever is very very low.

Comment 4

[Brian Hackett [Laid off!]]

NULL deref in a configuration we don't ship, not s-s.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Testcase can land with the patch.

Comment 6

[Hannes Verschore [:h4writer]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/a4a0aa798038

Comment 7

[Hannes Verschore [:h4writer]]

https://hg.mozilla.org/mozilla-central/rev/a4a0aa798038

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Testcase was landed -> VERIFIED