889937 - Crash while reading a NaN-Float32/64 from a DataView

Status: RESOLVED DUPLICATE of bug 859892

(Core :: JavaScript Engine, defect)

Description

[Jens Duttke]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0 (Beta/Release)
Build ID: 20130618035212

Steps to reproduce:

Running the following JavaScript code:
var ab = new ArrayBuffer(4),
    dv = new DataView(ab);

dv.setUint32(0, 0xfffffff6);
console.log(dv.getFloat32(0));


Actual results:

The Browser crashs


Expected results:

The browser should return NaN.
In Firefox 21 this worked without problems.

Comment 1

[Scoobidiver (away)]

Please provide a testcase as an attachment and a crash ID from the about:crashes page.

Comment 2

[Jens Duttke]

Attachment: Test case

The div#out should be filled with "NaN", but the browser crashs while loading the file.

Comment 3

[Jens Duttke]

Here are some crash IDs from the about:crashes page:
bp-df28ab19-9cc3-4e14-8200-b06892130703
bp-6789474a-29db-47f3-90b5-dbfa22130703
bp-49468c32-8ca7-4397-84b5-1efed2130703
bp-c7e5f31c-3e2a-4f20-b966-89f932130703
bp-ef03ee6a-964c-4da5-8b4e-539992130703
bp-8454b825-003c-473c-8604-64bfe2130703
(all related to this bug)

Comment 4

[Jens Duttke]

I don't know if this information helps, but:
The problem also occurs while reading Float64 values, but does not occur while reading integer values from a DataView.

Comment 5

[Scoobidiver (away)]

In Nightly: bp-3430ccec-05bf-4119-b086-33fb42130703
In Beta: bp-0e6ec28e-a726-4f6a-ba9a-3ea992130703

Comment 6

[Jeff Walden [:Waldo]]

getFloat32 clearly has a JS_CANONICALIZE_NAN on trunk, and I would assume on branches, so I dunno what's up here.  But this sort of thing smells of canonicalization failure, so marking s-s for now til someone can really investigate.  (I tried reproducing with a Linux64 shell and don't get any errors, so I don't know what's up here just yet.)

Comment 7

[Boris Zbarsky [:bzbarsky]]

I can't reproduce either with a 64-bit browser build or a 32-bit browser build on Mac (both the Firefox 22 release build)...

Comment 8

[Scoobidiver (away)]

Note that it has bug 799198's signature which is marked as related to PGO.

Comment 9

[Jens Duttke]

Today I tried it at work on 3 64bit-Windows 7 systems, and all of them crash.
In Firefox 22 on MacOS X everything works correct.

Comment 10

[Daniel Veditz [:dveditz]]

(In reply to Scoobidiver from comment #8)
> Note that it has bug 799198's signature

You must mean some other bug?

Comment 11

[Scoobidiver (away)]

(In reply to Daniel Veditz [:dveditz] from comment #10)
> (In reply to Scoobidiver from comment #8)
> > Note that it has bug 799198's signature
> You must mean some other bug?
Yes. Bug 799118.

Comment 12

[Daniel Veditz [:dveditz]]

These crashes look relatively benign.

Comment 13

[Jens Duttke]

The problem still occurs in Firefox 23 (Windows)

Comment 14

[Jeff Walden [:Waldo]]

I'm pretty sure this is a dup of bug 859892, which was just fixed on trunk.  I'm going to optimistically mark it as such (and re-mark as a security bug :-\ ).  But confirmation would still be good.

Jens, could you confirm that this problem no longer reproduces in a current nightly build?  Download it from http://nightly.mozilla.org/ and have it add a desktop shortcut, then add the command line arguments -no-remote --ProfileManager to the shortcut, then run that -- it won't touch your regular Firefox install if you do it that way.  :-)