893364 - FPE crash in OdinMonkey-generated code with (subtractionExpr % -1)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

function m()
{
    "use asm";
    function f()
    {
        return (((0x77777777 - 0xcccccccc) | 0) % -1) | 0;
    }
    return f;
}
m()()

Like bug 892291 (recently fixed), this started crashing when bug 864400 landed, but might be a pre-existing range analysis bug.

Comment 1

[Luke Wagner [:luke]]

Nicolas: Do you think this is another range analysis bug as Jesse suggests?

Comment 2

[Nicolas B. Pierron [:nbp]]

I think this is likely that there is a Range Analysis issue fixable with a similar patch as done for Bug 892291.  The reasons being that ASM.JS reuse the same truncate flag of the Range Analysis, but the Range Analysis was made assuming that no-one else was setting these truncate flags.

Comment 3

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: proposed fix + test case

Same patch as bug 892291. Bonus: same case is hit for additions overflowing in negative values.

Comment 4

[Benjamin Bouvier [:bbouvier] (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4a42817c9d5d

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/4a42817c9d5d