924538 - Assertion failure: false (MOZ_ASSUME_UNREACHABLE(Bad MIRType)), at jit/IonMacroAssembler.cpp:1862

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 56b0a41985f3 (run with --fuzzing-safe --ion-eager):


function testFloat32SetElemIC(a) {
  for (var i = 0; i < a.length; i++) {
    var r = Math.fround(Math.random());
    a[i] = r;
  }
}
testFloat32SetElemIC(new Array(2048));
testFloat32SetElemIC(new Uint8ClampedArray(2048));

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Sean Stangl [:sstangl]]

Float32 bug. I'll take it.

Comment 3

[Sean Stangl [:sstangl]]

Attachment: Float32 Support for Uint8ClampedArray

Uint8ClampedArray is missing a path for MIRType_Float32. This patch reuses the DoubleToInt path, since the conversion of a float to an integer is the same as the conversion of that float to a double and then to an integer. An actual implementation of FloatToInt involves some really scary-looking ARM code that I would prefer not to touch, and isn't appropriate for a security fix anyway -- we can leave that to a follow-up bug.

Comment 4

[Sean Stangl [:sstangl]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/869221327b1b

Comment 5

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/ed91189f940e
user:        Brian Hackett
date:        Wed Sep 18 09:43:21 2013 -0600
summary:     Bug 917441 - Remove dependence of IonBuilder on ScriptAnalysis, r=jandem.

This iteration took 380.577 seconds to run.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Sean, is bug 917441 an unlikely regressor, if it's a float32 bug?

Comment 7

[Carsten Book [:Tomcat]]

fixed in https://hg.mozilla.org/mozilla-central/rev/869221327b1b

Comment 8

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision c22969eec61d).

Comment 9

[Carsten Book [:Tomcat]]

marking fixed because its now landed on m-c

Comment 10

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 11

[Daniel Veditz [:dveditz]]

This appears to affect Firefox 26 (Aurora). How bad a crash is it? If it is actually a security problem we've now checked in a testcase that shows people how to trigger it. If it's a security bug we should land it in Aurora, if not we should unhide the bug.

Comment 12

[Daniel Veditz [:dveditz]]

I may need to take that back. If bug 917441 is the regressor (asked in comment 6 but not answered) then this is Firefox 27 only

Comment 13

[Lukas Blakk [:lsblakk] use ?needinfo]

Matt - can you confirm if this is unaffected on 26?

Comment 14

[Matt Wobensmith [:mwobensmith][:matt:]]

Appears to be unaffected on 26. I was able to repro on 27.

Comment 15

[Sean Stangl [:sstangl]]

Aurora contains Float32 support, so there's probably some way to trigger the same failure. I believe the plan is to disable Float32 on release and beta.