925848 - Crash with SIGTRAP and range analysis

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 672cd63528d3 (threadsafe build, run with --ion-check-range-analysis --ion-eager):


var TIME_1900 = -2208988800000;
var array = new Array();
array[array.length] = new Date( TIME_1900 * Math.PI );
array[array.length] = new Date( TIME_1900 * 10 );
var stringarr = new Array();
clone( array, stringarr );
stringarr.sort( stringsort );
function clone( source, target ) {
  for (i = 0; i < source.length; i++ ) {
    target[i] = source[i];
  }
}
function stringsort( x, y ) {
  for ( var i = 0; i < x.toString().length; i++ ) {
    var d = x.length - y.length;
    if  ( d > 0 ) {
    } else {
      if ( d < 0 ) {}
    }
  }
}

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Dan, do you have an idea on whether this is related to any of the recent range analysis work?

Comment 2

[Dan Gohman [:sunfish]]

Yes, I can confirm this is due to my range analysis changes.

Comment 3

[Dan Gohman [:sunfish]]

Attachment: range-nan-with-bounds.patch

Comment 4

[Dan Gohman [:sunfish]]

Since this was caused by my recent range analysis changes, I just checked the fix in:

https://hg.mozilla.org/integration/mozilla-inbound/rev/d0fc1cc4c62b

Comment 5

[Carsten Book [:Tomcat]]

fixed in mozilla-central https://hg.mozilla.org/mozilla-central/rev/d0fc1cc4c62b

Comment 6

[David Chan [:dchan]]

Cleaning up list of security bugs for b2g18. This bug doesn't need to be backported either due to it affecting a later version of Fx or another reason.