New issue
Advanced search Search tips

Issue 664117 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Nov 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug

Blocking:
issue 663324



Sign in to add a comment

Difference between fullcode and ignition_turbo: array length overflow

Project Member Reported by machenb...@chromium.org, Nov 10 2016

Issue description

# Minimized program:
function foo() {
  return v.length + 1;
}
var v = [];
foo();
v.length = 0xFFFFFFFF;
%OptimizeFunctionOnNextCall(foo);
print(foo());


# Compared fullcode with ignition_turbo

# Flags of fullcode:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit  --random-seed -1845399049 --nocrankshaft --turbo-filter=~
# Flags of ignition_turbo:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit  --random-seed -1845399049 --ignition-staging --turbo

Difference:
- 4294967296
+ 0

### Start of configuration fullcode:
4294967296

### End of configuration fullcode

### Start of configuration ignition_turbo:
0

### End of configuration ignition_turbo
 
Owner: jarin@chromium.org
Status: Assigned (was: Untriaged)
Project Member

Comment 2 by bugdroid1@chromium.org, Nov 22 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/d7aae405c759e4684c4864a8cc07ad3552bde13a

commit d7aae405c759e4684c4864a8cc07ad3552bde13a
Author: jarin <jarin@chromium.org>
Date: Tue Nov 22 12:07:19 2016

[turbofan] Fix representation changes for unsigned values used as checked-signed values.

BUG= chromium:664117 

Review-Url: https://codereview.chromium.org/2522883002
Cr-Commit-Position: refs/heads/master@{#41173}

[modify] https://crrev.com/d7aae405c759e4684c4864a8cc07ad3552bde13a/src/compiler/representation-change.cc
[add] https://crrev.com/d7aae405c759e4684c4864a8cc07ad3552bde13a/test/mjsunit/compiler/regress-664117.js

Comment 3 by jarin@chromium.org, Nov 29 2016

Status: Fixed (was: Assigned)
Labels: v8-foozzie-failure

Sign in to add a comment