135231 2014-07-24 01:42:40 -0700 ASSERTION FAILED: (year >= minYear && year <= maxYear) || (product - year == static_cast<int>(std::numeric_limits<double>::quiet_NaN())) in WTF::equivalentYearForDST 2016-08-03 14:37:58 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED WORKSFORME P2 Normal --- 116980 1 rhodovan.u-szeged llango.u-szeged ap bfulgham ggaren llango.u-szeged mark.lam oldest_to_newest 1024463 0 rhodovan.u-szeged 2014-07-24 01:42:40 -0700 The following test causes the assertion failure: new Date().setDate(7817338032789) The backtrace: ASSERTION FAILED: (year >= minYear && year <= maxYear) || (product - year == static_cast<int>(std::numeric_limits<double>::quiet_NaN())) ../../Source/WTF/wtf/DateMath.cpp(362) : int WTF::equivalentYearForDST(int) 1 0x7ffff73b4662 /home/renifuzz/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(WTFCrash+0x1e) [0x7ffff73b4662] 2 0x7ffff73b76fb /home/renifuzz/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3WTF20equivalentYearForDSTEi+0x10e) [0x7ffff73b76fb] 3 0x7ffff73b7740 /home/renifuzz/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3WTF24calculateLocalTimeOffsetEd+0x3b) [0x7ffff73b7740] 4 0x7ffff727f367 /home/renifuzz/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(+0xda2367) [0x7ffff727f367] 5 0x7ffff727f4a7 /home/renifuzz/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC21gregorianDateTimeToMSERNS_2VMERKN3WTF17GregorianDateTimeEdb+0x101) [0x7ffff727f4a7] 6 0x7ffff72553cb /home/renifuzz/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(+0xd783cb) [0x7ffff72553cb] 7 0x7ffff725557d /home/renifuzz/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(+0xd7857d) [0x7ffff725557d] 8 0x7fffb23ca0b4 [0x7fffb23ca0b4] Program received signal SIGSEGV, Segmentation fault. 0x00007ffff73b4667 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329 329 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007ffff73b4667 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329 #1 0x00007ffff73b76fb in WTF::equivalentYearForDST (year=2061) at ../../Source/WTF/wtf/DateMath.cpp:362 #2 0x00007ffff73b7740 in WTF::calculateLocalTimeOffset (ms=6.7541800743709429e+20) at ../../Source/WTF/wtf/DateMath.cpp:478 #3 0x00007ffff727f367 in JSC::localTimeOffset (vm=..., ms=6.7541800743709429e+20) at ../../Source/JavaScriptCore/runtime/JSDateMath.cpp:183 #4 0x00007ffff727f4a7 in JSC::gregorianDateTimeToMS (vm=..., t=..., milliSeconds=6.7541800603296963e+20, inputIsUTC=false) at ../../Source/JavaScriptCore/runtime/JSDateMath.cpp:198 #5 0x00007ffff72553cb in JSC::setNewValueFromDateArgs (exec=0x7fffffffcdc0, numArgsToUse=1, inputIsUTC=false) at ../../Source/JavaScriptCore/runtime/DatePrototype.cpp:936 #6 0x00007ffff725557d in JSC::dateProtoFuncSetDate (exec=0x7fffffffcdc0) at ../../Source/JavaScriptCore/runtime/DatePrototype.cpp:992 #7 0x00007fffb23ca0b4 in ?? () #8 0x00007fffffffce10 in ?? () #9 0x00007ffff739e0c8 in llint_entry () from /home/renifuzz/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0 1024753 1 ap 2014-07-24 19:58:06 -0700 Looks like a duplicate of bug 131248. 1217208 2 bfulgham 2016-08-03 14:37:58 -0700 This issue no longer occurs under GuardMalloc or ASAN as of r204037. If you believe there is still a bug, please reopen this issue with a revised test case. I tested in the MiniBrowser JSC console: > new Date().setDate(7817338032789) < NaN