Bug 128740 – ASSERTION FAILED: (year >= 1970 && yearday >= 0) || (year < 1970 && yearday < 0) in WTF::dateToDaysFrom1970

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Renata Hodovan]

Created attachment 224058 [details]
Test case

The test was ran on debug efl jsc:

function function_0() {
    new Date(6501480442020679337816440, 81696082856817131586190070, 1, 1, 1, 1, 1);   
}

function_0();


The backtrace:

ASSERTION FAILED: (year >= 1970 && yearday >= 0) || (year < 1970 && yearday < 0)
/home/reni2/data/REPOS/webkit_sec/Source/WTF/wtf/DateMath.cpp(312) : double WTF::dateToDaysFrom1970(int, int, int)
1   0x7ffff740623b WTFCrash
2   0x7ffff74090e2 WTF::dateToDaysFrom1970(int, int, int)
3   0x7ffff72d98d5 JSC::gregorianDateTimeToMS(JSC::VM&, WTF::GregorianDateTime const&, double, bool)
4   0x7ffff72ab18c JSC::constructDate(JSC::ExecState*, JSC::JSGlobalObject*, JSC::ArgList const&)
5   0x7ffff72ab24d
6   0x7ffff73e88d3
7   0x7ffff73eb7fa JSC::LLInt::setUpCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*)
8   0x7ffff73ebcb4 JSC::LLInt::genericCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind)
9   0x7ffff73e8a8f
10  0x7ffff73f1664

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7406240 in WTFCrash () at /home/reni2/data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:333
333	    *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt
#0  0x00007ffff7406240 in WTFCrash () at /home/reni2/data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:333
#1  0x00007ffff74090e2 in WTF::dateToDaysFrom1970 (year=-2147483648, month=0, day=1)
    at /home/reni2/data/REPOS/webkit_sec/Source/WTF/wtf/DateMath.cpp:312
#2  0x00007ffff72d98d5 in JSC::gregorianDateTimeToMS (vm=..., t=..., milliSeconds=1, inputIsUTC=false)
    at /home/reni2/data/REPOS/webkit_sec/Source/JavaScriptCore/runtime/JSDateMath.cpp:193
#3  0x00007ffff72ab18c in JSC::constructDate (exec=0x7fffffffcb90, globalObject=0x7ffff7f2f970, args=...)
    at /home/reni2/data/REPOS/webkit_sec/Source/JavaScriptCore/runtime/DateConstructor.cpp:170
#4  0x00007ffff72ab24d in JSC::constructWithDateConstructor (exec=0x7fffffffcb90)
    at /home/reni2/data/REPOS/webkit_sec/Source/JavaScriptCore/runtime/DateConstructor.cpp:180
#5  0x00007ffff73e88d3 in JSC::LLInt::handleHostCall (execCallee=0x7fffffffcb90, pc=0x680358, callee=..., kind=JSC::CodeForConstruct)
    at /home/reni2/data/REPOS/webkit_sec/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1050
#6  0x00007ffff73eb7fa in JSC::LLInt::setUpCall (execCallee=0x7fffffffcb90, pc=0x680358, kind=JSC::CodeForConstruct, calleeAsValue=..., 
    callLinkInfo=0x67fee0) at /home/reni2/data/REPOS/webkit_sec/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1071
#7  0x00007ffff73ebcb4 in JSC::LLInt::genericCall (exec=0x7fffffffcc10, pc=0x680358, kind=JSC::CodeForConstruct)
    at /home/reni2/data/REPOS/webkit_sec/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1137
#8  0x00007ffff73e8a8f in JSC::LLInt::llint_slow_path_construct (exec=0x7fffffffcc10, pc=0x680358)
    at /home/reni2/data/REPOS/webkit_sec/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1149
#9  0x00007ffff73f1664 in llint_op_construct () from /home/reni2/data/REPOS/webkit_sec/WebKitBuild/Debug/lib/libjavascriptcore_efl.so.0
#10 0x00007fffffffcc10 in ?? ()
#11 0x0000000000000000 in ?? ()
(gdb)

[Dániel Bátyai]

Created attachment 224367 [details]
Proposed patch

[Renata Hodovan]

You should add a test case demonstrating the bug and a bit more longer description about the fix.

[Build Bot]

Comment on attachment 224367 [details]
Proposed patch

Attachment 224367 [details] did not pass mac-ews (mac):
Output: http://webkit-queues.appspot.com/results/4958940718694400

New failing tests:
js/date-constructor.html
js/date-toisostring.html
platform/mac/fast/AppleScript/date.html
js/date-utc-timeclip.html

[Build Bot]

Created attachment 224383 [details]
Archive of layout-test-results from webkit-ews-08 for mac-mountainlion

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: webkit-ews-08  Port: mac-mountainlion  Platform: Mac OS X 10.8.5

[Build Bot]

Comment on attachment 224367 [details]
Proposed patch

Attachment 224367 [details] did not pass mac-ews (mac):
Output: http://webkit-queues.appspot.com/results/5059838493065216

New failing tests:
js/date-constructor.html
js/date-toisostring.html
platform/mac/fast/AppleScript/date.html
js/date-utc-timeclip.html

[Build Bot]

Created attachment 224385 [details]
Archive of layout-test-results from webkit-ews-06 for mac-mountainlion

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: webkit-ews-06  Port: mac-mountainlion  Platform: Mac OS X 10.8.5

[Build Bot]

Comment on attachment 224367 [details]
Proposed patch

Attachment 224367 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.appspot.com/results/5575685137498112

New failing tests:
js/date-constructor.html
js/date-toisostring.html
js/date-utc-timeclip.html

[Build Bot]

Created attachment 224387 [details]
Archive of layout-test-results from webkit-ews-14 for mac-mountainlion-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: webkit-ews-14  Port: mac-mountainlion-wk2  Platform: Mac OS X 10.8.5

[Dániel Bátyai]

Created attachment 224645 [details]
Proposed patch

Very large numbers could cause an overflow which resulted in the assertion failing in WTF::dateToDaysFrom1970
The patch makes DateConstructor check if the number fits into an Int32 before casting

[WebKit Commit Bot]

Attachment 224645 [details] did not pass style-queue:


ERROR: Source/JavaScriptCore/runtime/DateConstructor.cpp:151:  Missing spaces around <  [whitespace/operators] [3]
ERROR: Source/JavaScriptCore/runtime/DateConstructor.cpp:152:  Missing spaces around <  [whitespace/operators] [3]
ERROR: Source/JavaScriptCore/runtime/DateConstructor.cpp:153:  Missing spaces around <  [whitespace/operators] [3]
ERROR: Source/JavaScriptCore/runtime/DateConstructor.cpp:154:  Missing spaces around <  [whitespace/operators] [3]
ERROR: Source/JavaScriptCore/runtime/DateConstructor.cpp:155:  Missing spaces around <  [whitespace/operators] [3]
ERROR: Source/JavaScriptCore/runtime/DateConstructor.cpp:156:  Missing spaces around <  [whitespace/operators] [3]
ERROR: Source/JavaScriptCore/runtime/DateConstructor.cpp:157:  Missing spaces around <  [whitespace/operators] [3]
ERROR: Source/JavaScriptCore/runtime/DateConstructor.cpp:230:  Missing spaces around <  [whitespace/operators] [3]
ERROR: Source/JavaScriptCore/runtime/DateConstructor.cpp:231:  Missing spaces around <  [whitespace/operators] [3]
ERROR: Source/JavaScriptCore/runtime/DateConstructor.cpp:232:  Missing spaces around <  [whitespace/operators] [3]
ERROR: Source/JavaScriptCore/runtime/DateConstructor.cpp:233:  Missing spaces around <  [whitespace/operators] [3]
ERROR: Source/JavaScriptCore/runtime/DateConstructor.cpp:234:  Missing spaces around <  [whitespace/operators] [3]
ERROR: Source/JavaScriptCore/runtime/DateConstructor.cpp:235:  Missing spaces around <  [whitespace/operators] [3]
ERROR: Source/JavaScriptCore/runtime/DateConstructor.cpp:236:  Missing spaces around <  [whitespace/operators] [3]
Total errors found: 14 in 5 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Dániel Bátyai]

Created attachment 224648 [details]
Proposed patch

Very large numbers could cause an overflow which resulted in the assertion failing in WTF::dateToDaysFrom1970
The patch makes DateConstructor check if the number fits into an Int32 before casting

[Dániel Bátyai]

Comment on attachment 224648 [details]
Proposed patch

Very large numbers could cause an overflow which resulted in the assertion failing in WTF::dateToDaysFrom1970
The patch makes DateConstructor check if the number fits into an Int32 before casting

[Geoffrey Garen]

Comment on attachment 224648 [details]
Proposed patch

r=me

[WebKit Commit Bot]

Comment on attachment 224648 [details]
Proposed patch

Clearing flags on attachment: 224648

Committed r164373: <http://trac.webkit.org/changeset/164373>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.