Bug 135231 - ASSERTION FAILED: (year >= minYear && year <= maxYear) || (product - year == static_cast<int>(std::numeric_limits<double>::quiet_NaN())) in WTF::equivalentYearForDST
Summary: ASSERTION FAILED: (year >= minYear && year <= maxYear) || (product - year == ...
Status: RESOLVED WORKSFORME
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: László Langó
URL:
Keywords:
Depends on:
Blocks: 116980
  Show dependency tree / graph
 
Reported: 2014-07-24 01:42 PDT by Renata Hodovan
Modified: 2016-08-03 14:37 PDT (History)
5 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Renata Hodovan 2014-07-24 01:42:40 PDT 
The following test causes the assertion failure:

new Date().setDate(7817338032789)

The backtrace:

ASSERTION FAILED: (year >= minYear && year <= maxYear) || (product - year == static_cast<int>(std::numeric_limits<double>::quiet_NaN()))
../../Source/WTF/wtf/DateMath.cpp(362) : int WTF::equivalentYearForDST(int)
1   0x7ffff73b4662 /home/renifuzz/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(WTFCrash+0x1e) [0x7ffff73b4662]
2   0x7ffff73b76fb /home/renifuzz/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3WTF20equivalentYearForDSTEi+0x10e) [0x7ffff73b76fb]
3   0x7ffff73b7740 /home/renifuzz/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3WTF24calculateLocalTimeOffsetEd+0x3b) [0x7ffff73b7740]
4   0x7ffff727f367 /home/renifuzz/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(+0xda2367) [0x7ffff727f367]
5   0x7ffff727f4a7 /home/renifuzz/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC21gregorianDateTimeToMSERNS_2VMERKN3WTF17GregorianDateTimeEdb+0x101) [0x7ffff727f4a7]
6   0x7ffff72553cb /home/renifuzz/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(+0xd783cb) [0x7ffff72553cb]
7   0x7ffff725557d /home/renifuzz/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(+0xd7857d) [0x7ffff725557d]
8   0x7fffb23ca0b4 [0x7fffb23ca0b4]

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff73b4667 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329
329	    *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt
#0  0x00007ffff73b4667 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:329
#1  0x00007ffff73b76fb in WTF::equivalentYearForDST (year=2061) at ../../Source/WTF/wtf/DateMath.cpp:362
#2  0x00007ffff73b7740 in WTF::calculateLocalTimeOffset (ms=6.7541800743709429e+20) at ../../Source/WTF/wtf/DateMath.cpp:478
#3  0x00007ffff727f367 in JSC::localTimeOffset (vm=..., ms=6.7541800743709429e+20) at ../../Source/JavaScriptCore/runtime/JSDateMath.cpp:183
#4  0x00007ffff727f4a7 in JSC::gregorianDateTimeToMS (vm=..., t=..., milliSeconds=6.7541800603296963e+20, inputIsUTC=false)
    at ../../Source/JavaScriptCore/runtime/JSDateMath.cpp:198
#5  0x00007ffff72553cb in JSC::setNewValueFromDateArgs (exec=0x7fffffffcdc0, numArgsToUse=1, inputIsUTC=false)
    at ../../Source/JavaScriptCore/runtime/DatePrototype.cpp:936
#6  0x00007ffff725557d in JSC::dateProtoFuncSetDate (exec=0x7fffffffcdc0) at ../../Source/JavaScriptCore/runtime/DatePrototype.cpp:992
#7  0x00007fffb23ca0b4 in ?? ()
#8  0x00007fffffffce10 in ?? ()
#9  0x00007ffff739e0c8 in llint_entry () from /home/renifuzz/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0
Comment 1 Alexey Proskuryakov 2014-07-24 19:58:06 PDT 
Looks like a duplicate of bug 131248.
Comment 2 Brent Fulgham 2016-08-03 14:37:58 PDT 
This issue no longer occurs under GuardMalloc or ASAN as of r204037. If you believe there is still a bug, please reopen this issue with a revised test case.


I tested in the MiniBrowser JSC console:

> new Date().setDate(7817338032789)
< NaN