1082649 - Assertion failure: isAttached(), at builtin/TypedObject.cpp:1479

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 54217864bae9 (run with --no-threads --fuzzing-safe):


var {StructType, uint32, storage} = TypedObject;
var S = new StructType({f: uint32, g: uint32});
function main(variant) {
  var s = new S({f: 22, g: 44});
  neuter(storage(s).buffer, variant);
  storage(s);
}
main("same-data");

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Jeff Walden [:Waldo]]

At a glance, looks like StorageOfTypedObject needs the same TypedObjectIsAttached guard as a bunch of other accessor methods have.

It looks like, since I wrote the progenitor test to this mutation, new typed-object methods (or at least this one) have arisen that don't handle neutering correctly.  The process of fixing this bug should probably audit all buffer/length/byteLength/byteOffset accesses in all of TypedObject.js for proper guarding -- not just assuming this is the only one.

Comment 3

[Christian Holler (:decoder)]

Marking s-s after discussing with Waldo. This is nightly only but it might be security-related.

Comment 4

[Niko Matsakis [:nmatsakis]]

Bringing in bhackett as well, since he's been hacking on this code lately.

Comment 5

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/91914270690b
user:        Brian Hackett
date:        Wed Oct 08 09:38:09 2014 -0700
summary:     Bug 1073836 - Remove byte offset slot and non-unsized uses of length from typed objects, r=nmatsakis.

This iteration took 597.966 seconds to run.

Comment 6

[Christian Holler (:decoder)]

Needinfo from bhackett based on comment 5.

Comment 7

[Brian Hackett [Laid off!]]

Attachment: patch

After bug 1073836 we can't compute the byte offset for outline typed objects with a detached buffer.  I don't think it makes much sense for storage() to do anything when the buffer is detached, and I didn't see anything addressing this in the typed objects wiki, so this patch just throws in that case.  The only other use of TypedObjectByteOffset is in MapTypedParImplDepth1.  I didn't find a check for attached typed objects anywhere in the functions calling that one; how are neuter checks supposed to happen with PJS execution?

Comment 8

[Niko Matsakis [:nmatsakis]]

Regarding MapTypedParImplDepth1, it ought to check that the target array is not neutered I presume.

Comment 9

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/138f767ee224

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/138f767ee224

Comment 11

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.