1335619 - Assertion failure: !keyVal.isMagic(JS_ELEMENTS_HOLE), at js/src/builtin/MapObject.cpp:1185

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 1d025ac534a6 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --ion-eager):

// jsfunfuzz-generated
x = [];
y = x.push(Set, 1);
Array.prototype.shift.call(x);
// Adapted from randomly chosen test: js/src/tests/ecma_5/String/match-defines-match-elements.js
Object.defineProperty(Array.prototype, 1, {
    set: function() {}
})
// jsfunfuzz-generated
Array.prototype.splice.call(x, 3, {}, y);
new Set(x);


Backtrace:

0   js-dbg-64-dm-clang-darwin-1d025ac534a6	0x000000010e4ac8a0 js::SetObject::construct(JSContext*, unsigned int, JS::Value*) + 3360 (MapObject.cpp:1185)
1   js-dbg-64-dm-clang-darwin-1d025ac534a6	0x000000010e46381e js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) + 222 (jscntxtinlines.h:263)
2   js-dbg-64-dm-clang-darwin-1d025ac534a6	0x000000010e46fa8a js::CallJSNativeConstructor(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) + 138 (jscntxtinlines.h:295)
3   js-dbg-64-dm-clang-darwin-1d025ac534a6	0x000000010e46402a InternalConstruct(JSContext*, js::AnyConstructArgs const&) + 570 (Interpreter.cpp:551)
4   js-dbg-64-dm-clang-darwin-1d025ac534a6	0x000000010e463c71 js::ConstructFromStack(JSContext*, JS::CallArgs const&) + 65 (Interpreter.cpp:589)
/snip

For detailed crash information, see attachment.

Locking s-s as a start because the assert seems to involve holes in Arrays, not sure if that might be bad.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/6aae92d8aa00
user:        André Bargull
date:        Thu Jan 26 12:19:01 2017 -0800
summary:     Bug 1282104 - Part 2: Remove dense fast path in Array.prototype methods which didn't check for inherited accessors. r=jandem

André, is bug 1282104 a likely regressor?

Comment 4

[André Bargull [:anba]]

Attachment: bug1335619.patch

With bug 1282104 fixed, we also need to check for inherited accessor properties before extending the dense elements in the fast path of step 16 for Array.p.splice. Before bug 1282104, this wasn't necessary because we always defined instead of set the elements in step 16.b.iv.2.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9019b1aeabd45a050c99686f3d694fd616239b2b

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/9019b1aeabd4

Comment 7

[Fuzzing Team]

JSBugMon: This bug has been automatically verified fixed.