1427233 - Assertion failure: obj->is<ArrayBufferViewObject>(), at js/src/vm/ArrayBufferObject.cpp:2017 with parseBin

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 01cbfc6c625f (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --disable-profiling --enable-debug --enable-optimize, run with --fuzzing-safe --cpu-count=2 --disable-oom-functions --disable-oom-functions):

g = newGlobal();
g.parseBin(new Int32Array({}));


Backtrace:

received signal SIGSEGV, Segmentation fault.
0x0000000000ad7f48 in js::GetArrayBufferViewLengthAndData (obj=0x7ffff5100580, length=length@entry=0x7fffffffc204, isSharedMemory=isSharedMemory@entry=0x7fffffffc203, data=data@entry=0x7fffffffc208) at js/src/vm/ArrayBufferObject.cpp:2017
#0  0x0000000000ad7f48 in js::GetArrayBufferViewLengthAndData (obj=0x7ffff5100580, length=length@entry=0x7fffffffc204, isSharedMemory=isSharedMemory@entry=0x7fffffffc203, data=data@entry=0x7fffffffc208) at js/src/vm/ArrayBufferObject.cpp:2017
#1  0x0000000000462fad in BinParse (cx=0x7ffff5f16000, argc=<optimized out>, vp=<optimized out>) at js/src/shell/js.cpp:4430
#2  0x0000000000575dd1 in js::CallJSNative (cx=0x7ffff5f16000, native=0x462e10 <BinParse(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:291
[...]
#24 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at js/src/shell/js.cpp:9141
rax	0x0	0
rbx	0x1fc4b80	33311616
rcx	0x7ffff6c282ad	140737333330605
rdx	0x0	0
rsi	0x7ffff6ef7770	140737336276848
rdi	0x7ffff6ef6540	140737336272192
rbp	0x7fffffffc1c0	140737488339392
rsp	0x7fffffffc170	140737488339312
r8	0x7ffff6ef7770	140737336276848
r9	0x7ffff7fe4780	140737354024832
r10	0x58	88
r11	0x7ffff6b9e7a0	140737332766624
r12	0x2014260	33636960
r13	0x7fffffffc204	140737488339460
r14	0x7ffff5100580	140737304855936
r15	0x7fffffffc208	140737488339464
rip	0xad7f48 <js::GetArrayBufferViewLengthAndData(JSObject*, unsigned int*, bool*, unsigned char**)+568>
=> 0xad7f48 <js::GetArrayBufferViewLengthAndData(JSObject*, unsigned int*, bool*, unsigned char**)+568>:	movl   $0x0,0x0
   0xad7f53 <js::GetArrayBufferViewLengthAndData(JSObject*, unsigned int*, bool*, unsigned char**)+579>:	ud2


Shell-only issue.

Comment 1

[David Teller [:Yoric] - still alive but not very active]

Sorry for the slow response. Yeah, I can turn this into a TypeError.

Comment 2

[David Teller [:Yoric] - still alive but not very active]

Attachment: Bug 1427233 - BinParse checks whether the argument is an ArrayBuffer;

Review commit: https://reviewboard.mozilla.org/r/213550/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/213550/

Comment 3

[David Teller [:Yoric] - still alive but not very active]

Comment on attachment 8943198 [details]
Bug 1427233 - BinParse checks whether the argument is an ArrayBuffer;

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/213550/diff/1-2/

Comment 4

[Jan de Mooij [:jandem]]

Comment on attachment 8943198 [details]
Bug 1427233 - BinParse checks whether the argument is an ArrayBuffer;

https://reviewboard.mozilla.org/r/213550/#review219622

Does this mean we have no shell tests for this function? Why?

Comment 5

[Fuzzing Team]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/27a84140b47d
user:        David Teller
date:        Mon Sep 18 16:41:00 2017 +0200
summary:     Bug 1377007 - JS shell bindings for binjs-ref;r=arai,jorendorff

This iteration took 276.090 seconds to run.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

David, is this patch ready for landing soon?

Comment 7

[David Teller [:Yoric] - still alive but not very active]

(In reply to Jan de Mooij [:jandem] from comment #4)
> Comment on attachment 8943198 [details]
> Bug 1427233 - BinParse checks whether the argument is an ArrayBuffer;
> 
> https://reviewboard.mozilla.org/r/213550/#review219622
> 
> Does this mean we have no shell tests for this function? Why?

I'll admit that I don't even know where we can put such tests.

Comment 8

[David Teller [:Yoric] - still alive but not very active]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #6)
> David, is this patch ready for landing soon?

Sorry, forgot about that patch. Unless I realize that I made a terrible mistake, I hope to land it today.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0453e02a04c0
BinParse checks whether the argument is an ArrayBuffer;r=jandem

Comment 10

[Jan de Mooij [:jandem]]

(In reply to David Teller [:Yoric] (please use "needinfo") from comment #7)
> I'll admit that I don't even know where we can put such tests.

I'd suggest js/src/jit-test/tests/binast/

Comment 11

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/0453e02a04c0

Comment 12

[Ryan VanderMeulen [:RyanVM]]

Can we land this test?

Comment 13

[David Teller [:Yoric] - still alive but not very active]

I'll try and find time to land the test, but I'm currently fighting a pretty large and high-priority patch.