1461305 - Assertion failure: isExtensible(), at js/src/vm/NativeObject-inl.h:317

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision a7461494a7a0 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --disable-profiling --enable-debug --enable-optimize, run with --fuzzing-safe):

function init(self) {
    self[0] = self[1];
}
function testUnsettableLength(C) {
    C.from = Array.from;
    C.from([0, 10, 20, 30])
}
function InextensibleObject4() {
    init(this);
    Object.preventExtensions(this);
}
testUnsettableLength(InextensibleObject4);


Backtrace:

received signal SIGSEGV, Segmentation fault.
0x00000000004e2ea8 in js::NativeObject::ensureDenseInitializedLengthNoPackedCheck (this=this@entry=0x7ffff4c8a1a0, index=index@entry=0, extra=extra@entry=1) at js/src/vm/NativeObject-inl.h:317
#0  0x00000000004e2ea8 in js::NativeObject::ensureDenseInitializedLengthNoPackedCheck (this=this@entry=0x7ffff4c8a1a0, index=index@entry=0, extra=extra@entry=1) at js/src/vm/NativeObject-inl.h:317
#1  0x00000000004e3098 in js::NativeObject::ensureDenseElements (this=0x7ffff4c8a1a0, cx=0x7ffff5f17000, index=0, extra=1) at js/src/vm/NativeObject-inl.h:395
#2  0x0000000000c1328b in AddOrChangeProperty<(IsAddOrChange)1> (desc=..., id=..., obj=..., cx=0x7ffff5f17000) at js/src/vm/NativeObject.cpp:1424
#3  js::NativeDefineProperty (cx=<optimized out>, cx@entry=0x7ffff5f17000, obj=..., id=id@entry=..., desc_=..., result=...) at js/src/vm/NativeObject.cpp:1874
#4  0x0000000000ba4e6d in js::DefineDataProperty (cx=cx@entry=0x7ffff5f17000, obj=..., id=..., value=..., attrs=<optimized out>, result=...) at js/src/vm/JSObject.cpp:2852
#5  0x0000000000ba507b in js::DefineDataProperty (cx=0x7ffff5f17000, obj=..., id=..., value=..., attrs=<optimized out>) at js/src/vm/JSObject.cpp:2913
#6  0x00000000005a7500 in js::InitElemOperation (val=..., idval=..., obj=..., pc=<optimized out>, cx=<optimized out>) at js/src/vm/Interpreter-inl.h:647
#7  Interpret (cx=0x7ffff5f17000, state=...) at js/src/vm/Interpreter.cpp:3826
[...]
#17 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at js/src/shell/js.cpp:9294
rax	0x0	0
rbx	0x7ffff4c8a1a0	140737300177312
rcx	0x7ffff6c282ad	140737333330605
rdx	0x0	0
rsi	0x7ffff6ef7770	140737336276848
rdi	0x7ffff6ef6540	140737336272192
rbp	0x7fffffffc910	140737488341264
rsp	0x7fffffffc8b0	140737488341168
r8	0x7ffff6ef7770	140737336276848
r9	0x7ffff7fe4780	140737354024832
r10	0x58	88
r11	0x7ffff6b9e7a0	140737332766624
r12	0x7ffff4c8a1a0	140737300177312
r13	0x7ffff5f17000	140737319628800
r14	0x7ffff495a910	140737296836880
r15	0x7fffffffd040	140737488343104
rip	0x4e2ea8 <js::NativeObject::ensureDenseInitializedLengthNoPackedCheck(unsigned int, unsigned int)+472>
=> 0x4e2ea8 <js::NativeObject::ensureDenseInitializedLengthNoPackedCheck(unsigned int, unsigned int)+472>:	movl   $0x0,0x0
   0x4e2eb3 <js::NativeObject::ensureDenseInitializedLengthNoPackedCheck(unsigned int, unsigned int)+483>:	ud2

Comment 1

[André Bargull [:anba]]

This one should be fixed by https://hg.mozilla.org/mozilla-central/rev/aedaedf623ee.

Comment 2

[Fuzzing Team]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 45ec8fd380dd).
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/b46f3ba0c766
user:        Jan de Mooij
date:        Sat May 12 11:46:51 2018 +0200
summary:     Bug 1460381 - Support sealed and non-extensible dense elements on native objects. r=anba

This iteration took 292.021 seconds to run.

Comment 3

[Liz Henry (:lizzard) (relman/hg->git project)]

From commment 1 and 2, sounds like this is fixed in 62.