1481032 - Assertion failure: reqCapacity < oldCapacity, at js/src/vm/NativeObject.cpp:988

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 37b33c4f58b9 (build with --enable-debug, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

x = [];
x[6] = 0;
Object.preventExtensions(x);
x.length = 1;

Backtrace:

#0  0x000000000191e25f in js::NativeObject::shrinkElements (this=0x7f038c8002c0, cx=0x7f038c917000, reqCapacity=1) at js/src/vm/NativeObject.cpp:988
#1  0x000000000108bb13 in js::ArraySetLength (cx=0x7f038c917000, arr=..., id=..., attrs=4, value=..., result=...) at js/src/builtin/Array.cpp:795
#2  0x0000000001926b78 in js::CallJSSetterOp (cx=<optimized out>, op=0x108c470 <array_length_setter(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::ObjectOpResult&)>, result=..., obj=..., id=..., v=...) at js/src/vm/JSContext-inl.h:301
#3  NativeSetExistingDataProperty (cx=<optimized out>, obj=..., shape=..., v=..., result=...) at js/src/vm/NativeObject.cpp:2516
#4  SetExistingProperty (cx=0x7f038c917000, id=..., v=..., receiver=..., pobj=..., prop=..., result=...) at js/src/vm/NativeObject.cpp:2728
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/c543368b25a6
user:        André Bargull
date:        Thu Aug 02 13:03:04 2018 -0700
summary:     Bug 1478503: Shrink capacity when modifying length on a non-extensible array. r=jandem

Andre, is bug 1478503 a likely regressor?

Comment 3

[André Bargull [:anba]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #2)
> Andre, is bug 1478503 a likely regressor?

Yes, the issue is caused by bug 1478503.

Comment 4

[André Bargull [:anba]]

Attachment: bug1481032.patch

Simply overlooked to adjust the call to shrinkElements() in ArraySetLength.

Comment 5

[André Bargull [:anba]]

Try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=495374cf2efd8f47ba02446e22fe0fac6d05c6b7

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/b20289e44689
Non-extensible arrays are already shrunk to capacity. r=jandem

Comment 7

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/b20289e44689