1499854 - Assertion failure: (typeOffset % eArray == 0) && (typeOffset / eArray <= 2), at /builds/worker/workspace/build/src/dom/indexedDB/Key.cpp:195

Status: RESOLVED FIXED

(Core :: Storage: IndexedDB, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev -9c943fa07f72.

Assertion failure: (typeOffset % eArray == 0) && (typeOffset / eArray <= 2), at /builds/worker/workspace/build/src/dom/indexedDB/Key.cpp:195

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x0000000000000b40   rbx = 0x00007f938a45fe88
rsi = 0x00007f93bb0e58b0   rdi = 0x00007f93bb0e4680
rbp = 0x00007ffd81f4cd50   rsp = 0x00007ffd81f4ccf0
r8 = 0x00007f93bb0e58b0    r9 = 0x00007f93bc256740
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x00007f9387873b1b   r13 = 0x00007ffd81f4cd10
r14 = 0x0000000000000060   r15 = 0x00007ffd81f4cd08
rip = 0x00007f93ab3c6619
OS|Linux|0.0.0 Linux 4.15.0-36-generic #39-Ubuntu SMP Mon Sep 24 16:19:09 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|0
0|0|libxul.so|mozilla::dom::indexedDB::Key::ToLocaleBasedKey(mozilla::dom::indexedDB::Key&, nsTString<char> const&) const|hg:hg.mozilla.org/mozilla-central:dom/indexedDB/Key.cpp:9c943fa07f723ebf4fa3a885b69fe2cb3c5da2d7|195|0x18
0|1|libxul.so|mozilla::dom::IDBObjectStore::AppendIndexUpdateInfo(long, mozilla::dom::indexedDB::KeyPath const&, bool, bool, nsTString<char> const&, JSContext*, JS::Handle<JS::Value>, nsTArray<mozilla::dom::indexedDB::IndexUpdateInfo>&)|hg:hg.mozilla.org/mozilla-central:dom/indexedDB/IDBObjectStore.cpp:9c943fa07f723ebf4fa3a885b69fe2cb3c5da2d7|1050|0x5
0|2|libxul.so|DeserializeIndexValueHelper::Run|hg:hg.mozilla.org/mozilla-central:dom/indexedDB/IDBObjectStore.cpp:9c943fa07f723ebf4fa3a885b69fe2cb3c5da2d7|1313|0x2a
0|3|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:9c943fa07f723ebf4fa3a885b69fe2cb3c5da2d7|1252|0x15
0|4|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:9c943fa07f723ebf4fa3a885b69fe2cb3c5da2d7|530|0x11
0|5|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:9c943fa07f723ebf4fa3a885b69fe2cb3c5da2d7|97|0xa
0|6|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:9c943fa07f723ebf4fa3a885b69fe2cb3c5da2d7|325|0x17
0|7|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:9c943fa07f723ebf4fa3a885b69fe2cb3c5da2d7|318|0x8
0|8|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:9c943fa07f723ebf4fa3a885b69fe2cb3c5da2d7|158|0xd
0|9|libxul.so|nsAppStartup::Run()|hg:hg.mozilla.org/mozilla-central:toolkit/components/startup/nsAppStartup.cpp:9c943fa07f723ebf4fa3a885b69fe2cb3c5da2d7|290|0xe
0|10|libxul.so|XREMain::XRE_mainRun()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:9c943fa07f723ebf4fa3a885b69fe2cb3c5da2d7|4777|0x11
0|11|libxul.so|XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:9c943fa07f723ebf4fa3a885b69fe2cb3c5da2d7|4922|0x8
0|12|libxul.so|XRE_main(int, char**, mozilla::BootstrapConfig const&)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:9c943fa07f723ebf4fa3a885b69fe2cb3c5da2d7|5014|0x5
0|13|firefox-bin|do_main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:9c943fa07f723ebf4fa3a885b69fe2cb3c5da2d7|233|0x22
0|14|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:9c943fa07f723ebf4fa3a885b69fe2cb3c5da2d7|315|0xd
0|15|libc-2.27.so||||0x21b97
0|16|firefox-bin|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:9c943fa07f723ebf4fa3a885b69fe2cb3c5da2d7|164|0x5

Comment 1

[violet.bugreport]

Attachment: Bug 1499854 - Binary should not be affected by locale

Key::ToLocaleBasedKey() overlooked the existence of |eBuffer| type,
probably because |eBuffer| was added later and the code wasn't updated
properly.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5e3a4e2b344e
Binary should not be affected by locale r=asuth

Comment 3

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/5e3a4e2b344e