1790543 - Assertion failure: !PrototypeMayHaveIndexedProperties(arr), at jit/VMFunctions.cpp:654

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20220912-b66bbbcc4467 (debug build, run with --fuzzing-safe --ion-offthread-compile=off):

__proto__[0] = a = [];
for (;;)
  a.push(0);

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x00005555577ff895 in js::jit::ArrayPushDense(JSContext*, JS::Handle<js::ArrayObject*>, JS::Handle<JS::Value>, unsigned int*) ()
#1  0x000013ff8c2109c4 in ?? ()
#2  0x0000000000000000 in ?? ()
rax	0x555555842fc1	93824995307457
rbx	0x7ffff4e44010	140737301987344
rcx	0x5555582cdae8	93825039915752
rdx	0x0	0
rsi	0x7ffff7105770	140737338431344
rdi	0x7ffff7104540	140737338426688
rbp	0x7fffffffbd00	140737488338176
rsp	0x7fffffffbcd0	140737488338128
r8	0x7ffff7105770	140737338431344
r9	0x7ffff7f99800	140737353717760
r10	0x0	0
r11	0x0	0
r12	0x7ffff602a100	140737320755456
r13	0x7fffffffbd48	140737488338248
r14	0x7fffffffbd20	140737488338208
r15	0x7fffffffbd50	140737488338256
rip	0x5555577ff895 <js::jit::ArrayPushDense(JSContext*, JS::Handle<js::ArrayObject*>, JS::Handle<JS::Value>, unsigned int*)+501>
=> 0x5555577ff895 <_ZN2js3jit14ArrayPushDenseEP9JSContextN2JS6HandleIPNS_11ArrayObjectEEENS4_INS3_5ValueEEEPj+501>:	movl   $0x28e,0x0
   0x5555577ff8a0 <_ZN2js3jit14ArrayPushDenseEP9JSContextN2JS6HandleIPNS_11ArrayObjectEEENS4_INS3_5ValueEEEPj+512>:	callq  0x555556c349f4 <abort>

This happens with high frequency, marking as fuzzblocker.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[André Bargull [:anba]]

Attachment: Bug 1790543: Remove an overzealous assertion. r=jandem!

The assertion also rejects (non-frozen) dense elements on the prototype chain,
even though those are actually allowed.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ad955304487e
Remove an overzealous assertion. r=jandem

Comment 5

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220912214055-b66bbbcc4467.
The bug appears to have been introduced in the following build range:

Start: 747c206e4fd85e5ef30f5290872fde2204105c61 (20220912124208)
End: 1e48e6bda87186e8bef21870b7039f4f4f915007 (20220912124713)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=747c206e4fd85e5ef30f5290872fde2204105c61&tochange=1e48e6bda87186e8bef21870b7039f4f4f915007

Comment 6

[BugBot [:suhaib / :marco]]

Setting Regressed by field after analyzing regression range found by bugmon in comment #5.

Comment 7

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1790275

Comment 8

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/ad955304487e

Comment 9

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220913154221-26065fde0af4.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.