1904648 - Hit MOZ_CRASH(setFromOverlappingTypedArray with a typed array with bogus type) at js/src/vm/TypedArrayObject-inl.h:759

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Nils Bars]

Attachment: bug.js

Steps to reproduce:

Checkout commit 9fcc11127fbfbdc88cbf37489dac90542e141c77 and invoke the js shell as follows:

js --fuzzing-safe <test-case>

Actual results:

Hit MOZ_CRASH(setFromOverlappingTypedArray with a typed array with bogus type) at js/src/vm/TypedArrayObject-inl.h:759

Comment 1

[Jan de Mooij [:jandem]]

Reduced test below. We're not handling Float16Array in setFromOverlappingTypedArray.

var ta1 = new Uint8Array(6);
var ta2 = new Float16Array(ta1.buffer);
ta1.set(ta2);

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1833647

Comment 3

[Andrew McCreight [:mccr8]]

Is this actually a security issue? It looks like we're hitting a release crash.

Comment 4

[Dan Minor [:dminor]]

I don't think this is a sec issue, unless there are implications outside of the location of the crash. Jan, could we make this a non-sec bug?

Comment 5

[Jan de Mooij [:jandem]]

Yes this is a safe crash.

Comment 6

[Dan Minor [:dminor]]

Attachment: Bug 1904648 - Support Float16Array in setFromOverlappingTypedArray; r=jandem!

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c700d0b5a07c
Support Float16Array in setFromOverlappingTypedArray; r=jandem

Comment 8

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/c700d0b5a07c

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:dminor, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox128 to wontfix.

For more information, please visit BugBot documentation.

Comment 10

[Dan Minor [:dminor]]

This was previously off by default on Nightly prior to Firefox 129.