Closed
Bug 1981297
Opened 1 year ago
Closed 1 year ago
Assertion failure: oldBytes == SmallBufferRegion::from(alloc)->allocBytes(alloc), at /home/r00t/firefox/js/src/gc/BufferAllocator.cpp:1168
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
DUPLICATE
of bug 1978767
People
(Reporter: neseesun, Unassigned)
Details
(Keywords: reporter-external, Whiteboard: [client-bounty-form])
Attachments
(2 files)
version: lattest
reproduce:
just run with: ./js poc.js
Flags: sec-bounty?
Component is spidermonkey->js interpreter.
This can be trigger with following poc:
const arr = [1337, 1337];
arr.push(1337);
Object.defineProperty(arr, "length", { writable: false });
arr.shift();
Seems Object.defineProperty(arr, "length", { writable: false }); will trigger js::ArraySetLength => js::ArrayObject::setNonWritableLength => js::NativeObject::shrinkCapacityToInitializedLength and reshape the array map wrongly, thus when arr.shift gets runned array capacity inconsistent
|
||
Updated•1 year ago
|
Group: firefox-core-security → javascript-core-security
Component: Security → JavaScript Engine
Product: Firefox → Core
|
||
Updated•1 year ago
|
Status: UNCONFIRMED → RESOLVED
Closed: 1 year ago
Duplicate of bug: 1978767
Resolution: --- → DUPLICATE
|
||
Updated•1 year ago
|
Flags: sec-bounty? → sec-bounty-
|
|
||
Updated•6 months ago
|
Group: javascript-core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•