Closed Bug 601070 Opened 11 years ago Closed 11 years ago

"Assertion failure: offset < length" [@ TypedArrayTemplate::copyFromWithOverlap]

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
Tracking Status
blocking2.0 --- betaN+

People

(Reporter: jruderman, Assigned: vlad)

Details

(Keywords: assertion, testcase, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file, 1 obsolete file)

var x = Int32Array();
x.set(x);

Assertion failure: offset < length, at jstypedarray.cpp:1234

The first bad revision is:
changeset:   82ff7c27fcb0
user:        Vladimir Vukicevic
date:        Fri Aug 27 12:07:24 2010 -0400
summary:     bug 575685; implement set() from TypedArray spec; r=jorendorff
blocking2.0: --- → ?
Assignee: general → vladimir
blocking2.0: ? → betaN+
Attached patch fix (obsolete) — Splinter Review
Simple fix; just bail early if there's nothing to do.  Assertion that's being caused is harmless for this particular case; it'll end up doing a memmove with 0 length, in other cases it would do a js_malloc of 0 bytes, and then loop 0 times, and then js_free the thing we malloc'd.
Attachment #481087 - Flags: review?
Attachment #481087 - Flags: review? → review?(jorendorff)
Comment on attachment 481087 [details] [diff] [review]
fix

Wouldn't it be better to fix the assertion? Everywhere else we assert that
offset <= length.
Attachment #481087 - Flags: review?(jorendorff)
Hm, for some reason I convinced myself that we couldn't just do that, but looking at the code again (and what I wrote above!) I think we can.
yeah, seems to work fine.
Attachment #481087 - Attachment is obsolete: true
Attachment #481341 - Flags: review?(jorendorff)
Attachment #481341 - Flags: review?(jorendorff) → review+
Looks like we have a patch that just needs to land.
http://hg.mozilla.org/tracemonkey/rev/4aeb551dd44d
Status: NEW → ASSIGNED
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/4aeb551dd44d
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.