601070 - "Assertion failure: offset < length" [@ TypedArrayTemplate::copyFromWithOverlap]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

var x = Int32Array();
x.set(x);

Assertion failure: offset < length, at jstypedarray.cpp:1234

The first bad revision is:
changeset:   82ff7c27fcb0
user:        Vladimir Vukicevic
date:        Fri Aug 27 12:07:24 2010 -0400
summary:     bug 575685; implement set() from TypedArray spec; r=jorendorff

Comment 1

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: fix

Simple fix; just bail early if there's nothing to do.  Assertion that's being caused is harmless for this particular case; it'll end up doing a memmove with 0 length, in other cases it would do a js_malloc of 0 bytes, and then loop 0 times, and then js_free the thing we malloc'd.

Comment 2

[Jason Orendorff [:jorendorff]]

Comment on attachment 481087 [details] [diff] [review]
fix

Wouldn't it be better to fix the assertion? Everywhere else we assert that
offset <= length.

Comment 3

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Hm, for some reason I convinced myself that we couldn't just do that, but looking at the code again (and what I wrote above!) I think we can.

Comment 4

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: now with more assert fixing

yeah, seems to work fine.

Comment 5

[David Mandelin [:dmandelin]]

Looks like we have a patch that just needs to land.

Comment 6

[David Mandelin [:dmandelin]]

http://hg.mozilla.org/tracemonkey/rev/4aeb551dd44d

Comment 7

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/4aeb551dd44d

Comment 8

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929