686296 - Assertion failure: obj->isExtensible(), at jsobj.cpp:4649

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central revision 569a45bfb71c (options -m -n -a):


(function () {
  assertThrows = function assertThrows(code, type_opt, cause_opt) {
        eval(code);
  };
})();
var o = Object.preventExtensions(new ArrayBuffer());
assertThrows("o.__proto__ = {}");

Comment 1

[Tom S [:evilpie]]

Attachment: fix

Comment 3

[Jason Orendorff [:jorendorff]]

Comment on attachment 588675 [details] [diff] [review]
fix

The test doesn't work.

Try this instead:

load(libdir + "asserts.js");
var o = Object.preventExtensions(new ArrayBuffer);
assertThrowsInstanceOf(function () { o.__proto__ = {}; }, TypeError);

Comment 4

[Tom S [:evilpie]]

Dammit, missed that with the try .. catch. Cool that we have a library function for that.

Comment 5

[Tom S [:evilpie]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8a915ca62e05

Comment 6

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/8a915ca62e05

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Comment on attachment 588675 [details] [diff] [review]
fix

[Approval Request Comment]
If this is not a sec:{high,crit} bug, please state case for ESR consideration: jsfunfuzz and/or Langfuzz finds this (and other variants) really easily, in a short period of time after being run.
User impact if declined: Open sourcing the js fuzzers might lead to more bug duplicates of this one.
Fix Landed on Version: 12

See https://wiki.mozilla.org/Release_Management/ESR_Landing_Process for more info.

Tom / jorendorff, perhaps you'd like to answer these portions?

Risk to taking this patch (and alternatives if risky): 
String changes made by this patch:

Comment 8

[Lukas Blakk [:lsblakk] use ?needinfo]

(In reply to Gary Kwong [:gkw, :nth10sd] from comment #7)

> consideration: jsfunfuzz and/or Langfuzz finds this (and other variants)
> really easily, in a short period of time after being run.
> User impact if declined: Open sourcing the js fuzzers might lead to more bug
> duplicates of this one.

Can you explain to me what it means when these are found? Does this fix a test? I'm not 100% sure why this is needed on ESR.

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Comment on attachment 588675 [details] [diff] [review]
fix

On further analysis, this doesn't occur frequently enough similar to bug 697279 after being put on suppression.

Comment 10

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug686296.js.