Closed Bug 769433 Opened 12 years ago Closed 12 years ago

Assertion failure: objArrayType >= 0 && objArrayType < TypedArray::TYPE_MAX, at jsinfer.cpp:1756 or Opt-Crash [@ js::mjit::Assembler::storeToTypedArray]

Categories

(Core :: JavaScript Engine, defect)

x86_64
All
defect
Not set
critical

Tracking

()

RESOLVED FIXED
Tracking Status
firefox13 --- unaffected
firefox14 --- unaffected
firefox15 --- unaffected
firefox16 - affected
firefox-esr10 --- unaffected

People

(Reporter: decoder, Unassigned)

References

Details

(5 keywords, Whiteboard: js-triage-needed [jsbugmon:update])

Crash Data

Attachments

(1 file)

The following test asserts/crashes on mozilla-central revision 9bf5e71c5746 (options -m -n -a):


function stringConvert() {
  var a = Uint32Array.prototype;
  for (var i = 0; i < 10; i++) {
    a[0] = 1 >> s1;
  }
}
stringConvert();


Valgrind trace from opt-build:

==47271== Invalid read of size 4
==47271==    at 0x5E2A59: js::mjit::Assembler::storeToTypedArray(int, JSC::X86Registers::RegisterID, js::mjit::Int32Key, js::mjit::ValueRemat) (jstypedarrayinlines.h:119)
==47271==    by 0x5E71BB: js::mjit::Compiler::jsop_setelem_typed(int) (FastOps.cpp:1474)
==47271==    by 0x5E9EDF: js::mjit::Compiler::jsop_setelem(bool) (FastOps.cpp:1556)
==47271==    by 0x5B8E04: js::mjit::Compiler::generateMethod() (Compiler.cpp:2607)
==47271==    by 0x5BF130: js::mjit::Compiler::performCompilation() (Compiler.cpp:517)
==47271==    by 0x5BF1EA: js::mjit::Compiler::compile() (Compiler.cpp:112)
==47271==    by 0x5C0B34: js::mjit::CanMethodJIT(JSContext*, JSScript*, unsigned char*, bool, js::mjit::CompileRequest) (Compiler.cpp:978)
==47271==    by 0x47DC35: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsinterp.cpp:1489)
==47271==    by 0x58FF93: js::mjit::EnterMethodJIT(JSContext*, js::StackFrame*, void*, JS::Value*, bool) (MethodJIT.cpp:1043)
==47271==    by 0x5900E2: js::mjit::JaegerShot(JSContext*, bool) (MethodJIT.cpp:1074)
==47271==    by 0x47F5E9: js::RunScript(JSContext*, JSScript*, js::StackFrame*) (jsinterp.cpp:264)
==47271==    by 0x4801E1: js::Execute(JSContext*, JSScript*, JSObject&, JS::Value*) (jsinterp.cpp:455)
==47271==  Address 0x37e112078 is not stack'd, malloc'd or (recently) free'd


Looks like a critical corruption, s-s.
x = new Uint8ClampedArray;
y = x.__proto__;
(function() {
  for (var z = 0; z < 9; ++z) {
    y[0];
  }
})()

is another testcase that has a similar assertion on m-c changeset rev 081d8578beb1.
OS: Linux → All
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   97780:195ffaea56ea
user:        Brian Hackett
date:        Wed Jun 27 07:10:50 2012 -0700
summary:     Specialize big typed arrays with singleton types, bug 762561. r=dvander
Attached patch patchSplinter Review
JSObject::makeLazyType needs to look for typed array prototypes, which have a typed array proto key but are regular native objects.
Attachment #637961 - Flags: review?(dvander)
Attachment #637961 - Flags: review?(dvander) → review+
https://hg.mozilla.org/mozilla-central/rev/b1f1aeec7132
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Group: core-security
Keywords: sec-critical
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug769433.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: