Closed Bug 785776 Opened 8 years ago Closed 8 years ago

"Assertion failure: objArrayType >= 0 && objArrayType < TypedArray::TYPE_MAX,"

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla18
Tracking Flags:
Tracking Status
firefox15 --- unaffected
firefox16 --- fixed
firefox17 --- fixed
firefox18 --- fixed
firefox-esr10 --- unaffected

People

(Reporter: gkw, Assigned: bhackett1024)

References

Details

(4 keywords, Whiteboard: [jsbugmon:update,ignore][advisory-tracking-][qa?])

Attachments

(2 files)

stack
4.78 KB, text/plain
Details
patch
741 bytes, patch
dvander
: review+
akeybl
: approval-mozilla-aurora+
akeybl
: approval-mozilla-beta+
Details | Diff | Splinter Review
Attached file stack — 
function f([x]){}f(DataView.prototype)

asserts js debug shell on m-c changeset e08a67884b9b with -m, -n and -a at Assertion failure: objArrayType >= 0 && objArrayType < TypedArray::TYPE_MAX,
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   97780:195ffaea56ea
user:        Brian Hackett
date:        Wed Jun 27 07:10:50 2012 -0700
summary:     Specialize big typed arrays with singleton types, bug 762561. r=dvander
Brian, bug 762561 might be related according the bisection result in comment 1.
Blocks: 762561
Attached patch patch — — Splinter Review 
DataView objects were being treated like typed arrays when setting bits on the object's type.
Assignee: general → bhackett1024
Attachment #656587 - Flags: review?(dvander)
Attachment #656587 - Flags: review?(dvander) → review+
Group: core-security
Comment on attachment 656587 [details] [diff] [review]
patch

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 762561
User impact if declined: Incorrect type information which is potentially exploitable.
Risk to taking this patch (and alternatives if risky): None
Attachment #656587 - Flags: approval-mozilla-beta?
Attachment #656587 - Flags: approval-mozilla-aurora?
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 1b0b56afa33a).
https://hg.mozilla.org/mozilla-central/rev/b497e2c28be2
Status: NEW → RESOLVED
Closed: 8 years ago
status-firefox18: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla18
Status: RESOLVED → VERIFIED
JSBugMon: This bug has been automatically verified fixed.
Comment on attachment 656587 [details] [diff] [review]
patch

No risk patch for a possibly exploitable issue. Would be good to put a security rating on this bug, if you get the chance. Approving for branches.
Attachment #656587 - Flags: approval-mozilla-beta?
Attachment #656587 - Flags: approval-mozilla-beta+
Attachment #656587 - Flags: approval-mozilla-aurora?
Attachment #656587 - Flags: approval-mozilla-aurora+
Did this ever land?
Thanks mccr8!
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:update,ignore][advisory-tracking-]
Does this need QA verification given comment 8?
Whiteboard: [jsbugmon:update,ignore][advisory-tracking-] → [jsbugmon:update,ignore][advisory-tracking-][qa?]
Group: core-security
Keywords: sec-critical
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.