"Assertion failure: objArrayType >= 0 && objArrayType < TypedArray::TYPE_MAX,"

VERIFIED FIXED in Firefox 16

Status

()

defect
--
critical
VERIFIED FIXED
7 years ago
6 years ago

People

(Reporter: gkw, Assigned: bhackett)

Tracking

(Blocks 1 bug, 4 keywords)

Trunk
mozilla18
x86_64
macOS
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox15 unaffected, firefox16 fixed, firefox17 fixed, firefox18 fixed, firefox-esr10 unaffected)

Details

(Whiteboard: [jsbugmon:update,ignore][advisory-tracking-][qa?])

Attachments

(2 attachments)

Reporter

Description

7 years ago
Posted file stack
function f([x]){}f(DataView.prototype)

asserts js debug shell on m-c changeset e08a67884b9b with -m, -n and -a at Assertion failure: objArrayType >= 0 && objArrayType < TypedArray::TYPE_MAX,
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   97780:195ffaea56ea
user:        Brian Hackett
date:        Wed Jun 27 07:10:50 2012 -0700
summary:     Specialize big typed arrays with singleton types, bug 762561. r=dvander
Reporter

Comment 2

7 years ago
Brian, bug 762561 might be related according the bisection result in comment 1.
Blocks: 762561
Assignee

Comment 3

7 years ago
Posted patch patchSplinter Review
DataView objects were being treated like typed arrays when setting bits on the object's type.
Assignee: general → bhackett1024
Attachment #656587 - Flags: review?(dvander)
Attachment #656587 - Flags: review?(dvander) → review+
Assignee

Updated

7 years ago
Group: core-security
Assignee

Comment 5

7 years ago
Comment on attachment 656587 [details] [diff] [review]
patch

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 762561
User impact if declined: Incorrect type information which is potentially exploitable.
Risk to taking this patch (and alternatives if risky): None
Attachment #656587 - Flags: approval-mozilla-beta?
Attachment #656587 - Flags: approval-mozilla-aurora?
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 1b0b56afa33a).
https://hg.mozilla.org/mozilla-central/rev/b497e2c28be2
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla18
Status: RESOLVED → VERIFIED
JSBugMon: This bug has been automatically verified fixed.
Comment on attachment 656587 [details] [diff] [review]
patch

No risk patch for a possibly exploitable issue. Would be good to put a security rating on this bug, if you get the chance. Approving for branches.
Attachment #656587 - Flags: approval-mozilla-beta?
Attachment #656587 - Flags: approval-mozilla-beta+
Attachment #656587 - Flags: approval-mozilla-aurora?
Attachment #656587 - Flags: approval-mozilla-aurora+
Did this ever land?
Thanks mccr8!
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:update,ignore][advisory-tracking-]
Does this need QA verification given comment 8?
Whiteboard: [jsbugmon:update,ignore][advisory-tracking-] → [jsbugmon:update,ignore][advisory-tracking-][qa?]
Group: core-security
Keywords: sec-critical
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.