866611 - Assertion failure: length <= MAX_LENGTH, at vm/String.h

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, critical)

Description

[Gary Kwong [:gkw] [:nth10sd]]

try {
    y = 'x'
    Object.defineProperty(this, "z", {
        get: function() {
            y += y
            return z
        }
    })
    Uint8Array(z)
} catch (e) {}
for (v of y) {}

asserts js debug shell on m-c changeset 05533d50f2f7 with --ion-eager at Assertion failure: length <= MAX_LENGTH, at vm/String.h

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

Good catch. Regression from bug 863018. temp2 holds the length of the LHS, temp2 holds the result length and is the one we want to test against JSString::MAX_LENGTH.

Comment 2

[Hannes Verschore [:h4writer]]

Comment on attachment 742966 [details] [diff] [review]
Patch

Review of attachment 742966 [details] [diff] [review]:
-----------------------------------------------------------------

Indeed an easy one to overlook.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   130142:3b7a2cbccaaa
user:        Jan de Mooij
date:        Fri Apr 26 14:08:54 2013 +0200
summary:     Bug 863018 part 2 - Add JSShortString path back to ConcatStrings and LConcat. r=luke

This iteration took 149.557 seconds to run.

Comment 4

[Christian Holler (:decoder)]

I'm pretty sure this is s-s and at least sec-high. I'm seeing this trace in my fuzzer with the same assertion:

Program terminated with signal 11, Segmentation fault.
#0  0x0000000000672298 in JSString::buildLengthAndFlags (
    flags=<optimized out>, length=<optimized out>, this=<optimized out>)
    at ../vm/String.h:231
231	        JS_ASSERT(length <= MAX_LENGTH);
#0  0x0000000000672298 in JSString::buildLengthAndFlags (flags=<optimized out>, length=<optimized out>, this=<optimized out>) at ../vm/String.h:231
#1  0x0000000000674380 in buildLengthAndFlags (flags=<optimized out>, length=<optimized out>, this=<optimized out>) at ../vm/String.h:231
#2  JSRope::flattenInternal<(JSRope::UsingBarrier)1> (this=<error reading variable: Cannot access memory at address 0x64006300620061>, maybecx=<optimized out>) at js/src/vm/String.cpp:276


Notice the memory address in frame #2 consisting of a string (in 16 bit unicode).

Comment 6

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/cf9469c2c3c6

Comment 7

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/cf9469c2c3c6

Comment 8

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 9

[Anthony Hughes (:ashughes) [QA]]

Marking status-firefox23:verified based on comment 8.