936013 - Assertion failure: is<T>(), at ../jsobj.h:1156 or Crash [@ getClass] with neuter

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 70de5e24d79b (run with --fuzzing-safe):


function TestCase(n, d, e, a)
TestCase.prototype.dump = function () {};
var ab = new TestCase(12);
neuter(ab);

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 3

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 4

[Christian Holler (:decoder)]

This also crashes in some situations.

Comment 5

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 6

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/0d14c2de356e
user:        Steve Fink
date:        Tue Nov 05 14:42:16 2013 -0800
summary:     Bug 935173 - Fix JS_NeuterArrayBuffer and call it, r=Waldo

This iteration took 1.092 seconds to run.

Comment 7

[Steve Fink [:sfink] [:s:]]

Attachment: Type check JS_NeuterArrayBuffer argument

Just can't get a break from those fuzzers... ;-)

Comment 8

[Jason Orendorff [:jorendorff]]

Comment on attachment 831010 [details] [diff] [review]
Type check JS_NeuterArrayBuffer argument

Review of attachment 831010 [details] [diff] [review]:
-----------------------------------------------------------------

Stealing review.

Comment 9

[Steve Fink [:sfink] [:s:]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b2fd70cd9243

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/b2fd70cd9243

Comment 11

[Ada [:adalucinet]]

I get nothing with Nightly js shell from 2013-11-07 on Ubuntu 13.10 64bit.
With FF 28 beta 2 shell I get: "Error: ArrayBuffer object required"
Any idea on this?

Comment 12

[Jason Orendorff [:jorendorff]]

That error message is the correct behavior.

Comment 13

[Ada [:adalucinet]]

(In reply to Jason Orendorff [:jorendorff] from comment #12)
> That error message is the correct behavior.

Thanks for the reply.
Marking as verified.