Assertion failure: is<T>(), at ../jsobj.h:1156 or Crash [@ getClass] with neuter

VERIFIED FIXED in mozilla28

Status

()

defect
--
critical
VERIFIED FIXED
6 years ago
5 years ago

People

(Reporter: decoder, Assigned: sfink)

Tracking

(Blocks 1 bug, {assertion, crash, testcase})

Trunk
mozilla28
x86_64
Linux
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update], crash signature)

Attachments

(2 attachments, 3 obsolete attachments)

Reporter

Description

6 years ago
The following testcase asserts on mozilla-central revision 70de5e24d79b (run with --fuzzing-safe):


function TestCase(n, d, e, a)
TestCase.prototype.dump = function () {};
var ab = new TestCase(12);
neuter(ab);
Reporter

Comment 2

6 years ago
Attachment #828673 - Attachment is obsolete: true
Reporter

Comment 3

6 years ago
Attachment #829847 - Attachment is obsolete: true
Reporter

Comment 4

6 years ago
This also crashes in some situations.
Crash Signature: [@ getClass]
Keywords: crash
Summary: Assertion failure: is<T>(), at ../jsobj.h:1156 with neuter → Assertion failure: is<T>(), at ../jsobj.h:1156 or Crash [@ getClass] with neuter
Whiteboard: [jsbugmon:update,bisect]
Reporter

Updated

6 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
Reporter

Comment 6

6 years ago
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/0d14c2de356e
user:        Steve Fink
date:        Tue Nov 05 14:42:16 2013 -0800
summary:     Bug 935173 - Fix JS_NeuterArrayBuffer and call it, r=Waldo

This iteration took 1.092 seconds to run.
Assignee

Comment 7

6 years ago
Just can't get a break from those fuzzers... ;-)
Attachment #831010 - Flags: review?(jwalden+bmo)
Assignee

Updated

6 years ago
Assignee: general → sphink
Status: NEW → ASSIGNED
Assignee

Updated

6 years ago
Blocks: 935173
Comment on attachment 831010 [details] [diff] [review]
Type check JS_NeuterArrayBuffer argument

Review of attachment 831010 [details] [diff] [review]:
-----------------------------------------------------------------

Stealing review.
Attachment #831010 - Flags: review?(jwalden+bmo) → review+
https://hg.mozilla.org/mozilla-central/rev/b2fd70cd9243
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28

Updated

5 years ago
Keywords: verifyme
I get nothing with Nightly js shell from 2013-11-07 on Ubuntu 13.10 64bit.
With FF 28 beta 2 shell I get: "Error: ArrayBuffer object required"
Any idea on this?
Flags: needinfo?(sphink)
That error message is the correct behavior.
Flags: needinfo?(sphink)
(In reply to Jason Orendorff [:jorendorff] from comment #12)
> That error message is the correct behavior.

Thanks for the reply.
Marking as verified.
Status: RESOLVED → VERIFIED
Keywords: verifyme
You need to log in before you can comment on or make changes to this bug.