969159 - Assertion failure: offset < size(), at builtin/TypedObject.h:519

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 1e9f169c9715 (run with --fuzzing-safe):


var AA = TypedObject.uint8.array(0.).array(5);
var aa = new AA();
var aa0 = aa[0];

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Niko Matsakis [:nmatsakis]]

I think the assertion is probably wrong and should be offset <= size

Comment 3

[Niko Matsakis [:nmatsakis]]

Attachment: Bug969159.diff

Comment 4

[Niko Matsakis [:nmatsakis]]

(Note: not security sensitive)

Comment 5

[Shu-yu Guo [:shu]]

Opening per comment 4.

Comment 6

[Shu-yu Guo [:shu]]

Comment on attachment 8372448 [details] [diff] [review]
Bug969159.diff

Review of attachment 8372448 [details] [diff] [review]:
-----------------------------------------------------------------

As discussed on IRC, add the appropriate assert, namely |offset <= datum->size && offset + derived->size <= datum->size| to attach.

r=me for that

::: js/src/builtin/TypedObject.h
@@ +518,5 @@
>      uint8_t *typedMem(size_t offset) const {
> +        // It seems a bit surprising that one might request an offset
> +        // == size(), but it can happen when taking the "address of" a
> +        // user-sized value.
> +        JS_ASSERT(offset <= size());

Maybe clarify a bit that this can only really happen when types with size() == 0.

Comment 7

[Niko Matsakis [:nmatsakis]]

Attachment: Bug969159.diff

More asserts

Comment 8

[Niko Matsakis [:nmatsakis]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8a36e37f46ed

Comment 9

[Phil Ringnalda (:philor)]

Backed out in http://hg.mozilla.org/integration/mozilla-inbound/rev/93f2c8487cf7 for giving Valgrind a bellyache, https://tbpl.mozilla.org/php/getParsedLog.php?id=34386000&tree=Mozilla-Inbound and https://tbpl.mozilla.org/php/getParsedLog.php?id=34387371&tree=Mozilla-Inbound

Comment 10

[Phil Ringnalda (:philor)]

Relanded in https://hg.mozilla.org/integration/mozilla-inbound/rev/155486b9b85c - thanks for discovering bug 970164 for us!

Comment 11

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/155486b9b85c