Closed Bug 969159 Opened 6 years ago Closed 6 years ago

Assertion failure: offset < size(), at builtin/TypedObject.h:519

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla30

People

(Reporter: decoder, Assigned: nmatsakis)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update])

Attachments

(2 files, 1 obsolete file)

The following testcase asserts on mozilla-central revision 1e9f169c9715 (run with --fuzzing-safe):


var AA = TypedObject.uint8.array(0.).array(5);
var aa = new AA();
var aa0 = aa[0];
Whiteboard: [jsbugmon:update,bisect]
I think the assertion is probably wrong and should be offset <= size
Attached patch Bug969159.diff (obsolete) — Splinter Review
Attachment #8372448 - Flags: review?(shu)
(Note: not security sensitive)
Opening per comment 4.
Group: core-security
Comment on attachment 8372448 [details] [diff] [review]
Bug969159.diff

Review of attachment 8372448 [details] [diff] [review]:
-----------------------------------------------------------------

As discussed on IRC, add the appropriate assert, namely |offset <= datum->size && offset + derived->size <= datum->size| to attach.

r=me for that

::: js/src/builtin/TypedObject.h
@@ +518,5 @@
>      uint8_t *typedMem(size_t offset) const {
> +        // It seems a bit surprising that one might request an offset
> +        // == size(), but it can happen when taking the "address of" a
> +        // user-sized value.
> +        JS_ASSERT(offset <= size());

Maybe clarify a bit that this can only really happen when types with size() == 0.
Attachment #8372448 - Flags: review?(shu) → review+
Attached patch Bug969159.diffSplinter Review
More asserts
Attachment #8372448 - Attachment is obsolete: true
Attachment #8372707 - Flags: review+
Relanded in https://hg.mozilla.org/integration/mozilla-inbound/rev/155486b9b85c - thanks for discovering bug 970164 for us!
Assignee: nobody → nmatsakis
https://hg.mozilla.org/mozilla-central/rev/155486b9b85c
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
QA Whiteboard: [qa-]
You need to log in before you can comment on or make changes to this bug.