977647 - Assertion failure: offset + type->size() <= typedObj->size(), at builtin/TypedObject.cpp:1462

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision a98a1d78817f (threadsafe build, run with --fuzzing-safe --thread-count=2):


var { ArrayType, StructType, uint32 } = TypedObject;
var Point = new StructType({x: uint32, y: uint32});
var Points = Point.array();
var points = new Points();
function f() {
   points.mapPar(function() {});
}
while(true) { try { f(); } catch(exc1) {} }

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140224144106" and the hash "889a90d8aa11".
The "bad" changeset has the timestamp "20140224150007" and the hash "108209641936".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=889a90d8aa11&tochange=108209641936

Comment 3

[Niko Matsakis [:nmatsakis]]

Attachment: Bug977647.diff

Comment 4

[Shu-yu Guo [:shu]]

Comment on attachment 8383730 [details] [diff] [review]
Bug977647.diff

Review of attachment 8383730 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/builtin/TypedObject.js
@@ +1437,5 @@
>    const mode = undefined;
>  
>    const outArray = new outArrayType(length);
> +  if (length == 0)
> +    return outArray; // that was easy.

Nits: === and maybe no cutesy comment? I don't care too much about the cutesy comment though.

::: js/src/jit-test/tests/parallel/bug977647.js
@@ +1,2 @@
> +// Check for mapPar() applied to an empty array.
> +// Public domain.

Wait, why PD?

Comment 5

[Niko Matsakis [:nmatsakis]]

(In reply to Shu-yu Guo [:shu] from comment #4)
> Nits: === and maybe no cutesy comment? I don't care too much about the
> cutesy comment though.

I forgot I left that in there. I'll change to === -- should be equivalent, we know that length is an int at that point, I think. Or maybe not. Whatever.

> ::: js/src/jit-test/tests/parallel/bug977647.js
> @@ +1,2 @@
> > +// Check for mapPar() applied to an empty array.
> > +// Public domain.
> 
> Wait, why PD?

Till always tells me to make all tests public domain.

Comment 6

[Niko Matsakis [:nmatsakis]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2cab8c44a9b9

Comment 7

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/2cab8c44a9b9

Comment 8

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.