Closed
Bug 1811789
Opened 2 years ago
Closed 2 years ago
Assertion failure: MOZ_ASSERT(isString()) at include/js/Value.h:924 with --enable-change-by-array-copy
Categories
(Core :: JavaScript Engine, defect, P3)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
111 Branch
| Tracking | Status | |
|---|---|---|
| firefox111 | --- | fixed |
People
(Reporter: lukas.bernhard, Assigned: tjc)
References
(Blocks 2 open bugs)
Details
Attachments
(1 file)
|
(deleted),
text/x-phabricator-request
|
Details |
Steps to reproduce:
The following sample crashes the js shell in JS::Value::toString when invoked as: ./js --fuzzing-safe --enable-change-array-by-copy crash.js
Not setting s-s because this feature is disabled by default.
function f5() { }
function f0() {
const v15 = new Uint8Array();
f5 &&= v15;
const v17 = new Uint8Array();
const v16 = wrapWithProto(v17, f5);
v16.with();
}
f0();
|
Reporter | |
Updated•2 years ago
|
|
||
Comment 1•2 years ago
|
||
In this call, "TypedArrayWith" needs to be the last parameter, cf. CallSelfHostedNonGenericMethod.
|
||
Updated•2 years ago
|
|
Assignee | |
Comment 2•2 years ago
|
||
The order of arguments when calling CallTypedArrayMethodIfWrapped() in
the self-hosted TypedArrayWith() function was wrong.
|
||
Updated•2 years ago
|
Assignee: nobody → tjc
Attachment #9313902 -
Attachment description: WIP: Bug 1811789 - Fix order of arguments in TypedArrayWith() → WIP: Bug 1811789 - Fix order of arguments in TypedArrayWith() r?mgaudet
Status: NEW → ASSIGNED
|
|
||
Updated•2 years ago
|
Attachment #9313902 -
Attachment description: WIP: Bug 1811789 - Fix order of arguments in TypedArrayWith() r?mgaudet → Bug 1811789 - Fix order of arguments in TypedArrayWith() r?mgaudet
Pushed by mgaudet@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/e8e7053a70ea
Fix order of arguments in TypedArrayWith() r=mgaudet
|
||
Comment 4•2 years ago
|
||
| bugherder | ||
Status: ASSIGNED → RESOLVED
Closed: 2 years ago
status-firefox111:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 111 Branch
You need to log in
before you can comment on or make changes to this bug.
Description
•