[Webkit-unassigned] [Bug 118662] New: ASSERTION FAILED: divot >= divotLineStart in JSC::ASTBuilder::setExceptionLocation

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Mon Jul 15 02:04:37 PDT 2013


https://bugs.webkit.org/show_bug.cgi?id=118662

           Summary: ASSERTION FAILED: divot >= divotLineStart in
                    JSC::ASTBuilder::setExceptionLocation
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: reni at webkit.org
            Blocks: 116980


The following test crashes on the assertion above: 

function toFuzz() {
    if (PriorityQueue.prototype.doSort() instanceof (this ^= function() {
    })) return 2; 
}

toFuzz();


Tested on: Linux 13.04, PC, x86_64.

Backtrace:
==========

Program received signal SIGSEGV, Segmentation fault.
0x0000000000435185 in WTFCrash () at /home/reni/Data/REPOS/webkitnix/Source/WTF/wtf/Assertions.cpp:339
339        *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt
#0  0x0000000000435185 in WTFCrash () at /home/reni/Data/REPOS/webkitnix/Source/WTF/wtf/Assertions.cpp:339
#1  0x000000000073ec02 in JSC::ASTBuilder::setExceptionLocation (node=0xeed7b0, start=28, divot=72, end=100, divotLine=3, divotLineStart=94)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/ASTBuilder.h:656
#2  0x00000000007353a4 in JSC::ASTBuilder::makeBinaryNode (this=0x7fffffffba00, location=..., token=30605, lhs=<incomplete type>, rhs=<incomplete type>)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/ASTBuilder.h:902
#3  0x000000000073e6a4 in JSC::ASTBuilder::appendBinaryOperation (this=0x7fffffffba00, location=..., operandStackDepth=@0x7fffffffb400: 1, lhs=..., rhs=...)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/ASTBuilder.h:575
#4  0x000000000075a6bf in JSC::Parser<JSC::Lexer<unsigned char> >::parseBinaryExpression<JSC::ASTBuilder> (this=0x7fffffffc000, context=...)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:1286
#5  0x000000000075934b in JSC::Parser<JSC::Lexer<unsigned char> >::parseConditionalExpression<JSC::ASTBuilder> (this=0x7fffffffc000, context=...)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:1218
#6  0x0000000000757101 in JSC::Parser<JSC::Lexer<unsigned char> >::parseAssignmentExpression<JSC::ASTBuilder> (this=0x7fffffffc000, context=...)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:1157
#7  0x00000000007547f4 in JSC::Parser<JSC::Lexer<unsigned char> >::parseExpression<JSC::ASTBuilder> (this=0x7fffffffc000, context=...)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:1128
#8  0x000000000074bb42 in JSC::Parser<JSC::Lexer<unsigned char> >::parseIfStatement<JSC::ASTBuilder> (this=0x7fffffffc000, context=...)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:1048
#9  0x0000000000749907 in JSC::Parser<JSC::Lexer<unsigned char> >::parseStatement<JSC::ASTBuilder> (this=0x7fffffffc000, context=..., 
    directive=@0x7fffffffb818: 0x0, directiveLiteralLength=0x7fffffffb800) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:755
#10 0x0000000000753756 in JSC::Parser<JSC::Lexer<unsigned char> >::parseSourceElements<(JSC::SourceElementsMode)1, JSC::ASTBuilder> (this=0x7fffffffc000, 
    context=...) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:172
#11 0x000000000074b4fd in JSC::Parser<JSC::Lexer<unsigned char> >::parseBlockStatement<JSC::ASTBuilder> (this=0x7fffffffc000, context=...)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:724
#12 0x00000000007497f2 in JSC::Parser<JSC::Lexer<unsigned char> >::parseStatement<JSC::ASTBuilder> (this=0x7fffffffc000, context=..., 
    directive=@0x7fffffffb948: 0x0, directiveLiteralLength=0x7fffffffb930) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:741
#13 0x0000000000747a53 in JSC::Parser<JSC::Lexer<unsigned char> >::parseSourceElements<(JSC::SourceElementsMode)0, JSC::ASTBuilder> (this=0x7fffffffc000, 
    context=...) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:172
#14 0x0000000000740a91 in JSC::Parser<JSC::Lexer<unsigned char> >::parseInner (this=0x7fffffffc000)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:118
#15 0x0000000000624de8 in JSC::Parser<JSC::Lexer<unsigned char> >::parse<JSC::FunctionBodyNode> (this=0x7fffffffc000, error=...)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.h:1023
#16 0x000000000062426b in JSC::parse<JSC::FunctionBodyNode> (vm=0xecfb60, source=..., parameters=0xedd1f0, name=..., strictness=JSC::JSParseNormal, 
    parserMode=JSC::JSParseFunctionCode, error=...) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.h:1091
#17 0x0000000000621fc9 in JSC::generateFunctionCodeBlock (vm=..., scope=0x7ffff7f5f870, executable=0x7fffb437ff90, source=..., kind=JSC::CodeForCall, 
    debuggerMode=JSC::DebuggerOff, profilerMode=JSC::ProfilerOff, error=...)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp:52
#18 0x0000000000622ade in JSC::UnlinkedFunctionExecutable::codeBlockFor (this=0x7fffb437ff90, vm=..., scope=0x7ffff7f5f870, source=..., 
    specializationKind=JSC::CodeForCall, debuggerMode=JSC::DebuggerOff, profilerMode=JSC::ProfilerOff, error=...)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp:161
#19 0x00000000004eda7e in JSC::FunctionExecutable::produceCodeBlockFor (this=0x7fffb43bfd70, scope=0x7ffff7f5f870, specializationKind=JSC::CodeForCall, 
    exception=@0x7fffffffcb98: 0x0) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/runtime/Executable.cpp:503
#20 0x00000000004eddcd in JSC::FunctionExecutable::compileForCallInternal (this=0x7fffb43bfd70, exec=0x7fffb44020a0, scope=0x7ffff7f5f870, 
    jitType=JSC::JITCode::BaselineJIT, bytecodeIndex=4294967295) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/runtime/Executable.cpp:533
#21 0x0000000000498b08 in JSC::FunctionExecutable::compileForCall (this=0x7fffb43bfd70, exec=0x7fffb44020a0, scope=0x7ffff7f5f870)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/runtime/Executable.h:612
#22 0x00000000004b4ad2 in JSC::FunctionExecutable::compileFor (this=0x7fffb43bfd70, exec=0x7fffb44020a0, scope=0x7ffff7f5f870, kind=JSC::CodeForCall)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/runtime/Executable.h:670
#23 0x00000000007abff4 in JSC::LLInt::setUpCall (execCallee=0x7fffb44020a0, pc=0xeed4b8, kind=JSC::CodeForCall, calleeAsValue=<incomplete type>, 
    callLinkInfo=0xef04d0) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1392
#24 0x00000000007ac391 in JSC::LLInt::genericCall (exec=0x7fffb4402058, pc=0xeed4b8, kind=JSC::CodeForCall)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1434
#25 0x00000000007a9667 in JSC::LLInt::llint_slow_path_call (exec=0x7fffb4402058, pc=0xeed4b8)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1440
---Type <return> to continue, or q <return> to quit---
#26 0x00000000005d4185 in llint_op_call ()
#27 0x00007fffb4402058 in ?? ()
#28 0x0000000000edf610 in ?? ()
#29 0x00007fffffffce00 in ?? ()
#30 0x000000000049aa77 in JSC::JSStack::installTrapsAfterFrame (this=0x0, frame=0x0)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/interpreter/JSStackInlines.h:212
#31 0x0000000000497fec in JSC::JITCode::execute (this=0x7fffb43bfe90, stack=0xedf610, callFrame=0x7fffb4402058, vm=0xecfb60)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/jit/JITCode.h:135
#32 0x000000000049405c in JSC::Interpreter::execute (this=0xedf600, program=0x7fffb43bfe70, callFrame=0x7ffff7f5f8d8, thisObj=0x7ffff7e6feb0)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/interpreter/Interpreter.cpp:948
#33 0x00000000004e9785 in JSC::evaluate (exec=0x7ffff7f5f8d8, source=..., thisValue=<incomplete type>, returnedException=0x7fffffffd970)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/runtime/Completion.cpp:83
#34 0x000000000041f710 in runWithScripts (globalObject=0x7ffff7f5f870, scripts=..., dump=false)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/jsc.cpp:600
#35 0x00000000004205b6 in jscmain (argc=2, argv=0x7fffffffdc38) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/jsc.cpp:816
#36 0x000000000041f50d in main (argc=2, argv=0x7fffffffdc38) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/jsc.cpp:558

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.



More information about the webkit-unassigned mailing list