[Webkit-unassigned] [Bug 118664] New: ASSERTION FAILED: m_startOffset >= m_divotLineStart in JSC::ResolveNode::ResolveNode
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Mon Jul 15 02:20:50 PDT 2013
https://bugs.webkit.org/show_bug.cgi?id=118664
Summary: ASSERTION FAILED: m_startOffset >= m_divotLineStart in
JSC::ResolveNode::ResolveNode
Product: WebKit
Version: 528+ (Nightly build)
Platform: Unspecified
OS/Version: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: JavaScriptCore
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: reni at webkit.org
Blocks: 116980
The following test crashes on the assertion above:
function toFuzz() {
for (var conf = new ConfigObject({
}) in str1.localeCompare) {
}
}
toFuzz();
Tested on Linux 13.04 PC, x86_64
The backtrace:
==============
Program received signal SIGSEGV, Segmentation fault.
0x0000000000435185 in WTFCrash () at /home/reni/Data/REPOS/webkitnix/Source/WTF/wtf/Assertions.cpp:339
339 *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt
#0 0x0000000000435185 in WTFCrash () at /home/reni/Data/REPOS/webkitnix/Source/WTF/wtf/Assertions.cpp:339
#1 0x000000000073878b in JSC::ResolveNode::ResolveNode (this=0xeeded0, location=..., ident=..., startOffset=33, divotLine=3, divotLineStart=59)
at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/NodeConstructors.h:112
#2 0x000000000073b4d9 in JSC::ForInNode::ForInNode (this=0xeede88, vm=0xecfb60, location=..., ident=..., in=0xeedd90, expr=0xeede30, statement=0xeede68,
divot=38, startOffset=5, endOffset=27, divotLine=3, divotLineStart=59)
at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/NodeConstructors.h:828
#3 0x000000000073d779 in JSC::ASTBuilder::createForInLoop (this=0x7fffffffba00, location=..., ident=0xeefc10, initializer=0xeedd90, iter=0xeede30,
statements=0xeede68, start=33, divot=66, end=87, initStart=38, initEnd=65, startLine=2, endLine=3, divotLine=3, divotLineStart=59)
at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/ASTBuilder.h:381
#4 0x000000000074cc3f in JSC::Parser<JSC::Lexer<unsigned char> >::parseForStatement<JSC::ASTBuilder> (this=0x7fffffffc000, context=...)
at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:394
#5 0x0000000000749958 in JSC::Parser<JSC::Lexer<unsigned char> >::parseStatement<JSC::ASTBuilder> (this=0x7fffffffc000, context=...,
directive=@0x7fffffffb818: 0x0, directiveLiteralLength=0x7fffffffb800) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:761
#6 0x0000000000753756 in JSC::Parser<JSC::Lexer<unsigned char> >::parseSourceElements<(JSC::SourceElementsMode)1, JSC::ASTBuilder> (this=0x7fffffffc000,
context=...) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:172
#7 0x000000000074b4fd in JSC::Parser<JSC::Lexer<unsigned char> >::parseBlockStatement<JSC::ASTBuilder> (this=0x7fffffffc000, context=...)
at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:724
#8 0x00000000007497f2 in JSC::Parser<JSC::Lexer<unsigned char> >::parseStatement<JSC::ASTBuilder> (this=0x7fffffffc000, context=...,
directive=@0x7fffffffb948: 0x0, directiveLiteralLength=0x7fffffffb930) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:741
#9 0x0000000000747a53 in JSC::Parser<JSC::Lexer<unsigned char> >::parseSourceElements<(JSC::SourceElementsMode)0, JSC::ASTBuilder> (this=0x7fffffffc000,
context=...) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:172
#10 0x0000000000740a91 in JSC::Parser<JSC::Lexer<unsigned char> >::parseInner (this=0x7fffffffc000)
at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:118
#11 0x0000000000624de8 in JSC::Parser<JSC::Lexer<unsigned char> >::parse<JSC::FunctionBodyNode> (this=0x7fffffffc000, error=...)
at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.h:1023
#12 0x000000000062426b in JSC::parse<JSC::FunctionBodyNode> (vm=0xecfb60, source=..., parameters=0xedd1f0, name=..., strictness=JSC::JSParseNormal,
parserMode=JSC::JSParseFunctionCode, error=...) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.h:1091
#13 0x0000000000621fc9 in JSC::generateFunctionCodeBlock (vm=..., scope=0x7ffff7f5f870, executable=0x7fffb437ff90, source=..., kind=JSC::CodeForCall,
debuggerMode=JSC::DebuggerOff, profilerMode=JSC::ProfilerOff, error=...)
at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp:52
#14 0x0000000000622ade in JSC::UnlinkedFunctionExecutable::codeBlockFor (this=0x7fffb437ff90, vm=..., scope=0x7ffff7f5f870, source=...,
specializationKind=JSC::CodeForCall, debuggerMode=JSC::DebuggerOff, profilerMode=JSC::ProfilerOff, error=...)
at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp:161
#15 0x00000000004eda7e in JSC::FunctionExecutable::produceCodeBlockFor (this=0x7fffb43bfd70, scope=0x7ffff7f5f870, specializationKind=JSC::CodeForCall,
exception=@0x7fffffffcb98: 0x0) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/runtime/Executable.cpp:503
#16 0x00000000004eddcd in JSC::FunctionExecutable::compileForCallInternal (this=0x7fffb43bfd70, exec=0x7fffb44020a0, scope=0x7ffff7f5f870,
jitType=JSC::JITCode::BaselineJIT, bytecodeIndex=4294967295) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/runtime/Executable.cpp:533
#17 0x0000000000498b08 in JSC::FunctionExecutable::compileForCall (this=0x7fffb43bfd70, exec=0x7fffb44020a0, scope=0x7ffff7f5f870)
at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/runtime/Executable.h:612
#18 0x00000000004b4ad2 in JSC::FunctionExecutable::compileFor (this=0x7fffb43bfd70, exec=0x7fffb44020a0, scope=0x7ffff7f5f870, kind=JSC::CodeForCall)
at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/runtime/Executable.h:670
#19 0x00000000007abff4 in JSC::LLInt::setUpCall (execCallee=0x7fffb44020a0, pc=0xeed568, kind=JSC::CodeForCall, calleeAsValue=<incomplete type>,
callLinkInfo=0xef0520) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1392
#20 0x00000000007ac391 in JSC::LLInt::genericCall (exec=0x7fffb4402058, pc=0xeed568, kind=JSC::CodeForCall)
at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1434
#21 0x00000000007a9667 in JSC::LLInt::llint_slow_path_call (exec=0x7fffb4402058, pc=0xeed568)
at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1440
#22 0x00000000005d4185 in llint_op_call ()
#23 0x00007fffb4402058 in ?? ()
#24 0x0000000000edf610 in ?? ()
#25 0x00007fffffffce00 in ?? ()
#26 0x000000000049aa77 in JSC::JSStack::installTrapsAfterFrame (this=0x0, frame=0x0)
at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/interpreter/JSStackInlines.h:212
---Type <return> to continue, or q <return> to quit---
#27 0x0000000000497fec in JSC::JITCode::execute (this=0x7fffb43bfe90, stack=0xedf610, callFrame=0x7fffb4402058, vm=0xecfb60)
at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/jit/JITCode.h:135
#28 0x000000000049405c in JSC::Interpreter::execute (this=0xedf600, program=0x7fffb43bfe70, callFrame=0x7ffff7f5f8d8, thisObj=0x7ffff7e6feb0)
at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/interpreter/Interpreter.cpp:948
#29 0x00000000004e9785 in JSC::evaluate (exec=0x7ffff7f5f8d8, source=..., thisValue=<incomplete type>, returnedException=0x7fffffffd970)
at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/runtime/Completion.cpp:83
#30 0x000000000041f710 in runWithScripts (globalObject=0x7ffff7f5f870, scripts=..., dump=false)
at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/jsc.cpp:600
#31 0x00000000004205b6 in jscmain (argc=2, argv=0x7fffffffdc38) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/jsc.cpp:816
#32 0x000000000041f50d in main (argc=2, argv=0x7fffffffdc38) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/jsc.cpp:558
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list