[Webkit-unassigned] [Bug 141187] New: Crash in JSC::createTypeError
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Mon Feb 2 19:57:27 PST 2015
https://bugs.webkit.org/show_bug.cgi?id=141187
Bug ID: 141187
Summary: Crash in JSC::createTypeError
Classification: Unclassified
Product: WebKit
Version: 528+ (Nightly build)
Hardware: Unspecified
OS: Unspecified
Status: NEW
Severity: Critical
Priority: P2
Component: JavaScriptCore
Assignee: webkit-unassigned at lists.webkit.org
Reporter: cwhan.tunz at gmail.com
this code crashes.
----
new
function f() {
for (f in [1])({})();
}
----
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7ae324f in JSC::createTypeError(JSC::JSGlobalObject*, WTF::String const&) ()
from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
(gdb) bt
#0 0x00007ffff7ae324f in JSC::createTypeError(JSC::JSGlobalObject*, WTF::String const&) ()
from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#1 0x00007ffff7aea152 in JSC::createError(JSC::ExecState*, JSC::JSObject* (*)(JSC::ExecState*, WTF::String const&), JSC::JSValue, WTF::String const&) ()
from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#2 0x00007ffff7aeaa27 in JSC::createNotAFunctionError(JSC::ExecState*, JSC::JSValue) ()
from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#3 0x00007ffff7bf7f8d in JSC::LLInt::handleHostCall(JSC::ExecState*, JSC::Instruction*, JSC::JSValue, JSC::CodeSpecializationKind) [clone .isra.113] ()
from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#4 0x00007ffff7bff460 in llint_slow_path_call ()
from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#5 0x00007ffff7c09fdd in llint_entry ()
from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#6 0x00007ffff7c0a0e8 in llint_entry ()
from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#7 0x00007ffff7c046c9 in vmEntryToJavaScript ()
from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#8 0x00007ffff7998854 in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) ()
from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#9 0x00007ffff797b47d in JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) ()
from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#10 0x00007ffff7ad062a in JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) ()
from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#11 0x000000000040c489 in jscmain(int, char**) ()
#12 0x0000000000406da8 in main ()
ASSERTION FAILED: cell->isObject()
/development/tunz/javascript/webkit/Source/JavaScriptCore/runtime/JSObject.h(1190) : JSC::JSObject* JSC::asObject(JSC::JSCell*)
1 0x7fe551c86394 /development/tunz/javascript/webkit/WebKitDebug/Debug/lib/libjavascriptcoregtk-4.0.so.18(WTFCrash+0x1e) [0x7fe551c86394]
2 0x42f983 ../jsc_d(_ZN3JSC8asObjectEPNS_6JSCellE+0x3d) [0x42f983]
3 0x42f9b1 ../jsc_d(_ZN3JSC8asObjectENS_7JSValueE+0x20) [0x42f9b1]
4 0x43014f ../jsc_d(_ZNK3JSC8Register8functionEv+0x4d) [0x43014f]
5 0x42c700 ../jsc_d(_ZNK3JSC9ExecState6calleeEv+0x1c) [0x42c700]
6 0x4311f6 ../jsc_d(_ZNK3JSC9ExecState2vmEv+0x18) [0x4311f6]
7 0x7fe551ad9dae /development/tunz/javascript/webkit/WebKitDebug/Debug/lib/libjavascriptcoregtk-4.0.so.18(+0x1262dae) [0x7fe551ad9dae]
8 0x7fe551c37c49 /development/tunz/javascript/webkit/WebKitDebug/Debug/lib/libjavascriptcoregtk-4.0.so.18(+0x13c0c49) [0x7fe551c37c49]
Segmentation fault
Also,
----
new
function f() {
for (f in [1]);
print(f);
}
----
Output of above code should be
----
function f() {
for (f in [1]);
print(f);
}
----
But, in JSC, output is 0.
found with afl-fuzz.
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150203/3dfe86a5/attachment-0002.html>
More information about the webkit-unassigned
mailing list