[Webkit-unassigned] [Bug 159446] New: RELEASE_ASSERT(!thisObject) in ObjCCallbackFunctionImpl::call when calling JSExport ObjC Constructor without operator new

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=159446

            Bug ID: 159446
           Summary: RELEASE_ASSERT(!thisObject) in
                    ObjCCallbackFunctionImpl::call when calling JSExport
                    ObjC Constructor without operator new
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: joepeck at webkit.org
                CC: ggaren at apple.com, mark.lam at apple.com

Summary:
RELEASE_ASSERT(!thisObject) in ObjCCallbackFunctionImpl::call when calling JSExport ObjC Constructor without operator new

Test:
/*
 * shell> xcrun clang -framework Foundation -framework JavaScriptCore construct.m
 */

#import <Foundation/Foundation.h>
#import <JavaScriptCore/JavaScriptCore.h>

@protocol JSFooExports <JSExport>
- (instancetype)initWithName:(NSString *)name;
@end

@interface JSFoo : NSObject <JSFooExports>
- (instancetype)initWithName:(NSString *)name;
@end

@implementation JSFoo
- (instancetype)initWithName:(NSString *)name {
    self = [super init];
    if (!self) return nil;
    NSLog(@">>> initWithName: %@", name);
    return self;
}
@end

int main()
{
    JSContext *ctx = [[JSContext alloc] init];
    ctx[@"JSFoo"] = [JSFoo class];
    [ctx evaluateScript:@"JSFoo()"];
    return 0;
}

Steps to Reproduce:
1. Compile + Run test
  => RELEASE_ASSERT crash immediately

Crash:
Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BREAKPOINT (SIGTRAP)
Exception Codes:       0x0000000000000002, 0x0000000000000000

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore          0x000000010bdf0e6e JSC::ObjCCallbackFunctionImpl::call(JSContext*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**) + 654 (ObjCCallbackFunction.mm:557)
1   com.apple.JavaScriptCore          0x000000010bdf0926 JSC::objCCallbackFunctionCallAsFunction(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**) + 262 (ObjCCallbackFunction.mm:462)
2   com.apple.JavaScriptCore          0x000000010bdf1b7d long long JSC::APICallbackFunction::call<JSC::ObjCCallbackFunction>(JSC::ExecState*) + 573 (APICallbackFunction.h:61)
3   com.apple.JavaScriptCore          0x000000010bdb15b3 JSC::LLInt::setUpCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*) + 595 (LLIntSlowPaths.cpp:1203)
4   com.apple.JavaScriptCore          0x000000010bdb87ce llint_entry + 24803
5   com.apple.JavaScriptCore          0x000000010bdb2508 vmEntryToJavaScript + 299
6   com.apple.JavaScriptCore          0x000000010bc0c2ee JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 158 (JITCode.cpp:81)
7   com.apple.JavaScriptCore          0x000000010bb65cb5 JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) + 17125 (Interpreter.cpp:961)
8   com.apple.JavaScriptCore          0x000000010b7d0ea5 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 469 (Completion.cpp:107)
9   com.apple.JavaScriptCore          0x000000010bc61d98 JSEvaluateScript + 456 (NakedPtr.h:54)
10  com.apple.JavaScriptCore          0x000000010bc73639 -[JSContext evaluateScript:withSourceURL:] + 105 (JSContext.mm:102)
11  a.out                             0x000000010b56ee9b main + 171
12  libdyld.dylib                     0x00007fff918095ad start + 1
...

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160706/980b9b2d/attachment-0001.html>