[Webkit-unassigned] [Bug 171311] New: WebKitGtk+ 2.16.0 SEGV on Source/JavaScriptCore/runtime/VMEntryScope.cpp:70 JSC::VMEntryScope::~VMEntryScope()

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Tue Apr 25 19:57:00 PDT 2017


https://bugs.webkit.org/show_bug.cgi?id=171311

            Bug ID: 171311
           Summary: WebKitGtk+ 2.16.0 SEGV on
                    Source/JavaScriptCore/runtime/VMEntryScope.cpp:70
                    JSC::VMEntryScope::~VMEntryScope()
           Product: WebKit
           Version: WebKit Local Build
          Hardware: Unspecified
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: hust.qy at gmail.com

Build with:  Tools/Scripts/build-jsc --gtk --debug 
export CFLAGS="fsanitize=address -fsanitize=address "

The following test case triggers segmentation fault.

Test case:
---
function recompile() {
    var arr = [0, 1, 2, 3, 4];
    arr.__defineSetter__("4", function(x) {
        this._4 = true | x;
    });
    for (var i = 0; i < 5; i++) arr[i] = "grue";
    var tmp = arr._4;
    for (var p in arr) arr[p] = "bleen";
    return tmp + " " + arr._4;
}

function bar() {
    for (var i = 0; i < 50; i++) {
        var foo = new Function("recompile(arguments[0] + " + i + "); return arguments[0]");
        bar(foo.apply(null, [i]), i);
    }
}
bar();
----

Stacktrace with sanitizer

==757==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fd59945c47a bp 0x7ffff95abf30 sp 0x7ffff95abeb0 T0)
    #0 0x7fd59945c479 in JSC::VMEntryScope::~VMEntryScope() /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/VMEntryScope.cpp:70
    #1 0x7fd599092a19 in JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) /home/webkitgtk-2.16.0/Source/JavaScriptCore/interpreter/Interpreter.cpp:905
    #2 0x7fd59926b603 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/CallData.cpp:39
    #3 0x7fd5992c8330 in JSC::callSetter(JSC::ExecState*, JSC::JSValue, JSC::JSValue, JSC::JSValue, JSC::ECMAMode) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/GetterSetter.cpp:108
    #4 0x7fd59940f528 in JSC::SparseArrayEntry::put(JSC::ExecState*, JSC::JSValue, JSC::SparseArrayValueMap*, JSC::JSValue, bool) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp:188
    #5 0x7fd59940fa8c in JSC::SparseArrayValueMap::putEntry(JSC::ExecState*, JSC::JSObject*, unsigned int, JSC::JSValue, bool) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp:126
    #6 0x7fd5993448d8 in JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage(JSC::ExecState*, unsigned int, JSC::JSValue, bool, JSC::ArrayStorage*) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/JSObject.cpp:2635
    #7 0x7fd599348e02 in JSC::JSObject::putByIndexBeyondVectorLength(JSC::ExecState*, unsigned int, JSC::JSValue, bool) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/JSObject.cpp:2672
    #8 0x7fd599348a13 in JSC::JSObject::putByIndex(JSC::JSCell*, JSC::ExecState*, unsigned int, JSC::JSValue, bool) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/JSObject.cpp:930
    #9 0x7fd59934dc2c in JSC::JSObject::putInline(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/JSObjectInlines.h:211
    #10 0x7fd59934dc2c in JSC::JSObject::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/JSObject.cpp:751
    #11 0x7fd5992f40b1 in JSC::JSArray::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/JSArray.cpp:272
    #12 0x7fd598ea13fd in JSC::JSValue::put(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/JSCJSValueInlines.h:872
    #13 0x7fd598ea13fd in operationPutByValInternal<false, false> /home/webkitgtk-2.16.0/Source/JavaScriptCore/dfg/DFGOperations.cpp:145
    #14 0x7fd598ea13fd in operationPutByValNonStrict /home/webkitgtk-2.16.0/Source/JavaScriptCore/dfg/DFGOperations.cpp:624
    #15 0x7fd55180350c  (<unknown module>)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20170426/301b754d/attachment-0001.html>


More information about the webkit-unassigned mailing list