[Webkit-unassigned] [Bug 171311] New: WebKitGtk+ 2.16.0 SEGV on Source/JavaScriptCore/runtime/VMEntryScope.cpp:70 JSC::VMEntryScope::~VMEntryScope()
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Tue Apr 25 19:57:00 PDT 2017
https://bugs.webkit.org/show_bug.cgi?id=171311
Bug ID: 171311
Summary: WebKitGtk+ 2.16.0 SEGV on
Source/JavaScriptCore/runtime/VMEntryScope.cpp:70
JSC::VMEntryScope::~VMEntryScope()
Product: WebKit
Version: WebKit Local Build
Hardware: Unspecified
OS: Linux
Status: NEW
Severity: Normal
Priority: P2
Component: JavaScriptCore
Assignee: webkit-unassigned at lists.webkit.org
Reporter: hust.qy at gmail.com
Build with: Tools/Scripts/build-jsc --gtk --debug
export CFLAGS="fsanitize=address -fsanitize=address "
The following test case triggers segmentation fault.
Test case:
---
function recompile() {
var arr = [0, 1, 2, 3, 4];
arr.__defineSetter__("4", function(x) {
this._4 = true | x;
});
for (var i = 0; i < 5; i++) arr[i] = "grue";
var tmp = arr._4;
for (var p in arr) arr[p] = "bleen";
return tmp + " " + arr._4;
}
function bar() {
for (var i = 0; i < 50; i++) {
var foo = new Function("recompile(arguments[0] + " + i + "); return arguments[0]");
bar(foo.apply(null, [i]), i);
}
}
bar();
----
Stacktrace with sanitizer
==757==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fd59945c47a bp 0x7ffff95abf30 sp 0x7ffff95abeb0 T0)
#0 0x7fd59945c479 in JSC::VMEntryScope::~VMEntryScope() /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/VMEntryScope.cpp:70
#1 0x7fd599092a19 in JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) /home/webkitgtk-2.16.0/Source/JavaScriptCore/interpreter/Interpreter.cpp:905
#2 0x7fd59926b603 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/CallData.cpp:39
#3 0x7fd5992c8330 in JSC::callSetter(JSC::ExecState*, JSC::JSValue, JSC::JSValue, JSC::JSValue, JSC::ECMAMode) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/GetterSetter.cpp:108
#4 0x7fd59940f528 in JSC::SparseArrayEntry::put(JSC::ExecState*, JSC::JSValue, JSC::SparseArrayValueMap*, JSC::JSValue, bool) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp:188
#5 0x7fd59940fa8c in JSC::SparseArrayValueMap::putEntry(JSC::ExecState*, JSC::JSObject*, unsigned int, JSC::JSValue, bool) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp:126
#6 0x7fd5993448d8 in JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage(JSC::ExecState*, unsigned int, JSC::JSValue, bool, JSC::ArrayStorage*) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/JSObject.cpp:2635
#7 0x7fd599348e02 in JSC::JSObject::putByIndexBeyondVectorLength(JSC::ExecState*, unsigned int, JSC::JSValue, bool) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/JSObject.cpp:2672
#8 0x7fd599348a13 in JSC::JSObject::putByIndex(JSC::JSCell*, JSC::ExecState*, unsigned int, JSC::JSValue, bool) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/JSObject.cpp:930
#9 0x7fd59934dc2c in JSC::JSObject::putInline(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/JSObjectInlines.h:211
#10 0x7fd59934dc2c in JSC::JSObject::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/JSObject.cpp:751
#11 0x7fd5992f40b1 in JSC::JSArray::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/JSArray.cpp:272
#12 0x7fd598ea13fd in JSC::JSValue::put(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) /home/webkitgtk-2.16.0/Source/JavaScriptCore/runtime/JSCJSValueInlines.h:872
#13 0x7fd598ea13fd in operationPutByValInternal<false, false> /home/webkitgtk-2.16.0/Source/JavaScriptCore/dfg/DFGOperations.cpp:145
#14 0x7fd598ea13fd in operationPutByValNonStrict /home/webkitgtk-2.16.0/Source/JavaScriptCore/dfg/DFGOperations.cpp:624
#15 0x7fd55180350c (<unknown module>)
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20170426/301b754d/attachment-0001.html>
More information about the webkit-unassigned
mailing list