<html>
    <head>
      <base href="https://bugs.webkit.org/" />
    </head>
    <body><table border="1" cellspacing="0" cellpadding="8">
        <tr>
          <th>Bug ID</th>
          <td><a class="bz_bug_link 
          bz_status_NEW "
   title="NEW - Crash in JSC::createTypeError"
   href="https://bugs.webkit.org/show_bug.cgi?id=141187">141187</a>
          </td>
        </tr>

        <tr>
          <th>Summary</th>
          <td>Crash in JSC::createTypeError
          </td>
        </tr>

        <tr>
          <th>Classification</th>
          <td>Unclassified
          </td>
        </tr>

        <tr>
          <th>Product</th>
          <td>WebKit
          </td>
        </tr>

        <tr>
          <th>Version</th>
          <td>528+ (Nightly build)
          </td>
        </tr>

        <tr>
          <th>Hardware</th>
          <td>Unspecified
          </td>
        </tr>

        <tr>
          <th>OS</th>
          <td>Unspecified
          </td>
        </tr>

        <tr>
          <th>Status</th>
          <td>NEW
          </td>
        </tr>

        <tr>
          <th>Severity</th>
          <td>Critical
          </td>
        </tr>

        <tr>
          <th>Priority</th>
          <td>P2
          </td>
        </tr>

        <tr>
          <th>Component</th>
          <td>JavaScriptCore
          </td>
        </tr>

        <tr>
          <th>Assignee</th>
          <td>webkit-unassigned@lists.webkit.org
          </td>
        </tr>

        <tr>
          <th>Reporter</th>
          <td>cwhan.tunz@gmail.com
          </td>
        </tr></table>
      <p>
        <div>
        <pre>this code crashes.
----
new
function f() {
for (f in [1])({})();
}
----

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7ae324f in JSC::createTypeError(JSC::JSGlobalObject*, WTF::String const&) ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
(gdb) bt
#0  0x00007ffff7ae324f in JSC::createTypeError(JSC::JSGlobalObject*, WTF::String const&) ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#1  0x00007ffff7aea152 in JSC::createError(JSC::ExecState*, JSC::JSObject* (*)(JSC::ExecState*, WTF::String const&), JSC::JSValue, WTF::String const&) ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#2  0x00007ffff7aeaa27 in JSC::createNotAFunctionError(JSC::ExecState*, JSC::JSValue) ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#3  0x00007ffff7bf7f8d in JSC::LLInt::handleHostCall(JSC::ExecState*, JSC::Instruction*, JSC::JSValue, JSC::CodeSpecializationKind) [clone .isra.113] ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#4  0x00007ffff7bff460 in llint_slow_path_call ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#5  0x00007ffff7c09fdd in llint_entry ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#6  0x00007ffff7c0a0e8 in llint_entry ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#7  0x00007ffff7c046c9 in vmEntryToJavaScript ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#8  0x00007ffff7998854 in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#9  0x00007ffff797b47d in JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#10 0x00007ffff7ad062a in JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#11 0x000000000040c489 in jscmain(int, char**) ()
#12 0x0000000000406da8 in main ()

ASSERTION FAILED: cell->isObject()
/development/tunz/javascript/webkit/Source/JavaScriptCore/runtime/JSObject.h(1190) : JSC::JSObject* JSC::asObject(JSC::JSCell*)
1   0x7fe551c86394 /development/tunz/javascript/webkit/WebKitDebug/Debug/lib/libjavascriptcoregtk-4.0.so.18(WTFCrash+0x1e) [0x7fe551c86394]
2   0x42f983 ../jsc_d(_ZN3JSC8asObjectEPNS_6JSCellE+0x3d) [0x42f983]
3   0x42f9b1 ../jsc_d(_ZN3JSC8asObjectENS_7JSValueE+0x20) [0x42f9b1]
4   0x43014f ../jsc_d(_ZNK3JSC8Register8functionEv+0x4d) [0x43014f]
5   0x42c700 ../jsc_d(_ZNK3JSC9ExecState6calleeEv+0x1c) [0x42c700]
6   0x4311f6 ../jsc_d(_ZNK3JSC9ExecState2vmEv+0x18) [0x4311f6]
7   0x7fe551ad9dae /development/tunz/javascript/webkit/WebKitDebug/Debug/lib/libjavascriptcoregtk-4.0.so.18(+0x1262dae) [0x7fe551ad9dae]
8   0x7fe551c37c49 /development/tunz/javascript/webkit/WebKitDebug/Debug/lib/libjavascriptcoregtk-4.0.so.18(+0x13c0c49) [0x7fe551c37c49]
Segmentation fault

Also, 
----
new
function f() {
for (f in [1]);
print(f);
}
----

Output of above code should be 
----
function f() {
for (f in [1]);
print(f);
}
----

But, in JSC, output is 0.

found with afl-fuzz.</pre>
        </div>
      </p>
      <hr>
      <span>You are receiving this mail because:</span>
      
      <ul>
          <li>You are the assignee for the bug.</li>
      </ul>
    </body>
</html>