<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - RELEASE_ASSERT(!thisObject) in ObjCCallbackFunctionImpl::call when calling JSExport ObjC Constructor without operator new"
href="https://bugs.webkit.org/show_bug.cgi?id=159446">159446</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>RELEASE_ASSERT(!thisObject) in ObjCCallbackFunctionImpl::call when calling JSExport ObjC Constructor without operator new
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>WebKit Nightly Build
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>OS</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>JavaScriptCore
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>joepeck@webkit.org
</td>
</tr>
<tr>
<th>CC</th>
<td>ggaren@apple.com, mark.lam@apple.com
</td>
</tr></table>
<p>
<div>
<pre>Summary:
RELEASE_ASSERT(!thisObject) in ObjCCallbackFunctionImpl::call when calling JSExport ObjC Constructor without operator new
Test:
/*
* shell> xcrun clang -framework Foundation -framework JavaScriptCore construct.m
*/
#import <Foundation/Foundation.h>
#import <JavaScriptCore/JavaScriptCore.h>
@protocol JSFooExports <JSExport>
- (instancetype)initWithName:(NSString *)name;
@end
@interface JSFoo : NSObject <JSFooExports>
- (instancetype)initWithName:(NSString *)name;
@end
@implementation JSFoo
- (instancetype)initWithName:(NSString *)name {
self = [super init];
if (!self) return nil;
NSLog(@">>> initWithName: %@", name);
return self;
}
@end
int main()
{
JSContext *ctx = [[JSContext alloc] init];
ctx[@"JSFoo"] = [JSFoo class];
[ctx evaluateScript:@"JSFoo()"];
return 0;
}
Steps to Reproduce:
1. Compile + Run test
=> RELEASE_ASSERT crash immediately
Crash:
Crashed Thread: 0 Dispatch queue: com.apple.main-thread
Exception Type: EXC_BREAKPOINT (SIGTRAP)
Exception Codes: 0x0000000000000002, 0x0000000000000000
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 com.apple.JavaScriptCore 0x000000010bdf0e6e JSC::ObjCCallbackFunctionImpl::call(JSContext*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**) + 654 (ObjCCallbackFunction.mm:557)
1 com.apple.JavaScriptCore 0x000000010bdf0926 JSC::objCCallbackFunctionCallAsFunction(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**) + 262 (ObjCCallbackFunction.mm:462)
2 com.apple.JavaScriptCore 0x000000010bdf1b7d long long JSC::APICallbackFunction::call<JSC::ObjCCallbackFunction>(JSC::ExecState*) + 573 (APICallbackFunction.h:61)
3 com.apple.JavaScriptCore 0x000000010bdb15b3 JSC::LLInt::setUpCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*) + 595 (LLIntSlowPaths.cpp:1203)
4 com.apple.JavaScriptCore 0x000000010bdb87ce llint_entry + 24803
5 com.apple.JavaScriptCore 0x000000010bdb2508 vmEntryToJavaScript + 299
6 com.apple.JavaScriptCore 0x000000010bc0c2ee JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 158 (JITCode.cpp:81)
7 com.apple.JavaScriptCore 0x000000010bb65cb5 JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) + 17125 (Interpreter.cpp:961)
8 com.apple.JavaScriptCore 0x000000010b7d0ea5 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 469 (Completion.cpp:107)
9 com.apple.JavaScriptCore 0x000000010bc61d98 JSEvaluateScript + 456 (NakedPtr.h:54)
10 com.apple.JavaScriptCore 0x000000010bc73639 -[JSContext evaluateScript:withSourceURL:] + 105 (JSContext.mm:102)
11 a.out 0x000000010b56ee9b main + 171
12 libdyld.dylib 0x00007fff918095ad start + 1
...</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>