141187 2015-02-02 19:57:27 -0800 Crash in JSC::createTypeError 2016-02-02 15:53:12 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified NEW InRadar P2 Critical --- 1 cwhan.tunz webkit-unassigned ddkilzer webkit-bug-importer oldest_to_newest 1066335 0 cwhan.tunz 2015-02-02 19:57:27 -0800 this code crashes. ---- new function f() { for (f in [1])({})(); } ---- Program received signal SIGSEGV, Segmentation fault. 0x00007ffff7ae324f in JSC::createTypeError(JSC::JSGlobalObject*, WTF::String const&) () from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 (gdb) bt #0 0x00007ffff7ae324f in JSC::createTypeError(JSC::JSGlobalObject*, WTF::String const&) () from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 #1 0x00007ffff7aea152 in JSC::createError(JSC::ExecState*, JSC::JSObject* (*)(JSC::ExecState*, WTF::String const&), JSC::JSValue, WTF::String const&) () from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 #2 0x00007ffff7aeaa27 in JSC::createNotAFunctionError(JSC::ExecState*, JSC::JSValue) () from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 #3 0x00007ffff7bf7f8d in JSC::LLInt::handleHostCall(JSC::ExecState*, JSC::Instruction*, JSC::JSValue, JSC::CodeSpecializationKind) [clone .isra.113] () from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 #4 0x00007ffff7bff460 in llint_slow_path_call () from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 #5 0x00007ffff7c09fdd in llint_entry () from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 #6 0x00007ffff7c0a0e8 in llint_entry () from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 #7 0x00007ffff7c046c9 in vmEntryToJavaScript () from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 #8 0x00007ffff7998854 in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) () from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 #9 0x00007ffff797b47d in JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) () from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 #10 0x00007ffff7ad062a in JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) () from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 #11 0x000000000040c489 in jscmain(int, char**) () #12 0x0000000000406da8 in main () ASSERTION FAILED: cell->isObject() /development/tunz/javascript/webkit/Source/JavaScriptCore/runtime/JSObject.h(1190) : JSC::JSObject* JSC::asObject(JSC::JSCell*) 1 0x7fe551c86394 /development/tunz/javascript/webkit/WebKitDebug/Debug/lib/libjavascriptcoregtk-4.0.so.18(WTFCrash+0x1e) [0x7fe551c86394] 2 0x42f983 ../jsc_d(_ZN3JSC8asObjectEPNS_6JSCellE+0x3d) [0x42f983] 3 0x42f9b1 ../jsc_d(_ZN3JSC8asObjectENS_7JSValueE+0x20) [0x42f9b1] 4 0x43014f ../jsc_d(_ZNK3JSC8Register8functionEv+0x4d) [0x43014f] 5 0x42c700 ../jsc_d(_ZNK3JSC9ExecState6calleeEv+0x1c) [0x42c700] 6 0x4311f6 ../jsc_d(_ZNK3JSC9ExecState2vmEv+0x18) [0x4311f6] 7 0x7fe551ad9dae /development/tunz/javascript/webkit/WebKitDebug/Debug/lib/libjavascriptcoregtk-4.0.so.18(+0x1262dae) [0x7fe551ad9dae] 8 0x7fe551c37c49 /development/tunz/javascript/webkit/WebKitDebug/Debug/lib/libjavascriptcoregtk-4.0.so.18(+0x13c0c49) [0x7fe551c37c49] Segmentation fault Also, ---- new function f() { for (f in [1]); print(f); } ---- Output of above code should be ---- function f() { for (f in [1]); print(f); } ---- But, in JSC, output is 0. found with afl-fuzz. 1161445 1 webkit-bug-importer 2016-02-02 15:53:12 -0800 <rdar://problem/24469697>