157078 2016-04-27 10:28:02 -0700 Assertion failure when returning incomplete property descriptor from proxy trap 2016-06-15 21:41:53 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 andre.bargull mark.lam commit-queue ggaren keith_miller mark.lam msaboff saam webkit-bug-importer ysuzuki oldest_to_newest 1187790 0 andre.bargull 2016-04-27 10:28:02 -0700 SVN: rev200124 Build with: perl Tools/Scripts/build-jsc --gtk --debug The following test case triggers this assertion error: --- ASSERTION FAILED: value --- Test case: --- Object.getOwnPropertyDescriptor(new Proxy({a:0}, { getOwnPropertyDescriptor(t,pk){return {writable:true, enumerable:true, configurable:true}} }), "") --- Stack trace: --- #0 0x00007ffff6e289ac in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:322 #1 0x00007ffff6ceb180 in JSC::PropertyDescriptor::setDescriptor (this=0x7fffffffca50, value=..., attributes=0) at ../../Source/JavaScriptCore/runtime/PropertyDescriptor.cpp:116 #2 0x00007ffff6c62064 in JSC::JSObject::getOwnPropertyDescriptor (this=0x7fffaedbf4f0, exec=0x7fffffffcaf0, propertyName=..., descriptor=...) at ../../Source/JavaScriptCore/runtime/JSObject.cpp:2866 #3 0x00007ffff6cd385f in JSC::objectConstructorGetOwnPropertyDescriptor (exec=0x7fffffffcaf0, object=0x7fffaedbf4f0, propertyName=...) at ../../Source/JavaScriptCore/runtime/ObjectConstructor.cpp:229 #4 0x00007ffff6cd3c71 in JSC::objectConstructorGetOwnPropertyDescriptor (exec=0x7fffffffcaf0) at ../../Source/JavaScriptCore/runtime/ObjectConstructor.cpp:272 #5 0x00007fffb0bff028 in ?? () #6 0x00007fffffffcb60 in ?? () #7 0x00007ffff6a33818 in llint_entry () at ../../Source/JavaScriptCore/runtime/JSCJSValueInlines.h:1037 Backtrace stopped: frame did not save the PC --- 1192692 1 webkit-bug-importer 2016-05-13 00:43:10 -0700 <rdar://problem/26263841> 1202748 2 mark.lam 2016-06-15 16:29:56 -0700 I can reproduce this on a debug build. Looking into it. 1202851 3 281434 mark.lam 2016-06-15 20:59:06 -0700 Created attachment 281434 proposed patch. 1202862 4 mark.lam 2016-06-15 21:41:53 -0700 Thanks for the review. Landed in r202124: <http://trac.webkit.org/r202124>. 281434 2016-06-15 20:59:06 -0700 2016-06-15 21:25:00 -0700 proposed patch. bug-157078.patch text/plain 3528 mark.lam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjAyMTIzKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIyIEBA CisyMDE2LTA2LTE1ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBB c3NlcnRpb24gZmFpbHVyZSB3aGVuIHJldHVybmluZyBpbmNvbXBsZXRlIHByb3BlcnR5IGRlc2Ny aXB0b3IgZnJvbSBwcm94eSB0cmFwLgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9z aG93X2J1Zy5jZ2k/aWQ9MTU3MDc4CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT ISkuCisKKyAgICAgICAgSWYgdGhlIHByb3h5IHJldHVybnMgYSBkZXNjcmlwdG9yIHRoYXQgZXhw ZWN0cyBhIHZhbHVlIGJ1dCBkb2VzIG5vdCBzcGVjaWZ5IG9uZSwKKyAgICAgICAgd2Ugc2hvdWxk IHVzZSB1bmRlZmluZWQgZm9yIHRoZSB2YWx1ZS4KKworICAgICAgICAqIHJ1bnRpbWUvUHJveHlP YmplY3QuY3BwOgorICAgICAgICAoSlNDOjpQcm94eU9iamVjdDo6cGVyZm9ybUludGVybmFsTWV0 aG9kR2V0T3duUHJvcGVydHkpOgorICAgICAgICAqIHRlc3RzL3N0cmVzcy9wcm94eS1yZXR1cm5p bmctaW5jb21wbGV0ZS1wcm9wZXJ0eS1kZXNjcmlwdG9yLmpzOiBBZGRlZC4KKyAgICAgICAgKHRy dXRoaW5lc3MpOgorICAgICAgICAoY29tcGFyZSk6CisgICAgICAgIChzaG91bGRCZSk6CisgICAg ICAgICh0ZXN0KToKKyAgICAgICAgKGdldCB0ZXN0KToKKwogMjAxNi0wNi0xNSAgS2VpdGggTWls bGVyICA8a2VpdGhfbWlsbGVyQGFwcGxlLmNvbT4KIAogICAgICAgICBVbnJldmlld2VkLCBmaXgg dHlwbyBpbiB0ZXN0IGFuZCBtb3ZlIHRlc3RzIHRvIHRoZSBjb3JyZWN0IGZpbGVzLgpJbmRleDog U291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvUHJveHlPYmplY3QuY3BwCj09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K LS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL1Byb3h5T2JqZWN0LmNwcAkocmV2aXNp b24gMjAyMDk1KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvUHJveHlPYmplY3Qu Y3BwCSh3b3JraW5nIGNvcHkpCkBAIC0yNjIsNyArMjYyLDcgQEAgYm9vbCBQcm94eU9iamVjdDo6 cGVyZm9ybUludGVybmFsTWV0aG9kRwogICAgICAgICBpZiAoZXhlYy0+aGFkRXhjZXB0aW9uKCkp CiAgICAgICAgICAgICByZXR1cm4gZmFsc2U7CiAgICAgICAgIHNsb3Quc2V0R2V0dGVyU2xvdCh0 aGlzLCB0cmFwUmVzdWx0QXNEZXNjcmlwdG9yLmF0dHJpYnV0ZXMoKSwgZ2V0dGVyU2V0dGVyKTsK LSAgICB9IGVsc2UgaWYgKHRyYXBSZXN1bHRBc0Rlc2NyaXB0b3IuaXNEYXRhRGVzY3JpcHRvcigp KQorICAgIH0gZWxzZSBpZiAodHJhcFJlc3VsdEFzRGVzY3JpcHRvci5pc0RhdGFEZXNjcmlwdG9y KCkgJiYgIXRyYXBSZXN1bHRBc0Rlc2NyaXB0b3IudmFsdWUoKS5pc0VtcHR5KCkpCiAgICAgICAg IHNsb3Quc2V0VmFsdWUodGhpcywgdHJhcFJlc3VsdEFzRGVzY3JpcHRvci5hdHRyaWJ1dGVzKCks IHRyYXBSZXN1bHRBc0Rlc2NyaXB0b3IudmFsdWUoKSk7CiAgICAgZWxzZQogICAgICAgICBzbG90 LnNldFZhbHVlKHRoaXMsIHRyYXBSZXN1bHRBc0Rlc2NyaXB0b3IuYXR0cmlidXRlcygpLCBqc1Vu ZGVmaW5lZCgpKTsgLy8gV2UgdXNlIHVuZGVmaW5lZCBiZWNhdXNlIGl0J3MgdGhlIGRlZmF1bHQg dmFsdWUgaW4gb2JqZWN0IHByb3BlcnRpZXMuCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUv dGVzdHMvc3RyZXNzL3Byb3h5LXJldHVybmluZy1pbmNvbXBsZXRlLXByb3BlcnR5LWRlc2NyaXB0 b3IuanMKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL3Rlc3RzL3N0cmVzcy9w cm94eS1yZXR1cm5pbmctaW5jb21wbGV0ZS1wcm9wZXJ0eS1kZXNjcmlwdG9yLmpzCShub25leGlz dGVudCkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS90ZXN0cy9zdHJlc3MvcHJveHktcmV0dXJu aW5nLWluY29tcGxldGUtcHJvcGVydHktZGVzY3JpcHRvci5qcwkod29ya2luZyBjb3B5KQpAQCAt MCwwICsxLDM2IEBACisvLyBUaGlzIHRlc3Qgc2hvdWxkIG5vdCBjcmFzaC4KK2Z1bmN0aW9uIHRy dXRoaW5lc3MoeCkgeworICAgIHJldHVybiAhIXg7Cit9CisKK2Z1bmN0aW9uIGNvbXBhcmUoYSwg YikgeworICAgIGZvciAodmFyIGkgaW4gYS5kZXNjKSB7CisgICAgICAgIGxldCBwcm9wQSA9IGEu ZGVzY1tpXTsKKyAgICAgICAgbGV0IHByb3BCID0gYi5kZXNjW2ldOworICAgICAgICBpZiAocHJv cEEgPT0gcHJvcEIpCisgICAgICAgICAgICBjb250aW51ZTsKKyAgICAgICAgaWYgKHR5cGVvZiBw cm9wQSA9PSAiYm9vbGVhbiIgJiYgdHJ1dGhpbmVzcyhwcm9wQSkgPT0gdHJ1dGhpbmVzcyhwcm9w QikpCisgICAgICAgICAgICBjb250aW51ZTsKKyAgICAgICAgdGhyb3cgRXJyb3IoYS5uYW1lICsg IlsiICsgaSArICJdIDogIiArIHByb3BBICsgIiAhPSAiICsgYi5uYW1lICsgIlsiICsgaSArICJd IDogIiArIHByb3BCKTsKKyAgICB9Cit9CisKK2Z1bmN0aW9uIHNob3VsZEJlKGFjdHVhbERlc2Ms IGV4cGVjdGVkRGVzYykgeworICAgIGNvbXBhcmUoeyBuYW1lOiAiYWN0dWFsIiwgZGVzYzogYWN0 dWFsRGVzYyB9LCB7IG5hbWU6ICJleHBlY3RlZCIsIGRlc2M6IGV4cGVjdGVkRGVzYyB9KTsKKyAg ICBjb21wYXJlKHsgbmFtZTogImV4cGVjdGVkIiwgZGVzYzogZXhwZWN0ZWREZXNjIH0sIHsgbmFt ZTogImFjdHVhbCIsIGRlc2M6IGFjdHVhbERlc2MgfSk7Cit9CisKK2Z1bmN0aW9uIHRlc3QoZXhw ZWN0ZWREZXNjKSB7CisgICAgdmFyIGRlc2MgPSBPYmplY3QuZ2V0T3duUHJvcGVydHlEZXNjcmlw dG9yKG5ldyBQcm94eSh7YTowfSwgeworICAgICAgICAgICAgZ2V0T3duUHJvcGVydHlEZXNjcmlw dG9yKHQscGspIHsKKyAgICAgICAgICAgICAgICByZXR1cm4gZXhwZWN0ZWREZXNjCisgICAgICAg ICAgICB9CisgICAgICAgIH0pLCAiIik7CisgICAgc2hvdWxkQmUoZGVzYywgZXhwZWN0ZWREZXNj KTsKK30KKwordGVzdCh7IGNvbmZpZ3VyYWJsZTp0cnVlIH0pOwordGVzdCh7IHdyaXRhYmxlOnRy dWUsIGNvbmZpZ3VyYWJsZTp0cnVlIH0pOwordGVzdCh7IHdyaXRhYmxlOnRydWUsIGVudW1lcmFi bGU6dHJ1ZSwgY29uZmlndXJhYmxlOnRydWUgfSk7Cit0ZXN0KHsgZW51bWVyYWJsZTp0cnVlLCBj b25maWd1cmFibGU6dHJ1ZSwgZ2V0OiBmdW5jdGlvbigpIHt9IH0pOwordGVzdCh7IGVudW1lcmFi bGU6dHJ1ZSwgY29uZmlndXJhYmxlOnRydWUsIHNldDogZnVuY3Rpb24oKSB7fSB9KTsK