157081 2016-04-27 10:28:38 -0700 Assertion failure for bound function with custom prototype and Reflect.construct 2017-08-04 09:22:33 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 175191 1 andre.bargull ysuzuki commit-queue ggaren keith_miller mark.lam msaboff saam webkit-bug-importer ysuzuki oldest_to_newest 1187793 0 andre.bargull 2016-04-27 10:28:38 -0700 SVN: rev200124 Build with: perl Tools/Scripts/build-jsc --gtk --debug The following test case triggers this assertion error: --- ASSERTION FAILED: prototype != baseStructure->storedPrototype() --- Test case: --- Reflect.construct(Array, [], Object.defineProperty(function(){}.bind(), "prototype", {value: Array.prototype})); --- Stack trace: --- #0 0x00007ffff6e289ac in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:322 #1 0x00007ffff6bbf328 in JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase (this=0x7fffaedb3ea0, vm=..., owner=0x7fffaedb3e80, prototype=0x7fffaedd36a0, baseStructure=0x7fffaedf4380) at ../../Source/JavaScriptCore/bytecode/InternalFunctionAllocationProfile.h:50 #2 0x00007ffff6bbf443 in JSC::FunctionRareData::createInternalFunctionAllocationStructureFromBase (this=0x7fffaedb3e80, vm=..., prototype=0x7fffaedd36a0, baseStructure=0x7fffaedf4380) at ../../Source/JavaScriptCore/runtime/FunctionRareData.h:90 #3 0x00007ffff6bbf200 in JSC::InternalFunction::createSubclassStructure (exec=0x7fffffffc800, newTarget=..., baseClass=0x7fffaedf4380) at ../../Source/JavaScriptCore/runtime/InternalFunction.cpp:115 #4 0x0000000000447887 in JSC::JSGlobalObject::arrayStructureForIndexingTypeDuringAllocation (this=0x7fffaede7900, exec=0x7fffffffc800, indexingType=3 '\003', newTarget=...) at ../../Source/JavaScriptCore/runtime/JSGlobalObject.h:506 #5 0x00000000004478c5 in JSC::JSGlobalObject::arrayStructureForProfileDuringAllocation (this=0x7fffaede7900, exec=0x7fffffffc800, profile=0x0, newTarget=...) at ../../Source/JavaScriptCore/runtime/JSGlobalObject.h:510 #6 0x00007ffff600afb9 in JSC::constructArray (exec=0x7fffffffc800, profile=0x0, globalObject=0x7fffaede7900, values=..., newTarget=...) at ../../Source/JavaScriptCore/runtime/JSGlobalObject.h:766 #7 0x00007ffff6b2efd6 in JSC::constructArrayWithSizeQuirk (exec=0x7fffffffc800, args=..., newTarget=...) at ../../Source/JavaScriptCore/runtime/ArrayConstructor.cpp:101 #8 0x00007ffff6b2f03c in JSC::constructWithArrayConstructor (exec=0x7fffffffc800) at ../../Source/JavaScriptCore/runtime/ArrayConstructor.cpp:107 #9 0x00007ffff6a2da0a in vmEntryToNative () at ../../Source/JavaScriptCore/runtime/Butterfly.h:58 #10 0x00007ffff6998ae5 in JSC::Interpreter::executeConstruct (this=0x7ffff0def058, callFrame=0x7fffffffcae0, constructor=0x7fffaedbbe00, constructType=<incomplete type>, constructData=..., args=..., newTarget=...) at ../../Source/JavaScriptCore/interpreter/Interpreter.cpp:1090 #11 0x00007ffff6b8a3ac in JSC::construct (exec=0x7fffffffcae0, constructorObject=..., constructType=<incomplete type>, constructData=..., args=..., newTarget=...) at ../../Source/JavaScriptCore/runtime/ConstructData.cpp:52 #12 0x00007ffff6cfbbd8 in JSC::reflectObjectConstruct (exec=0x7fffffffcae0) at ../../Source/JavaScriptCore/runtime/ReflectObject.cpp:130 #13 0x00007fffb0bff028 in ?? () #14 0x00007fffffffcb60 in ?? () #15 0x00007ffff6a33818 in llint_entry () at ../../Source/JavaScriptCore/runtime/Butterfly.h:58 Backtrace stopped: frame did not save the PC --- 1188743 1 webkit-bug-importer 2016-04-29 12:12:50 -0700 <rdar://problem/26010086> 1188744 2 ysuzuki 2016-04-29 12:13:08 -0700 This assertion is incorrect. We ensured newTarget != exec->callee(). But it does not guarantee that newTarget.[[Prototype]] != exec->callee().[[Prototype]]. 1189050 3 277807 ysuzuki 2016-04-30 07:35:02 -0700 Created attachment 277807 Patch 1189251 4 277807 saam 2016-05-01 16:03:03 -0700 Comment on attachment 277807 Patch r=me 1189344 5 277807 commit-queue 2016-05-02 01:08:48 -0700 Comment on attachment 277807 Patch Clearing flags on attachment: 277807 Committed r200319: <http://trac.webkit.org/changeset/200319> 1189345 6 commit-queue 2016-05-02 01:08:52 -0700 All reviewed patches have been landed. Closing bug. 277807 2016-04-30 07:35:02 -0700 2016-05-02 01:08:48 -0700 Patch bug-157081-20160430233535.patch text/plain 3270 ysuzuki U3VidmVyc2lvbiBSZXZpc2lvbjogMjAwMjg5CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCAz OTgzOTQ5NWFiYTI0OWIzZWJmZGRiYmQxM2UxOWFlMGZlOTY3OWVlLi5jZWZlZjNkMDQ3OGQ4YjQ2 OGQ5MDc1NTdhMzYwOTVmNzNmNGRmNWMzIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwyMCBAQAorMjAxNi0wNC0zMCAgWXVzdWtlIFN1enVraSAgPHV0YXRhbmUudGVhQGdtYWls LmNvbT4KKworICAgICAgICBBc3NlcnRpb24gZmFpbHVyZSBmb3IgYm91bmQgZnVuY3Rpb24gd2l0 aCBjdXN0b20gcHJvdG90eXBlIGFuZCBSZWZsZWN0LmNvbnN0cnVjdAorICAgICAgICBodHRwczov L2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTU3MDgxCisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgV2UgZW5zdXJlZCBgbmV3VGFyZ2V0ICE9 IGV4ZWMtPmNhbGxlZSgpYC4gSG93ZXZlciwgaXQgZG9lcyBub3QgbWVhbiBgbmV3VGFyZ2V0Lmdl dCgicHJvdG90eXBlIikgIT0gZXhlYy0+Y2FsbGVlKCktPmdldCgicHJvdG90eXBlIilgLgorICAg ICAgICBXaGVuIHRoZSBnaXZlbiBgcHJvdG90eXBlYCBpcyB0aGUgc2FtZSB0byBgYmFzZVN0cnVj dHVyZS0+c290cmVkUHJvdG90eXBlKClgLCBpdCBpcyB1bm5lY2Vzc2FyeSB0byBjcmVhdGUgYSBu ZXcgc3RydWN0dXJlIGZyb20gdGhpcworICAgICAgICBiYXNlU3RydWN0dXJlLgorCisgICAgICAg ICogYnl0ZWNvZGUvSW50ZXJuYWxGdW5jdGlvbkFsbG9jYXRpb25Qcm9maWxlLmg6CisgICAgICAg IChKU0M6OkludGVybmFsRnVuY3Rpb25BbGxvY2F0aW9uUHJvZmlsZTo6Y3JlYXRlQWxsb2NhdGlv blN0cnVjdHVyZUZyb21CYXNlKToKKyAgICAgICAgKiB0ZXN0cy9zdHJlc3MvY3VzdG9tLXByb3Rv dHlwZS1tYXktYmUtc2FtZS10by1vcmlnaW5hbC1vbmUuanM6IEFkZGVkLgorICAgICAgICAoc2hv dWxkQmUpOgorICAgICAgICAoYm91bmRGdW5jdGlvbik6CisKIDIwMTYtMDQtMjggIERhcmluIEFk bGVyICA8ZGFyaW5AYXBwbGUuY29tPgogCiAgICAgICAgIEZpcnN0IHN0ZXAgaW4gdXNpbmcgImVu dW0gY2xhc3MiIGluc3RlYWQgb2YgIlN0cmluZyIgZm9yIGVudW1lcmF0aW9ucyBpbiBET00KZGlm ZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9ieXRlY29kZS9JbnRlcm5hbEZ1bmN0aW9u QWxsb2NhdGlvblByb2ZpbGUuaCBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9ieXRlY29kZS9JbnRl cm5hbEZ1bmN0aW9uQWxsb2NhdGlvblByb2ZpbGUuaAppbmRleCAxOTI2ZTkzZjJhYjZhOTExYzkx M2NjYTU4MGIwMGJhODhmNzI0ZTZiLi41NjY3NWI0ODJhMDE1ODNkZTcyNTU0MDE1YTI3MjYwNmFm NmZkZmIwIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvZGUvSW50ZXJu YWxGdW5jdGlvbkFsbG9jYXRpb25Qcm9maWxlLmgKKysrIGIvU291cmNlL0phdmFTY3JpcHRDb3Jl L2J5dGVjb2RlL0ludGVybmFsRnVuY3Rpb25BbGxvY2F0aW9uUHJvZmlsZS5oCkBAIC00NywxMCAr NDcsMTMgQEAgY2xhc3MgSW50ZXJuYWxGdW5jdGlvbkFsbG9jYXRpb25Qcm9maWxlIHsKIAogaW5s aW5lIFN0cnVjdHVyZSogSW50ZXJuYWxGdW5jdGlvbkFsbG9jYXRpb25Qcm9maWxlOjpjcmVhdGVB bGxvY2F0aW9uU3RydWN0dXJlRnJvbUJhc2UoVk0mIHZtLCBKU0NlbGwqIG93bmVyLCBKU09iamVj dCogcHJvdG90eXBlLCBTdHJ1Y3R1cmUqIGJhc2VTdHJ1Y3R1cmUpCiB7Ci0gICAgQVNTRVJUKHBy b3RvdHlwZSAhPSBiYXNlU3RydWN0dXJlLT5zdG9yZWRQcm90b3R5cGUoKSk7CiAgICAgQVNTRVJU KCFtX3N0cnVjdHVyZSB8fCBtX3N0cnVjdHVyZS5nZXQoKS0+Y2xhc3NJbmZvKCkgIT0gYmFzZVN0 cnVjdHVyZS0+Y2xhc3NJbmZvKCkpOwogCi0gICAgU3RydWN0dXJlKiBzdHJ1Y3R1cmUgPSB2bS5w cm90b3R5cGVNYXAuZW1wdHlTdHJ1Y3R1cmVGb3JQcm90b3R5cGVGcm9tQmFzZVN0cnVjdHVyZShw cm90b3R5cGUsIGJhc2VTdHJ1Y3R1cmUpOworICAgIFN0cnVjdHVyZSogc3RydWN0dXJlOworICAg IGlmIChwcm90b3R5cGUgPT0gYmFzZVN0cnVjdHVyZS0+c3RvcmVkUHJvdG90eXBlKCkpCisgICAg ICAgIHN0cnVjdHVyZSA9IGJhc2VTdHJ1Y3R1cmU7CisgICAgZWxzZQorICAgICAgICBzdHJ1Y3R1 cmUgPSB2bS5wcm90b3R5cGVNYXAuZW1wdHlTdHJ1Y3R1cmVGb3JQcm90b3R5cGVGcm9tQmFzZVN0 cnVjdHVyZShwcm90b3R5cGUsIGJhc2VTdHJ1Y3R1cmUpOwogCiAgICAgLy8gRW5zdXJlIHRoYXQg aWYgYW5vdGhlciB0aHJlYWQgc2VlcyB0aGUgc3RydWN0dXJlLCBpdCB3aWxsIHNlZSBpdCBwcm9w ZXJseSBjcmVhdGVkLgogICAgIFdURjo6c3RvcmVTdG9yZUZlbmNlKCk7CmRpZmYgLS1naXQgYS9T b3VyY2UvSmF2YVNjcmlwdENvcmUvdGVzdHMvc3RyZXNzL2N1c3RvbS1wcm90b3R5cGUtbWF5LWJl LXNhbWUtdG8tb3JpZ2luYWwtb25lLmpzIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL3Rlc3RzL3N0 cmVzcy9jdXN0b20tcHJvdG90eXBlLW1heS1iZS1zYW1lLXRvLW9yaWdpbmFsLW9uZS5qcwpuZXcg ZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwLi4yZDBkNDY1OTVmMjMwNDBkZTQzOGQ0MDg3Y2UzMjhlYzgxMGRhNmNiCi0tLSAvZGV2 L251bGwKKysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL3Rlc3RzL3N0cmVzcy9jdXN0b20tcHJv dG90eXBlLW1heS1iZS1zYW1lLXRvLW9yaWdpbmFsLW9uZS5qcwpAQCAtMCwwICsxLDExIEBACitm dW5jdGlvbiBzaG91bGRCZShhY3R1YWwsIGV4cGVjdGVkKSB7CisgICAgaWYgKGFjdHVhbCAhPT0g ZXhwZWN0ZWQpCisgICAgICAgIHRocm93IG5ldyBFcnJvcihgYmFkIHZhbHVlOiAke1N0cmluZyhh Y3R1YWwpfWApOworfQorCit2YXIgYm91bmRGdW5jdGlvbiA9IGZ1bmN0aW9uKCl7fS5iaW5kKCk7 CitPYmplY3QuZGVmaW5lUHJvcGVydHkoYm91bmRGdW5jdGlvbiwgInByb3RvdHlwZSIsIHsKKyAg ICB2YWx1ZTogQXJyYXkucHJvdG90eXBlCit9KTsKK3ZhciByZXN1bHQgPSBSZWZsZWN0LmNvbnN0 cnVjdChBcnJheSwgW10sIGJvdW5kRnVuY3Rpb24pOworc2hvdWxkQmUocmVzdWx0Ll9fcHJvdG9f XywgQXJyYXkucHJvdG90eXBlKTsK