157084 2016-04-27 10:29:27 -0700 Assertion failure for exception in "prototype" property getter and Reflect.construct 2016-04-29 13:01:16 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 andre.bargull ysuzuki commit-queue ggaren keith_miller mark.lam msaboff saam ysuzuki oldest_to_newest 1187796 0 andre.bargull 2016-04-27 10:29:27 -0700 SVN: rev200124 Build with: perl Tools/Scripts/build-jsc --gtk --debug The following test case triggers this assertion error: --- ASSERTION FAILED: !exec->hadException() --- Test case: --- var bf = (function(){}).bind(); Object.defineProperty(bf, "prototype", { get() { throw Error() } }); Reflect.construct(Array, [], bf) --- Stack trace: --- #0 0x00007ffff6e289ac in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:322 #1 0x00007ffff6bbf1cb in JSC::InternalFunction::createSubclassStructure (exec=0x7fffffffc800, newTarget=..., baseClass=0x7fffaedf4380) at ../../Source/JavaScriptCore/runtime/InternalFunction.cpp:113 #2 0x0000000000447887 in JSC::JSGlobalObject::arrayStructureForIndexingTypeDuringAllocation (this=0x7fffaede7900, exec=0x7fffffffc800, indexingType=3 '\003', newTarget=...) at ../../Source/JavaScriptCore/runtime/JSGlobalObject.h:506 #3 0x00000000004478c5 in JSC::JSGlobalObject::arrayStructureForProfileDuringAllocation (this=0x7fffaede7900, exec=0x7fffffffc800, profile=0x0, newTarget=...) at ../../Source/JavaScriptCore/runtime/JSGlobalObject.h:510 #4 0x00007ffff600afb9 in JSC::constructArray (exec=0x7fffffffc800, profile=0x0, globalObject=0x7fffaede7900, values=..., newTarget=...) at ../../Source/JavaScriptCore/runtime/JSGlobalObject.h:766 #5 0x00007ffff6b2efd6 in JSC::constructArrayWithSizeQuirk (exec=0x7fffffffc800, args=..., newTarget=...) at ../../Source/JavaScriptCore/runtime/ArrayConstructor.cpp:101 #6 0x00007ffff6b2f03c in JSC::constructWithArrayConstructor (exec=0x7fffffffc800) at ../../Source/JavaScriptCore/runtime/ArrayConstructor.cpp:107 #7 0x00007ffff6a2da0a in vmEntryToNative () at ../../Source/JavaScriptCore/runtime/Butterfly.h:58 #8 0x00007ffff6998ae5 in JSC::Interpreter::executeConstruct (this=0x7ffff0def058, callFrame=0x7fffffffcae0, constructor=0x7fffaedbbe00, constructType=<incomplete type>, constructData=..., args=..., newTarget=...) at ../../Source/JavaScriptCore/interpreter/Interpreter.cpp:1090 #9 0x00007ffff6b8a3ac in JSC::construct (exec=0x7fffffffcae0, constructorObject=..., constructType=<incomplete type>, constructData=..., args=..., newTarget=...) at ../../Source/JavaScriptCore/runtime/ConstructData.cpp:52 #10 0x00007ffff6cfbbd8 in JSC::reflectObjectConstruct (exec=0x7fffffffcae0) at ../../Source/JavaScriptCore/runtime/ReflectObject.cpp:130 #11 0x00007fffb0bff028 in ?? () #12 0x00007fffffffcb60 in ?? () #13 0x00007ffff6a33818 in llint_entry () at ../../Source/JavaScriptCore/runtime/Butterfly.h:58 --- 1188720 1 ysuzuki 2016-04-29 11:17:40 -0700 As of r196966, createSubclassStructure is allowed to throw any exceptions. So, let's drop this assertion and return if there is some exceptions. http://trac.webkit.org/changeset/196966 1188738 2 277724 ysuzuki 2016-04-29 11:59:30 -0700 Created attachment 277724 Patch 1188741 3 277724 mark.lam 2016-04-29 12:07:32 -0700 Comment on attachment 277724 Patch r=me 1188742 4 277724 ysuzuki 2016-04-29 12:11:49 -0700 Comment on attachment 277724 Patch Thanks! 1188761 5 277724 commit-queue 2016-04-29 13:01:11 -0700 Comment on attachment 277724 Patch Clearing flags on attachment: 277724 Committed r200257: <http://trac.webkit.org/changeset/200257> 1188762 6 commit-queue 2016-04-29 13:01:16 -0700 All reviewed patches have been landed. Closing bug. 277724 2016-04-29 11:59:30 -0700 2016-04-29 13:01:11 -0700 Patch bug-157084-20160430040002.patch text/plain 3543 ysuzuki U3VidmVyc2lvbiBSZXZpc2lvbjogMjAwMjM3CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCAz MDA5YTI4MGU0OGZkOGZhMWU4ZjFmZGI4NTFhZmFiMWM2MmFjOGZjLi4xN2Y0YWEzNDZkYWUyYjI5 MWFjNTIzMzEwODEwYzdkYmQ4MmNiZjJiIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwyMiBAQAorMjAxNi0wNC0yOSAgWXVzdWtlIFN1enVraSAgPHV0YXRhbmUudGVhQGdtYWls LmNvbT4KKworICAgICAgICBBc3NlcnRpb24gZmFpbHVyZSBmb3IgZXhjZXB0aW9uIGluICJwcm90 b3R5cGUiIHByb3BlcnR5IGdldHRlciBhbmQgUmVmbGVjdC5jb25zdHJ1Y3QKKyAgICAgICAgaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE1NzA4NAorCisgICAgICAgIFJl dmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEludGVybmFsRnVuY3Rpb246OmNy ZWF0ZVN1YmNsYXNzU3RydWN1dHVyZSBtYXkgdGhyb3cgZXhjZXB0aW9ucyBiZWNhdXNlIGl0IHBl cmZvcm1zIFtbR2V0XV0gdG8KKyAgICAgICAgbG9vayB1cCB0aGUgInByb3RvdHlwZSIgb2JqZWN0 LiBUaGUgY3VycmVudCBhc3NlcnRpb24gaXMgaW52YWxpZC4KKyAgICAgICAgV2UgYWxzbyBmb3Vu ZCB0aGF0IE9iamVjdCBjb25zdHJ1Y3RvciBpcyBub3QgYXdhcmUgb2YgbmV3LnRhcmdldC4gVGhp cyBpcyBmaWxlZFsxXS4KKworICAgICAgICBbMV06IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3No b3dfYnVnLmNnaT9pZD0xNTcxOTYKKworICAgICAgICAqIHJ1bnRpbWUvSW50ZXJuYWxGdW5jdGlv bi5jcHA6CisgICAgICAgIChKU0M6OkludGVybmFsRnVuY3Rpb246OmNyZWF0ZVN1YmNsYXNzU3Ry dWN0dXJlKToKKyAgICAgICAgKiB0ZXN0cy9zdHJlc3MvY3JlYXRlLXN1YmNsYXNzLXN0cnVjdHVy ZS1tYXktdGhyb3ctZXhjZXB0aW9uLXdoZW4tZ2V0dGluZy1wcm90b3R5cGUuanM6IEFkZGVkLgor ICAgICAgICAoc2hvdWxkVGhyb3cpOgorICAgICAgICAoYmYpOgorCiAyMDE2LTA0LTI5ICBZb2F2 IFdlaXNzICA8eW9hdkB5b2F2LndzPgogCiAgICAgICAgIE1vdmUgUmVzb3VyY2VUaW1pbmcgYmVo aW5kIGEgcnVudGltZSBmbGFnCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVu dGltZS9JbnRlcm5hbEZ1bmN0aW9uLmNwcCBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1l L0ludGVybmFsRnVuY3Rpb24uY3BwCmluZGV4IDIwMDc0M2NjMmYzNDVlYWM2ZWNlNTdkNDhiNDYy NGE3ZDgyNjEzOWEuLmEyMGE1NjMzYjM0YTZmMDU0NjhlZmQyZmUzMDY2N2YxYzVhZGZlMmYgMTAw NjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0ludGVybmFsRnVuY3Rpb24u Y3BwCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0ludGVybmFsRnVuY3Rpb24u Y3BwCkBAIC0xMTAsNyArMTEwLDggQEAgU3RydWN0dXJlKiBJbnRlcm5hbEZ1bmN0aW9uOjpjcmVh dGVTdWJjbGFzc1N0cnVjdHVyZShFeGVjU3RhdGUqIGV4ZWMsIEpTVmFsdWUgbmUKIAogICAgICAg ICAgICAgLy8gTm90ZSwgUmVmbGVjdC5jb25zdHJ1Y3QgbWlnaHQgY2F1c2UgdGhlIHByb2ZpbGUg dG8gY2h1cm4gYnV0IHdlIGRvbid0IGNhcmUuCiAgICAgICAgICAgICBKU09iamVjdCogcHJvdG90 eXBlID0ganNEeW5hbWljQ2FzdDxKU09iamVjdCo+KG5ld1RhcmdldC5nZXQoZXhlYywgZXhlYy0+ cHJvcGVydHlOYW1lcygpLnByb3RvdHlwZSkpOwotICAgICAgICAgICAgQVNTRVJUKCFleGVjLT5o YWRFeGNlcHRpb24oKSk7CisgICAgICAgICAgICBpZiAoZXhlYy0+aGFkRXhjZXB0aW9uKCkpCisg ICAgICAgICAgICAgICAgcmV0dXJuIG51bGxwdHI7CiAgICAgICAgICAgICBpZiAocHJvdG90eXBl KQogICAgICAgICAgICAgICAgIHJldHVybiB0YXJnZXRGdW5jdGlvbi0+cmFyZURhdGEodm0pLT5j cmVhdGVJbnRlcm5hbEZ1bmN0aW9uQWxsb2NhdGlvblN0cnVjdHVyZUZyb21CYXNlKHZtLCBwcm90 b3R5cGUsIGJhc2VDbGFzcyk7CiAgICAgICAgIH0gZWxzZSB7CmRpZmYgLS1naXQgYS9Tb3VyY2Uv SmF2YVNjcmlwdENvcmUvdGVzdHMvc3RyZXNzL2NyZWF0ZS1zdWJjbGFzcy1zdHJ1Y3R1cmUtbWF5 LXRocm93LWV4Y2VwdGlvbi13aGVuLWdldHRpbmctcHJvdG90eXBlLmpzIGIvU291cmNlL0phdmFT Y3JpcHRDb3JlL3Rlc3RzL3N0cmVzcy9jcmVhdGUtc3ViY2xhc3Mtc3RydWN0dXJlLW1heS10aHJv dy1leGNlcHRpb24td2hlbi1nZXR0aW5nLXByb3RvdHlwZS5qcwpuZXcgZmlsZSBtb2RlIDEwMDY0 NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi5mNzhkMWIz NzhjY2QxNTVlMjg3OTI1OGJhOWZjNWFiMThmMTE1NGI5Ci0tLSAvZGV2L251bGwKKysrIGIvU291 cmNlL0phdmFTY3JpcHRDb3JlL3Rlc3RzL3N0cmVzcy9jcmVhdGUtc3ViY2xhc3Mtc3RydWN0dXJl LW1heS10aHJvdy1leGNlcHRpb24td2hlbi1nZXR0aW5nLXByb3RvdHlwZS5qcwpAQCAtMCwwICsx LDQ0IEBACitmdW5jdGlvbiBzaG91bGRUaHJvdyhmdW5jLCBlcnJvck1lc3NhZ2UpIHsKKyAgICB2 YXIgZXJyb3JUaHJvd24gPSBmYWxzZTsKKyAgICB2YXIgZXJyb3IgPSBudWxsOworICAgIHRyeSB7 CisgICAgICAgIGZ1bmMoKTsKKyAgICB9IGNhdGNoIChlKSB7CisgICAgICAgIGVycm9yVGhyb3du ID0gdHJ1ZTsKKyAgICAgICAgZXJyb3IgPSBlOworICAgIH0KKyAgICBpZiAoIWVycm9yVGhyb3du KQorICAgICAgICB0aHJvdyBuZXcgRXJyb3IoJ25vdCB0aHJvd24nKTsKKyAgICBpZiAoU3RyaW5n KGVycm9yKSAhPT0gZXJyb3JNZXNzYWdlKQorICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYGJhZCBl cnJvcjogJHtTdHJpbmcoZXJyb3IpfWApOworfQorCit2YXIgYmYgPSAoZnVuY3Rpb24oKXt9KS5i aW5kKCk7CitPYmplY3QuZGVmaW5lUHJvcGVydHkoYmYsICJwcm90b3R5cGUiLCB7CisgICAgZ2V0 KCkgeyB0aHJvdyBFcnJvcigiT0siKSB9Cit9KTsKKworWworICAgIEFycmF5LAorICAgIERhdGUs CisgICAgQm9vbGVhbiwKKyAgICBGdW5jdGlvbiwKKyAgICBOdW1iZXIsCisgICAgU3RyaW5nLAor ICAgIFJlZ0V4cCwKKyAgICBFcnJvciwKKyAgICBVaW50OEFycmF5LAorICAgIEFycmF5QnVmZmVy LAorICAgIFByb21pc2UsCisgICAgTWFwLAorICAgIFdlYWtNYXAsCisgICAgU2V0LAorICAgIFdl YWtTZXQsCitdLmZvckVhY2goZnVuY3Rpb24gKGNvbnN0cnVjdG9yKSB7CisgICAgc2hvdWxkVGhy b3coKCkgPT4geworICAgICAgICBSZWZsZWN0LmNvbnN0cnVjdChjb25zdHJ1Y3RvciwgW10sIGJm KTsKKyAgICB9LCBgRXJyb3I6IE9LYCk7Cit9KTsKKworLy8gUHJveHkgY29uc3RydWN0b3IgaXMg bm90IGF3YXJlIG9mIG5ldy50YXJnZXQuCitSZWZsZWN0LmNvbnN0cnVjdChQcm94eSwgW3t9LCB7 fV0sIGJmKTsK