19834 2008-06-30 21:03:09 -0700 Failed assertion in JavaScriptCore/VM/SegmentedVector.h:82 2008-07-01 23:35:47 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 1 david.hansen ap ap ggaren oldest_to_newest 84817 0 david.hansen 2008-06-30 21:03:09 -0700 Just run this little test program: #include <stdlib.h> #include <JavaScriptCore/JavaScript.h> static JSValueRef jsGet_prop (JSContextRef jsCtx, JSObjectRef jsObj, JSStringRef jsName, JSValueRef* jsExn) { return JSValueMakeNumber (jsCtx, 42.0); } static bool jsSet_prop (JSContextRef jsCtx, JSObjectRef jsObj, JSStringRef jsName, JSValueRef jsVal, JSValueRef* jsExn) { return true; } static JSClassRef create_class (void) { static const JSStaticValue vals[] = { { "a", jsGet_prop, jsSet_prop, kJSPropertyAttributeDontDelete }, { NULL, NULL, NULL, 0 } }; JSClassDefinition cdef = kJSClassDefinitionEmpty; cdef.className = "FooObject"; cdef.staticValues = vals; return JSClassCreate (&cdef); } int main (void) { JSClassRef jsClass; JSGlobalContextRef jsCtx; JSStringRef jsScript; jsScript = JSStringCreateWithUTF8CString ("// blah blub!"); jsClass = create_class (); jsCtx = JSGlobalContextCreate (jsClass); /* Boom! */ JSEvaluateScript (jsCtx, jsScript, NULL, NULL, 0, NULL); return EXIT_SUCCESS; } /* Local Variables: compile-command: "gcc -g -ggdb -O0 -W -Wall \ `pkg-config --cflags --libs webkit-1.0` \ jseval.c -o jseval" End: */ $ ./jseval ASSERTION FAILED: index < m_size (JavaScriptCore/VM/SegmentedVector.h:82 T& KJS::SegmentedVector<T, SegmentSize>::operator[](size_t) [with T = KJS::RegisterID, unsigned int SegmentSize = 512u]) segmentation fault 84841 1 ap 2008-07-01 03:06:23 -0700 I'm seeing the assertion failure on Mac OS X, too. Not being a JavaScriptCore API expect, I'm not sure if this is a bug or expected behavior for this usage. 84843 2 ap 2008-07-01 03:23:23 -0700 Feels more like a bug though, confirming. 84868 3 david.hansen 2008-07-01 07:17:17 -0700 (In reply to comment #2) > Feels more like a bug though, confirming. > I should have added some more words... Was a bit tired. This is just the shortest test case I came up with. It doesn't depend on the implementation of the getter / setters. w/o assertions enabled it produces the weirdest things (I discovered this when I managed to define `undefined' to some function) but usually it just segfaults. Linking against electric fence (w/ disabled assertions) results in a seg fault in the hash table code. I suspect the symbol table of the global object is completely foobared. This started after updating from SVN yesterday, didn't happen before (about 1 week old version from svn). Hope this helps a bit to narrow it down. 84873 4 22030 ap 2008-07-01 07:53:18 -0700 Created attachment 22030 naive fix 84880 5 22030 darin 2008-07-01 08:20:49 -0700 Comment on attachment 22030 naive fix Why not use new [] and OwnArrayPtr for registerArray? Why not have JSVariableObjectData inherit from Noncopyable rather than reimplementing it? Seems OK, as-is. r=me 84883 6 ap 2008-07-01 08:28:51 -0700 (In reply to comment #5) > Why not have JSVariableObjectData inherit from Noncopyable rather than > reimplementing it? Confusingly, Noncopyable didn't work for me, I was getting a compiler error ('class WTFNoncopyable::Noncopyable' is inaccessible). I couldn't figure out why. 84907 7 22030 ggaren 2008-07-01 14:13:51 -0700 Comment on attachment 22030 naive fix This patch looks good to me, too. In the long term, though, we should just get rid of JSGlobalObject::reset -- we no longer need to support resetting a global object. 84951 8 ap 2008-07-01 23:35:47 -0700 Committed revision 34946 (changed registerArray to OwnArrayPtr). 22030 2008-07-01 07:53:18 -0700 2008-07-01 08:20:49 -0700 naive fix 19834r1_patch.txt text/plain 5754 ap SW5kZXg6IEphdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKYXZhU2NyaXB0 Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDM0OTE4KQorKysgSmF2YVNjcmlwdENvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMzAgQEAKKzIwMDgtMDctMDEgIEFsZXhleSBQ cm9za3VyeWFrb3YgIDxhcEB3ZWJraXQub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNn aT9pZD0xOTgzNAorICAgICAgICBGYWlsZWQgYXNzZXJ0aW9uIGluIEphdmFTY3JpcHRDb3JlL1ZN L1NlZ21lbnRlZFZlY3Rvci5oOjgyCisKKyAgICAgICAgQ3JlYXRpbmcgYSBnbG9iYWwgb2JqZWN0 IHdpdGggYSBjdXN0b20gcHJvdG90eXBlIHJlc2V0cyBpdCB0d2ljZSAod2FzdGVmdWwhKS4KKyAg ICAgICAgU28sIGFkZFN0YXRpY0dsb2JhbHMoKSB3YXMgY2FsbGVkIHR3aWNlLCBidXQgSlNHbG9i YWxPYmplY3Q6OnJlc2V0KCkgZGlkbid0IHJlc2V0CisgICAgICAgIHRoZSByZWdpc3RlciBhcnJh eS4gICAgICAgIAorCisgICAgICAgICoga2pzL0pTVmFyaWFibGVPYmplY3QuaDogU2luY2UgcmVn aXN0ZXJBcnJheSBpcyBhbGxvY2F0ZWQgd2l0aCBmYXN0TWFsbG9jLCBpdCBzaG91bGQKKyAgICAg ICAgYmUgZGVsZXRlZCB3aXRoIGZhc3RGcmVlLCBzbyBPd25QdHIgZGlkbid0IGZpdC4gQWxzbywg YWRkZWQgcHJpdmF0ZSBjb3B5IGNvbnN0cnVjdG9yIGFuZAorICAgICAgICBvcGVyYXRvcj0gdG8g ZW5zdXJlIHRoYXQgbm8gb25lIGF0dGVtcHRzIHRvIGNvcHkgdGhpcyBvYmplY3QgKGZvciB3aGF0 ZXZlciByZWFzb24sIEkKKyAgICAgICAgY291bGRuJ3QgbWFrZSBOb25jb3B5YWJsZSB3b3JrKS4K KworICAgICAgICAqIGtqcy9KU0dsb2JhbE9iamVjdC5jcHA6CisgICAgICAgIChLSlM6OkpTR2xv YmFsT2JqZWN0OjpyZXNldCk6IENhbGwgc2V0UmVnaXN0ZXJBcnJheSgwLCAwKS4KKyAgICAgICAg KEtKUzo6SlNHbG9iYWxPYmplY3Q6OmNvcHlHbG9iYWxzVG8pOiBVcGRhdGVkIGZvciByZWdpc3Rl ckFycmF5IG5vdCBiZWluZyBhbiBPd25QdHIuCisKKyAgICAgICAgKiBranMvSlNHbG9iYWxPYmpl Y3QuaDoKKyAgICAgICAgKEtKUzo6SlNHbG9iYWxPYmplY3Q6OmFkZFN0YXRpY0dsb2JhbHMpOgor ICAgICAgICAqIGtqcy9KU1ZhcmlhYmxlT2JqZWN0LmNwcDoKKyAgICAgICAgKEtKUzo6SlNWYXJp YWJsZU9iamVjdDo6bWFyayk6CisgICAgICAgIChLSlM6OkpTVmFyaWFibGVPYmplY3Q6OnNldFJl Z2lzdGVyQXJyYXkpOgorICAgICAgICBVcGRhdGVkIGZvciByZWdpc3RlckFycmF5IG5vdCBiZWlu ZyBhbiBPd25QdHIuCisKIDIwMDgtMDctMDEgIFNpbW9uIEhhdXNtYW5uICA8aGF1c21hbm5Ad2Vi a2l0Lm9yZz4KIAogICAgICAgICBCdWlsZCBmaXgsIGluY2x1ZGUgT3duUHRyLmguCkluZGV4OiBK YXZhU2NyaXB0Q29yZS9ranMvSlNHbG9iYWxPYmplY3QuY3BwCj09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEphdmFT Y3JpcHRDb3JlL2tqcy9KU0dsb2JhbE9iamVjdC5jcHAJKHJldmlzaW9uIDM0OTEzKQorKysgSmF2 YVNjcmlwdENvcmUva2pzL0pTR2xvYmFsT2JqZWN0LmNwcAkod29ya2luZyBjb3B5KQpAQCAtMTc0 LDYgKzE3NCw3IEBAIHZvaWQgSlNHbG9iYWxPYmplY3Q6OnJlc2V0KEpTVmFsdWUqIHByb3QKIAog ICAgIF9wcm9wLmNsZWFyKCk7CiAgICAgc3ltYm9sVGFibGUoKS5jbGVhcigpOworICAgIHNldFJl Z2lzdGVyQXJyYXkoMCwgMCk7CiAKICAgICAvLyBQcm90b3R5cGVzCiAgICAgZCgpLT5mdW5jdGlv blByb3RvdHlwZSA9IDA7CkBAIC00MTgsNyArNDE5LDcgQEAgdm9pZCBKU0dsb2JhbE9iamVjdDo6 Y29weUdsb2JhbHNUbyhSZWdpcwogICAgIHJlZ2lzdGVyRmlsZS5zZXROdW1HbG9iYWxzKHN5bWJv bFRhYmxlKCkuc2l6ZSgpKTsKIAogICAgIGlmIChkKCktPnJlZ2lzdGVyQXJyYXkpIHsKLSAgICAg ICAgbWVtY3B5KHJlZ2lzdGVyRmlsZS5iYXNlKCkgLSBkKCktPnJlZ2lzdGVyQXJyYXlTaXplLCBk KCktPnJlZ2lzdGVyQXJyYXkuZ2V0KCksIGQoKS0+cmVnaXN0ZXJBcnJheVNpemUgKiBzaXplb2Yo UmVnaXN0ZXIpKTsKKyAgICAgICAgbWVtY3B5KHJlZ2lzdGVyRmlsZS5iYXNlKCkgLSBkKCktPnJl Z2lzdGVyQXJyYXlTaXplLCBkKCktPnJlZ2lzdGVyQXJyYXksIGQoKS0+cmVnaXN0ZXJBcnJheVNp emUgKiBzaXplb2YoUmVnaXN0ZXIpKTsKICAgICAgICAgc2V0UmVnaXN0ZXJBcnJheSgwLCAwKTsK ICAgICB9CiAKSW5kZXg6IEphdmFTY3JpcHRDb3JlL2tqcy9KU0dsb2JhbE9iamVjdC5oCj09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT0KLS0tIEphdmFTY3JpcHRDb3JlL2tqcy9KU0dsb2JhbE9iamVjdC5oCShyZXZpc2lvbiAz NDkxMykKKysrIEphdmFTY3JpcHRDb3JlL2tqcy9KU0dsb2JhbE9iamVjdC5oCSh3b3JraW5nIGNv cHkpCkBAIC0yNjEsNyArMjYxLDcgQEAgbmFtZXNwYWNlIEtKUyB7CiAgICAgICAgIHNpemVfdCBy ZWdpc3RlckFycmF5U2l6ZSA9IGQoKS0+cmVnaXN0ZXJBcnJheVNpemU7CiAgICAgICAgIFJlZ2lz dGVyKiByZWdpc3RlckFycmF5ID0gc3RhdGljX2Nhc3Q8UmVnaXN0ZXIqPihmYXN0TWFsbG9jKChy ZWdpc3RlckFycmF5U2l6ZSArIGNvdW50KSAqIHNpemVvZihSZWdpc3RlcikpKTsKICAgICAgICAg aWYgKGQoKS0+cmVnaXN0ZXJBcnJheSkKLSAgICAgICAgICAgIG1lbWNweShyZWdpc3RlckFycmF5 ICsgY291bnQsIGQoKS0+cmVnaXN0ZXJBcnJheS5nZXQoKSwgcmVnaXN0ZXJBcnJheVNpemUgKiBz aXplb2YoUmVnaXN0ZXIpKTsKKyAgICAgICAgICAgIG1lbWNweShyZWdpc3RlckFycmF5ICsgY291 bnQsIGQoKS0+cmVnaXN0ZXJBcnJheSwgcmVnaXN0ZXJBcnJheVNpemUgKiBzaXplb2YoUmVnaXN0 ZXIpKTsKICAgICAgICAgc2V0UmVnaXN0ZXJBcnJheShyZWdpc3RlckFycmF5LCByZWdpc3RlckFy cmF5U2l6ZSArIGNvdW50KTsKIAogICAgICAgICBmb3IgKGludCBpID0gMCwgaW5kZXggPSAtcmVn aXN0ZXJBcnJheVNpemUgLSAxOyBpIDwgY291bnQ7ICsraSwgLS1pbmRleCkgewpJbmRleDogSmF2 YVNjcmlwdENvcmUva2pzL0pTVmFyaWFibGVPYmplY3QuY3BwCj09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEphdmFT Y3JpcHRDb3JlL2tqcy9KU1ZhcmlhYmxlT2JqZWN0LmNwcAkocmV2aXNpb24gMzQ5MTMpCisrKyBK YXZhU2NyaXB0Q29yZS9ranMvSlNWYXJpYWJsZU9iamVjdC5jcHAJKHdvcmtpbmcgY29weSkKQEAg LTcwLDggKzcwLDggQEAgdm9pZCBKU1ZhcmlhYmxlT2JqZWN0OjptYXJrKCkKICAgICBpZighZC0+ cmVnaXN0ZXJBcnJheSkKICAgICAgICAgcmV0dXJuOwogICAgIAotICAgIFJlZ2lzdGVyKiBlbmQg PSBkLT5yZWdpc3RlckFycmF5LmdldCgpICsgZC0+cmVnaXN0ZXJBcnJheVNpemU7Ci0gICAgZm9y IChSZWdpc3RlciogaXQgPSBkLT5yZWdpc3RlckFycmF5LmdldCgpOyBpdCAhPSBlbmQ7ICsraXQp IHsKKyAgICBSZWdpc3RlciogZW5kID0gZC0+cmVnaXN0ZXJBcnJheSArIGQtPnJlZ2lzdGVyQXJy YXlTaXplOworICAgIGZvciAoUmVnaXN0ZXIqIGl0ID0gZC0+cmVnaXN0ZXJBcnJheTsgaXQgIT0g ZW5kOyArK2l0KSB7CiAgICAgICAgIEpTVmFsdWUqIHYgPSAoKml0KS51LmpzVmFsdWU7CiAgICAg ICAgIGlmICghdi0+bWFya2VkKCkpCiAgICAgICAgICAgICB2LT5tYXJrKCk7CkBAIC05NSw3ICs5 NSw4IEBAIHZvaWQgSlNWYXJpYWJsZU9iamVjdDo6Y29weVJlZ2lzdGVyQXJyYXkKIAogdm9pZCBK U1ZhcmlhYmxlT2JqZWN0OjpzZXRSZWdpc3RlckFycmF5KFJlZ2lzdGVyKiByZWdpc3RlckFycmF5 LCBzaXplX3QgY291bnQpCiB7Ci0gICAgZC0+cmVnaXN0ZXJBcnJheS5zZXQocmVnaXN0ZXJBcnJh eSk7CisgICAgZmFzdEZyZWUoZC0+cmVnaXN0ZXJBcnJheSk7CisgICAgZC0+cmVnaXN0ZXJBcnJh eSA9IHJlZ2lzdGVyQXJyYXk7CiAgICAgZC0+cmVnaXN0ZXJBcnJheVNpemUgPSBjb3VudDsKICAg ICBkLT5yZWdpc3RlcnMgPSByZWdpc3RlckFycmF5ICsgY291bnQ7CiB9CkluZGV4OiBKYXZhU2Ny aXB0Q29yZS9ranMvSlNWYXJpYWJsZU9iamVjdC5oCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEphdmFTY3JpcHRD b3JlL2tqcy9KU1ZhcmlhYmxlT2JqZWN0LmgJKHJldmlzaW9uIDM0OTEzKQorKysgSmF2YVNjcmlw dENvcmUva2pzL0pTVmFyaWFibGVPYmplY3QuaAkod29ya2luZyBjb3B5KQpAQCAtNjUsMTUgKzY1 LDI1IEBAIG5hbWVzcGFjZSBLSlMgewogICAgICAgICAgICAgSlNWYXJpYWJsZU9iamVjdERhdGEo U3ltYm9sVGFibGUqIHN5bWJvbFRhYmxlXywgUmVnaXN0ZXIqIHJlZ2lzdGVyc18pCiAgICAgICAg ICAgICAgICAgOiBzeW1ib2xUYWJsZShzeW1ib2xUYWJsZV8pCiAgICAgICAgICAgICAgICAgLCBy ZWdpc3RlcnMocmVnaXN0ZXJzXykKKyAgICAgICAgICAgICAgICAsIHJlZ2lzdGVyQXJyYXkoMCkK ICAgICAgICAgICAgICAgICAsIHJlZ2lzdGVyQXJyYXlTaXplKDApCiAgICAgICAgICAgICB7CiAg ICAgICAgICAgICAgICAgQVNTRVJUKHN5bWJvbFRhYmxlXyk7CiAgICAgICAgICAgICB9Ci0gICAg ICAgICAgICAKKworICAgICAgICAgICAgfkpTVmFyaWFibGVPYmplY3REYXRhKCkKKyAgICAgICAg ICAgIHsKKyAgICAgICAgICAgICAgICBmYXN0RnJlZShyZWdpc3RlckFycmF5KTsKKyAgICAgICAg ICAgIH0KKwogICAgICAgICAgICAgU3ltYm9sVGFibGUqIHN5bWJvbFRhYmxlOyAvLyBNYXBzIG5h bWUgLT4gb2Zmc2V0IGZyb20gInIiIGluIHJlZ2lzdGVyIGZpbGUuCiAgICAgICAgICAgICBSZWdp c3RlciogcmVnaXN0ZXJzOyAvLyBQb2ludGVycyB0byB0aGUgcmVnaXN0ZXIgcGFzdCB0aGUgZW5k IG9mIGxvY2FsIHN0b3JhZ2UuIChMb2NhbCBzdG9yYWdlIGluZGV4ZXMgYXJlIG5lZ2F0aXZlLikK LSAgICAgICAgICAgIE93blB0cjxSZWdpc3Rlcj4gcmVnaXN0ZXJBcnJheTsgLy8gSW5kZXBlbmRl bnQgY29weSBvZiByZWdpc3RlcnMsIHVzZWQgd2hlbiBhIHZhcmlhYmxlIG9iamVjdCBjb3BpZXMg aXRzIHJlZ2lzdGVycyBvdXQgb2YgdGhlIHJlZ2lzdGVyIGZpbGUuCisgICAgICAgICAgICBSZWdp c3RlciogcmVnaXN0ZXJBcnJheTsgLy8gSW5kZXBlbmRlbnQgY29weSBvZiByZWdpc3RlcnMsIHVz ZWQgd2hlbiBhIHZhcmlhYmxlIG9iamVjdCBjb3BpZXMgaXRzIHJlZ2lzdGVycyBvdXQgb2YgdGhl IHJlZ2lzdGVyIGZpbGUuCiAgICAgICAgICAgICBzaXplX3QgcmVnaXN0ZXJBcnJheVNpemU7CisK KyAgICAgICAgcHJpdmF0ZToKKyAgICAgICAgICAgIEpTVmFyaWFibGVPYmplY3REYXRhKGNvbnN0 IEpTVmFyaWFibGVPYmplY3REYXRhJik7CisgICAgICAgICAgICBKU1ZhcmlhYmxlT2JqZWN0RGF0 YSYgb3BlcmF0b3I9KGNvbnN0IEpTVmFyaWFibGVPYmplY3REYXRhJik7CiAgICAgICAgIH07CiAK ICAgICAgICAgSlNWYXJpYWJsZU9iamVjdChKU1ZhcmlhYmxlT2JqZWN0RGF0YSogZGF0YSkK