204971 2019-12-06 19:20:19 -0800 Object.prototype.isPrototypeOf() should check if the passed in value is a non-object first. 2019-12-07 14:58:25 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build PC Linux RESOLVED FIXED InRadar P2 Normal --- 1 yaohouyou mark.lam ews-watchlist fpizlo keith_miller mark.lam msaboff saam tzagallo webkit-bug-importer ysuzuki oldest_to_newest 1596481 0 yaohouyou 2019-12-06 19:20:19 -0800 According to the ES standard(From ES3 to ES 10), when the argument "thisArg" of Function.prototype.call(thisArg, ...args) is undefined or null, the argument "thisArg" should be replaced with the global object, and then Object.prototype.isPrototypeOf will called which return false. However, JSC throws TypeError. So I suspect it is a bug of javascriptCore. The references of ES10 are as follows: http://www.ecma-international.org/ecma-262/10.0/index.html#sec-function.prototype.call http://www.ecma-international.org/ecma-262/10.0/index.html#sec-object.prototype.isprototypeof Version:b96bf75 https://github.com/WebKit/webkit/commit/b96bf7590bc090fa8161cff1189255ca3319c94b Build steps: Tools/Scripts/build-webkit --debug --jsc-only -j Testcase: var NISLFuzzingFunc = function() { var a = Object.prototype.isPrototypeOf.call(null); print(a); }; NISLFuzzingFunc(); Execution steps: webkit/WebKitBuild/Debug/bin/jsc testcase.js Output: Exception: TypeError: null is not an object (evaluating 'Object.prototype.isPrototypeOf.call(null)') isPrototypeOf@[native code] NISLFuzzingFunc@testcase.js:2:48 global code@testcase.js:5:16 Expected output: flase 1596609 1 webkit-bug-importer 2019-12-07 13:18:50 -0800 <rdar://problem/57730080> 1596622 2 mark.lam 2019-12-07 13:54:04 -0800 Thanks for reporting this issue. Investigating now. 1596632 3 385107 mark.lam 2019-12-07 14:22:20 -0800 Created attachment 385107 proposed patch. 1596634 4 mark.lam 2019-12-07 14:58:25 -0800 Thanks for the review. Landed in r253264: <http://trac.webkit.org/r253264>. 385107 2019-12-07 14:22:20 -0800 2019-12-07 14:24:07 -0800 proposed patch. bug-204971.patch text/plain 3513 mark.lam SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyNTMyNjEpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDEzIEBACisyMDE5LTEyLTA3ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNv bT4KKworICAgICAgICBPYmplY3QucHJvdG90eXBlLmlzUHJvdG90eXBlT2YoKSBzaG91bGQgY2hl Y2sgaWYgdGhlIHBhc3NlZCBpbiB2YWx1ZSBpcyBhIG5vbi1vYmplY3QgZmlyc3QuCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMDQ5NzEKKyAgICAgICAg PHJkYXI6Ly9wcm9ibGVtLzU3NzMwMDgwPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo T09QUyEpLgorCisgICAgICAgICogc3RyZXNzL29iamVjdC1wcm90b3R5cGUtaXNQcm90b3R5cGVP Zi1zaG91bGQtY2hlY2stZm9yLW5vbi1vYmplY3QtZmlyc3QuanM6IEFkZGVkLgorCiAyMDE5LTEy LTA2ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KIAogICAgICAgICBUaGUgY29tcGls ZXIgdGhyZWFkIHNob3VsZCBub3QgYWRqdXN0IElkZW50aWZpZXIgcmVmQ291bnRzLgpJbmRleDog SlNUZXN0cy9zdHJlc3Mvb2JqZWN0LXByb3RvdHlwZS1pc1Byb3RvdHlwZU9mLXNob3VsZC1jaGVj ay1mb3Itbm9uLW9iamVjdC1maXJzdC5qcwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKU1Rlc3RzL3N0cmVzcy9v YmplY3QtcHJvdG90eXBlLWlzUHJvdG90eXBlT2Ytc2hvdWxkLWNoZWNrLWZvci1ub24tb2JqZWN0 LWZpcnN0LmpzCShub25leGlzdGVudCkKKysrIEpTVGVzdHMvc3RyZXNzL29iamVjdC1wcm90b3R5 cGUtaXNQcm90b3R5cGVPZi1zaG91bGQtY2hlY2stZm9yLW5vbi1vYmplY3QtZmlyc3QuanMJKHdv cmtpbmcgY29weSkKQEAgLTAsMCArMSwxNiBAQAorLy9AIHJ1bkRlZmF1bHQKKwordmFyIHJlc3Vs dDsKK3ZhciBleGNlcHRpb24gPSB1bmRlZmluZWQ7Cit0cnkgeworICAgIHJlc3VsdCA9IE9iamVj dC5wcm90b3R5cGUuaXNQcm90b3R5cGVPZi5jYWxsKG51bGwpOworfSBjYXRjaCAoZSkgeworICAg IGV4Y2VwdGlvbiA9IGU7Cit9CisKK2lmICh0eXBlb2YgZXhjZXB0aW9uICE9ICJ1bmRlZmluZWQi KQorICAgIHRocm93ICJGQUlMRUQiOworaWYgKHR5cGVvZiByZXN1bHQgIT0gImJvb2xlYW4iKQor ICAgIHRocm93ICJGQUlMRUQiOworaWYgKHJlc3VsdCAhPSBmYWxzZSkKKyAgICB0aHJvdyAiRkFJ TEVEIjsKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0gU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjUzMjU3KQorKysg U291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsx LDIzIEBACisyMDE5LTEyLTA3ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAg ICAgICBPYmplY3QucHJvdG90eXBlLmlzUHJvdG90eXBlT2YoKSBzaG91bGQgY2hlY2sgaWYgdGhl IHBhc3NlZCBpbiB2YWx1ZSBpcyBhIG5vbi1vYmplY3QgZmlyc3QuCisgICAgICAgIGh0dHBzOi8v YnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMDQ5NzEKKyAgICAgICAgPHJkYXI6Ly9w cm9ibGVtLzU3NzMwMDgwPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgor CisgICAgICAgIFRoZSBzcGVjIHNheXMgT2JqZWN0LnByb3RvdHlwZS5pc1Byb3RvdHlwZU9mKCkg c2hvdWxkIGRvIGNoZWNrcyBpbiB0aGUgZm9sbG93aW5nCisgICAgICAgIG9yZGVyOgorICAgICAg ICAxLiBJZiBUeXBlKFYpIGlzIG5vdCBPYmplY3QsIHJldHVybiBmYWxzZS4KKyAgICAgICAgMi4g TGV0IE8gYmUgPyBUb09iamVjdCh0aGlzIHZhbHVlKS4KKyAgICAgICAgLi4uCisgICAgICAgIFdl IHdlcmUgcHJldmlvdXNseSBjaGVja2luZyAoMikgYmVmb3JlICgxKS4gIFRoaXMgcGF0Y2ggZml4 ZXMgdGhpcyBvcmRlci4KKworICAgICAgICBSZWY6IGh0dHA6Ly93d3cuZWNtYS1pbnRlcm5hdGlv bmFsLm9yZy9lY21hLTI2Mi8xMC4wL2luZGV4Lmh0bWwjc2VjLW9iamVjdC5wcm90b3R5cGUuaXNw cm90b3R5cGVvZgorCisgICAgICAgICogcnVudGltZS9PYmplY3RQcm90b3R5cGUuY3BwOgorICAg ICAgICAoSlNDOjpvYmplY3RQcm90b0Z1bmNJc1Byb3RvdHlwZU9mKToKKwogMjAxOS0xMi0wNyAg TWFyayBMYW0gIDxtYXJrLmxhbUBhcHBsZS5jb20+CiAKICAgICAgICAgQnVpbGQgZml4IGZvcjog VGhlIGNvbXBpbGVyIHRocmVhZCBzaG91bGQgbm90IGFkanVzdCBJZGVudGlmaWVyIHJlZkNvdW50 cy4KSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL09iamVjdFByb3RvdHlwZS5j cHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvT2JqZWN0UHJv dG90eXBlLmNwcAkocmV2aXNpb24gMjUzMjU2KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL3J1 bnRpbWUvT2JqZWN0UHJvdG90eXBlLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMTIxLDE1ICsxMjEs MTUgQEAgRW5jb2RlZEpTVmFsdWUgSlNDX0hPU1RfQ0FMTCBvYmplY3RQcm90bwogICAgIFZNJiB2 bSA9IGdsb2JhbE9iamVjdC0+dm0oKTsKICAgICBhdXRvIHNjb3BlID0gREVDTEFSRV9USFJPV19T Q09QRSh2bSk7CiAKKyAgICBpZiAoIWNhbGxGcmFtZS0+YXJndW1lbnQoMCkuaXNPYmplY3QoKSkK KyAgICAgICAgcmV0dXJuIEpTVmFsdWU6OmVuY29kZShqc0Jvb2xlYW4oZmFsc2UpKTsKKwogICAg IEpTVmFsdWUgdGhpc1ZhbHVlID0gY2FsbEZyYW1lLT50aGlzVmFsdWUoKS50b1RoaXMoZ2xvYmFs T2JqZWN0LCBTdHJpY3RNb2RlKTsKICAgICBKU09iamVjdCogdGhpc09iaiA9IHRoaXNWYWx1ZS50 b09iamVjdChnbG9iYWxPYmplY3QpOwogICAgIEVYQ0VQVElPTl9BU1NFUlQoISFzY29wZS5leGNl cHRpb24oKSA9PSAhdGhpc09iaik7CiAgICAgaWYgKFVOTElLRUxZKCF0aGlzT2JqKSkKICAgICAg ICAgcmV0dXJuIGVuY29kZWRKU1ZhbHVlKCk7CiAKLSAgICBpZiAoIWNhbGxGcmFtZS0+YXJndW1l bnQoMCkuaXNPYmplY3QoKSkKLSAgICAgICAgcmV0dXJuIEpTVmFsdWU6OmVuY29kZShqc0Jvb2xl YW4oZmFsc2UpKTsKLQogICAgIEpTVmFsdWUgdiA9IGFzT2JqZWN0KGNhbGxGcmFtZS0+YXJndW1l bnQoMCkpLT5nZXRQcm90b3R5cGUodm0sIGdsb2JhbE9iamVjdCk7CiAgICAgUkVUVVJOX0lGX0VY Q0VQVElPTihzY29wZSwgZW5jb2RlZEpTVmFsdWUoKSk7CiAK