212399 2020-05-26 20:41:07 -0700 in_structure_property needs to handle constants on the RHS of the "in" 2020-06-01 16:50:41 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Mac macOS 10.15 RESOLVED FIXED InRadar P2 Normal --- 1 myoki.crystal keith_miller ews-watchlist keith_miller mark.lam msaboff saam tzagallo webkit-bot-watchers-bugzilla webkit-bug-importer oldest_to_newest 1656280 0 myoki.crystal 2020-05-26 20:41:07 -0700 The bug is in object iterator, really simple. Some type check must happen if the iterator can use `in` or not. In this case, the index (string d) can not use `in` function. I know `1337` is not an Object, but it still crash in some way. I am really new to JavaScriptCore and do not understand the design pattern fully, but I hope my POC can help. Thanks. POC: ``` const v0 = {d:13.37}; for (const v1 in v0) { print(typeof(v1), v1); print(typeof(v0[v1]), v0[v1]); const v2 = v1 in 1337; } ``` LOG: ``` string d number 13.37 ASSERTION FAILED: !reg.isConstant() ../../Source/JavaScriptCore/interpreter/CallFrameInlines.h(44) : JSC::Register &JSC::CallFrame::uncheckedR(JSC::VirtualRegister) 1 0x114a6b8d9 WTFCrash 2 0x104896590 WTF::BasicRawSentinelNode<Worker, WTF::DumbPtrTraits<Worker> >::remove() 3 0x1113625a3 JSC::CallFrame::uncheckedR(JSC::VirtualRegister) 4 0x1134d367e slow_path_in_structure_property 5 0x10f6b2e02 llint_entry 6 0x10f69bf32 vmEntryToJavaScript 7 0x112ab449b JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) 8 0x112ab1fa3 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*) 9 0x11351c4da JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 10 0x104975534 runWithOptions(GlobalObject*, CommandLine&, bool&) 11 0x1048f7174 jscmain(int, char**)::$_4::operator()(JSC::VM&, GlobalObject*, bool&) const 12 0x10489b6fe int runJSC<jscmain(int, char**)::$_4>(CommandLine const&, bool, jscmain(int, char**)::$_4 const&) 13 0x1048981ae jscmain(int, char**) 14 0x104897c8e main 15 0x7fff72122cc9 start 16 0xc ``` Steps to Reproduce: 1) Build Relaese with ASAN: ./Tools/Scripts/set-webkit-configuration --asan ./Tools/Scripts/build-webkit --jsc-only --release 2) Run JSC with JS file Actual Results: JSC crashes with log like above Expected Results: JSC should not crash (or raise Type Error because 1337 is not an Object) Build Date & Hardware: commit@751ec07c691376353670d0913d09a85d490395cd (Date: Wed May 27 02:42:14 2020 +0000) 1656299 1 webkit-bug-importer 2020-05-26 23:38:50 -0700 <rdar://problem/63662913> 1656384 2 400340 keith_miller 2020-05-27 09:15:12 -0700 Created attachment 400340 Patch 1656385 3 400340 saam 2020-05-27 09:17:57 -0700 Comment on attachment 400340 Patch nice & thanks r=me 1656386 4 400340 mark.lam 2020-05-27 09:18:37 -0700 Comment on attachment 400340 Patch r=me too 1656389 5 keith_miller 2020-05-27 09:28:56 -0700 Committed r262197: <https://trac.webkit.org/changeset/262197> 1656519 6 ryanhaddad 2020-05-27 12:44:01 -0700 (In reply to Keith Miller from comment #5) > Committed r262197: <https://trac.webkit.org/changeset/262197> JSC EWS showed 18 new failures, which are now appearing on the trunk bot: https://build.webkit.org/builders/Apple-Catalina-Release-JSC-Tests/builds/2209/steps/jscore-test/logs/stdio 1656526 7 400340 saam 2020-05-27 13:00:44 -0700 Comment on attachment 400340 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=400340&action=review > JSTests/stress/for-in-in-structure-property-constant-virtual-register.js:4 > +const v0 = {d:13.37}; > +for (const v1 in v0) { > + const v2 = v1 in 1337; > +} You need to wrap this in try/catch I believe 1658112 8 ryanhaddad 2020-06-01 16:50:41 -0700 (In reply to Ryan Haddad from comment #6) > (In reply to Keith Miller from comment #5) > > Committed r262197: <https://trac.webkit.org/changeset/262197> > JSC EWS showed 18 new failures, which are now appearing on the trunk bot: > https://build.webkit.org/builders/Apple-Catalina-Release-JSC-Tests/builds/ > 2209/steps/jscore-test/logs/stdio Keith fixed this in https://trac.webkit.org/changeset/262210/webkit 400340 2020-05-27 09:15:12 -0700 2020-05-27 09:17:57 -0700 Patch bug-212399-20200527091512.patch text/plain 2637 keith_miller U3VidmVyc2lvbiBSZXZpc2lvbjogMjYyMTY4CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCBh ZDJlODIyZDViYTZmNmJmMGMyYzg4ZTBjNWM4NzdjNzM1MjM3NTZjLi45NjMwNzY4MTU4YzEzNmY4 NGFjZDZmMDEwZDM0ZDM1YWM1ZDM4Mjc4IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxMyBAQAorMjAyMC0wNS0yNyAgS2VpdGggTWlsbGVyICA8a2VpdGhfbWlsbGVyQGFwcGxl LmNvbT4KKworICAgICAgICBpbl9zdHJ1Y3R1cmVfcHJvcGVydHkgbmVlZHMgdG8gaGFuZGxlIGNv bnN0YW50cyBvbiB0aGUgUkhTIG9mIHRoZSAiaW4iCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMTIzOTkKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP RFkgKE9PUFMhKS4KKworICAgICAgICAqIHJ1bnRpbWUvQ29tbW9uU2xvd1BhdGhzLmNwcDoKKyAg ICAgICAgKEpTQzo6U0xPV19QQVRIX0RFQ0wpOgorCiAyMDIwLTA1LTI2ICBNYXJrIExhbSAgPG1h cmsubGFtQGFwcGxlLmNvbT4KIAogICAgICAgICBBZGQgc29tZSBuZXcgZW1pdHRlcnMgdG8gdGhl IFg4Nl82NCBhbmQgQVJNNjQgTWFjcm9Bc3NlbWJsZXJzLgpkaWZmIC0tZ2l0IGEvU291cmNlL0ph dmFTY3JpcHRDb3JlL3J1bnRpbWUvQ29tbW9uU2xvd1BhdGhzLmNwcCBiL1NvdXJjZS9KYXZhU2Ny aXB0Q29yZS9ydW50aW1lL0NvbW1vblNsb3dQYXRocy5jcHAKaW5kZXggMmQ5MzQ1NWU3OTRmYTBh ZTc0ZWQxZmVjMTgyZTNlYWU5ZTBmOWQ2Ni4uMGY3N2E4MTgzYmVhMzZkYWJkYzYyMzEzMTYyNmEz MDYxODkzMGM3ZSAxMDA2NDQKLS0tIGEvU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvQ29t bW9uU2xvd1BhdGhzLmNwcAorKysgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9Db21t b25TbG93UGF0aHMuY3BwCkBAIC0xMDY3LDcgKzEwNjcsNyBAQCBTTE9XX1BBVEhfREVDTChzbG93 X3BhdGhfaW5fc3RydWN0dXJlX3Byb3BlcnR5KQogewogICAgIEJFR0lOKCk7CiAgICAgYXV0byBi eXRlY29kZSA9IHBjLT5hczxPcEluU3RydWN0dXJlUHJvcGVydHk+KCk7Ci0gICAgSlNWYWx1ZSBi YXNlID0gR0VUKGJ5dGVjb2RlLm1fYmFzZSkuanNWYWx1ZSgpOworICAgIEpTVmFsdWUgYmFzZSA9 IEdFVF9DKGJ5dGVjb2RlLm1fYmFzZSkuanNWYWx1ZSgpOwogI2lmIFVTRShKU1ZBTFVFMzJfNjQp CiAgICAgSlNQcm9wZXJ0eU5hbWVFbnVtZXJhdG9yKiBlbnVtZXJhdG9yID0ganNDYXN0PEpTUHJv cGVydHlOYW1lRW51bWVyYXRvcio+KEdFVChieXRlY29kZS5tX2VudW1lcmF0b3IpLmpzVmFsdWUo KS5hc0NlbGwoKSk7CiAgICAgaWYgKGJhc2UuaXNDZWxsKCkgJiYgYmFzZS5hc0NlbGwoKS0+c3Ry dWN0dXJlKHZtKS0+aWQoKSA9PSBlbnVtZXJhdG9yLT5jYWNoZWRTdHJ1Y3R1cmVJRCgpKQpkaWZm IC0tZ2l0IGEvSlNUZXN0cy9DaGFuZ2VMb2cgYi9KU1Rlc3RzL0NoYW5nZUxvZwppbmRleCAwMDQz ODM3MTg1MzRjZWZmZjNjY2M3NzkzM2IwOTgwYjAxZjRmYWJkLi44NGFhMTY4ZjIwZGIzZmQ5ZThl OTUyZmJhOGVjODU1NTc0ZTBjOTVjIDEwMDY0NAotLS0gYS9KU1Rlc3RzL0NoYW5nZUxvZworKysg Yi9KU1Rlc3RzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDEyIEBACisyMDIwLTA1LTI3ICBLZWl0aCBN aWxsZXIgIDxrZWl0aF9taWxsZXJAYXBwbGUuY29tPgorCisgICAgICAgIGluX3N0cnVjdHVyZV9w cm9wZXJ0eSBuZWVkcyB0byBoYW5kbGUgY29uc3RhbnRzIG9uIHRoZSBSSFMgb2YgdGhlICJpbiIK KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIxMjM5OQor CisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogc3RyZXNz L2Zvci1pbi1pbi1zdHJ1Y3R1cmUtcHJvcGVydHktY29uc3RhbnQtdmlydHVhbC1yZWdpc3Rlci5q czogQWRkZWQuCisKIDIwMjAtMDUtMjYgIEFsZXhleSBTaHZheWthICA8c2h2YWlrYWxlc2hAZ21h aWwuY29tPgogCiAgICAgICAgIEl0ZXJhdG9yQ2xvc2Ugc2hvdWxkIHN1cHByZXNzIEdldE1ldGhv ZCBlcnJvcnMKZGlmZiAtLWdpdCBhL0pTVGVzdHMvc3RyZXNzL2Zvci1pbi1pbi1zdHJ1Y3R1cmUt cHJvcGVydHktY29uc3RhbnQtdmlydHVhbC1yZWdpc3Rlci5qcyBiL0pTVGVzdHMvc3RyZXNzL2Zv ci1pbi1pbi1zdHJ1Y3R1cmUtcHJvcGVydHktY29uc3RhbnQtdmlydHVhbC1yZWdpc3Rlci5qcwpu ZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwLi5iNTNiMThjYTUwOTljYTMxNmQ2NzI1YjVjYTM2NDExYTViY2NiZjFjCi0tLSAv ZGV2L251bGwKKysrIGIvSlNUZXN0cy9zdHJlc3MvZm9yLWluLWluLXN0cnVjdHVyZS1wcm9wZXJ0 eS1jb25zdGFudC12aXJ0dWFsLXJlZ2lzdGVyLmpzCkBAIC0wLDAgKzEsNCBAQAorY29uc3QgdjAg PSB7ZDoxMy4zN307Citmb3IgKGNvbnN0IHYxIGluIHYwKSB7CisgICAgICAgIGNvbnN0IHYyID0g djEgaW4gMTMzNzsKK30K