216103 2020-09-02 15:42:45 -0700 ASSERTION FAILED: value.isCell() && value.asCell()->type() == CustomGetterSetterType ./bytecode/ObjectPropertyConditionSet.cpp 2022-02-27 23:28:30 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 msaboff msaboff ews-watchlist keith_miller mark.lam saam tzagallo webkit-bug-importer oldest_to_newest 1685031 0 msaboff 2020-09-02 15:42:45 -0700 This debug ASSERT happens in the case where we replace a custom getter setter property with a function. The ASSERT can be reworked to an if statement to fix the issue. Backtrace: ASSERTION FAILED: value.isCell() && value.asCell()->type() == CustomGetterSetterType ./bytecode/ObjectPropertyConditionSet.cpp(403) : auto JSC::generateConditionsForPrototypePropertyHitCustom(JSC::VM &, JSC::JSCell *, JSC::JSGlobalObject *, JSC::Structure *, JSC::JSObject *, WTF::UniquedStringImpl *, unsigned int)::(anonymous class)::operator()(Vector<JSC::ObjectPropertyCondition> &, JSC::JSObject *) const 1 0x1141ea34c WTFCrash 2 0x114731684 WTFCrashWithInfo(int, char const*, char const*, int) 3 0x114c6b244 JSC::generateConditionsForPrototypePropertyHitCustom(JSC::VM&, JSC::JSCell*, JSC::JSGlobalObject*, JSC::Structure*, JSC::JSObject*, WTF::UniquedStringImpl*, unsigned int)::$_5::operator()(WTF::Vector<JSC::ObjectPropertyCondition, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, JSC::JSObject*) const 4 0x114c5ed00 JSC::ObjectPropertyConditionSet JSC::(anonymous namespace)::generateConditions<JSC::generateConditionsForPrototypePropertyHitCustom(JSC::VM&, JSC::JSCell*, JSC::JSGlobalObject*, JSC::Structure*, JSC::JSObject*, WTF::UniquedStringImpl*, unsigned int)::$_5>(JSC::VM&, JSC::JSGlobalObject*, JSC::Structure*, JSC::JSObject*, JSC::generateConditionsForPrototypePropertyHitCustom(JSC::VM&, JSC::JSCell*, JSC::JSGlobalObject*, JSC::Structure*, JSC::JSObject*, WTF::UniquedStringImpl*, unsigned int)::$_5 const&) 5 0x114c5ebdc JSC::generateConditionsForPrototypePropertyHitCustom(JSC::VM&, JSC::JSCell*, JSC::JSGlobalObject*, JSC::Structure*, JSC::JSObject*, WTF::UniquedStringImpl*, unsigned int) 6 0x115623908 JSC::tryCachePutByID(JSC::JSGlobalObject*, JSC::CodeBlock*, JSC::JSValue, JSC::Structure*, JSC::CacheableIdentifier, JSC::PutPropertySlot const&, JSC::StructureStubInfo&, JSC::PutKind) 7 0x115622bf8 JSC::repatchPutByID(JSC::JSGlobalObject*, JSC::CodeBlock*, JSC::JSValue, JSC::Structure*, JSC::CacheableIdentifier, JSC::PutPropertySlot const&, JSC::StructureStubInfo&, JSC::PutKind) 8 0x11558b65c operationPutByIdNonStrictOptimize 9 0xb80140a6c 10 0x114715a48 llint_entry 11 0x114715a48 llint_entry 12 0x114715a48 llint_entry 13 0x114715c84 llint_entry 14 0x114715a48 llint_entry 15 0x114715a48 llint_entry 16 0x114715a48 llint_entry 17 0x114715a48 llint_entry 18 0x114715a48 llint_entry 19 0x114715a48 llint_entry 20 0x1146f0274 vmEntryToJavaScript 21 0x115bcf06c JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) 22 0x1154d7438 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*) 23 0x1158b9ad8 JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 24 0x1158b9c14 JSC::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 25 0x11d86b414 WebCore::JSExecState::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 26 0x11d86af70 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) 27 0x11d86ad9c WebCore::ScriptController::evaluateInWorldIgnoringException(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) 28 0x11d86b85c WebCore::ScriptController::evaluateIgnoringException(WebCore::ScriptSourceCode const&) 29 0x11df9b5ac WebCore::ScriptElement::executeClassicScript(WebCore::ScriptSourceCode const&) 30 0x11def55c0 WebCore::LoadableClassicScript::execute(WebCore::ScriptElement&) 31 0x11df9c32c WebCore::ScriptElement::executeScriptAndDispatchEvent(WebCore::LoadableScript&) 1685032 1 msaboff 2020-09-02 15:43:05 -0700 <rdar://problem/66651057> 1685039 2 407824 msaboff 2020-09-02 15:52:40 -0700 Created attachment 407824 Patch 1685053 3 407824 saam 2020-09-02 16:21:45 -0700 Comment on attachment 407824 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=407824&action=review > Source/JavaScriptCore/ChangeLog:8 > + Changed the ASSERT to an if statement. you should say why 1685066 4 msaboff 2020-09-02 16:58:09 -0700 Committed r266496: <https://trac.webkit.org/changeset/266496> 407824 2020-09-02 15:52:40 -0700 2022-02-27 23:28:30 -0800 Patch 216103.patch text/plain 5009 msaboff SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyNjY0OTIpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDE2IEBACisyMDIwLTA5LTAyICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBw bGUuY29tPgorCisgICAgICAgIEFTU0VSVElPTiBGQUlMRUQ6IHZhbHVlLmlzQ2VsbCgpICYmIHZh bHVlLmFzQ2VsbCgpLT50eXBlKCkgPT0gQ3VzdG9tR2V0dGVyU2V0dGVyVHlwZSAuL2J5dGVjb2Rl L09iamVjdFByb3BlcnR5Q29uZGl0aW9uU2V0LmNwcAorICAgICAgICBodHRwczovL2J1Z3Mud2Vi a2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjE2MTAzCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9C T0RZIChPT1BTISkuCisKKyAgICAgICAgTmV3IHRlc2V0LgorCisgICAgICAgICogc3RyZXNzL2N1 c3RvbS1nZXQtc2V0LW92ZXJyaWRlLmpzOiBBZGRlZC4KKyAgICAgICAgKG92ZXJyaWRlRnVuY3Rp b24uby5jdXN0b21GdW5jdGlvbik6CisgICAgICAgIChvdmVycmlkZUZ1bmN0aW9uKToKKwogMjAy MC0wOS0wMiAgQ2FpbyBMaW1hICA8dGljYWlvbGltYUBnbWFpbC5jb20+CiAKICAgICAgICAgW0FS TXY3XSBTa2lwIHN0cmVzcy9pbnRsLXNlZ21lbnRlci5qcwpJbmRleDogSlNUZXN0cy9zdHJlc3Mv Y3VzdG9tLWdldC1zZXQtb3ZlcnJpZGUuanMKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gSlNUZXN0cy9zdHJlc3Mv Y3VzdG9tLWdldC1zZXQtb3ZlcnJpZGUuanMJKG5vbmV4aXN0ZW50KQorKysgSlNUZXN0cy9zdHJl c3MvY3VzdG9tLWdldC1zZXQtb3ZlcnJpZGUuanMJKHdvcmtpbmcgY29weSkKQEAgLTAsMCArMSwx OCBAQAorLy8gVmVyaWZ5IHRoYXQgY2hhbmdpbmcgYSBjdXN0b20gc2V0dGVyIHRvIGEgRnVuY3Rp b24gZG9lc24ndCBjYXVzZSBhbnkgaXNzdWVzLgorCitmdW5jdGlvbiBvdmVycmlkZUZ1bmN0aW9u KCkgeworICAgIGxldCBvID0ge307CisgICAgbGV0IGN1c3RvbVRoaW5neSA9ICR2bS5jcmVhdGVD dXN0b21UZXN0R2V0dGVyU2V0dGVyKCk7CisgICAgby5fX3Byb3RvX18gPSBjdXN0b21UaGluZ3k7 CisKKyAgICBvLmN1c3RvbUZ1bmN0aW9uID0gZnVuY3Rpb24oKSB7CisgICAgICAgIE9iamVjdC5k ZWZpbmVQcm9wZXJ0eShjdXN0b21UaGluZ3ksICJjdXN0b21GdW5jdGlvbiIsIHsKKyAgICAgICAg ICAgIHZhbHVlOiA0MgorICAgICAgICB9KTsKKyAgICB9OworfQorbm9JbmxpbmUob3ZlcnJpZGVG dW5jdGlvbik7CisKK2ZvciAobGV0IGkgPSAwOyBpIDwgMTAwMDsgKytpKSB7CisgICAgb3ZlcnJp ZGVGdW5jdGlvbigpOworfQpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwo9 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCShyZXZpc2lvbiAy NjY0OTIpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkp CkBAIC0xLDMgKzEsMTYgQEAKKzIwMjAtMDktMDIgIE1pY2hhZWwgU2Fib2ZmICA8bXNhYm9mZkBh cHBsZS5jb20+CisKKyAgICAgICAgQVNTRVJUSU9OIEZBSUxFRDogdmFsdWUuaXNDZWxsKCkgJiYg dmFsdWUuYXNDZWxsKCktPnR5cGUoKSA9PSBDdXN0b21HZXR0ZXJTZXR0ZXJUeXBlIC4vYnl0ZWNv ZGUvT2JqZWN0UHJvcGVydHlDb25kaXRpb25TZXQuY3BwCisgICAgICAgIGh0dHBzOi8vYnVncy53 ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMTYxMDMKKworICAgICAgICBSZXZpZXdlZCBieSBO T0JPRFkgKE9PUFMhKS4KKworICAgICAgICBDaGFuZ2VkIHRoZSBBU1NFUlQgdG8gYW4gaWYgc3Rh dGVtZW50LgorCisgICAgICAgICogYnl0ZWNvZGUvT2JqZWN0UHJvcGVydHlDb25kaXRpb25TZXQu Y3BwOgorICAgICAgICAoSlNDOjpnZW5lcmF0ZUNvbmRpdGlvbnNGb3JQcm90b3R5cGVQcm9wZXJ0 eUhpdEN1c3RvbSk6CisgICAgICAgICogdG9vbHMvSlNEb2xsYXJWTS5jcHA6IEFkZGVkIHRlc3Qg aGVscGVyIGZ1bmN0aW9uLgorCiAyMDIwLTA5LTAxICBZdXN1a2UgU3V6dWtpICA8eXN1enVraUBh cHBsZS5jb20+CiAKICAgICAgICAgU2tpcCBmYXN0L2Nzcy1jdXN0b20tcGFpbnQvb3V0LW9mLW1l bW9yeS13aGlsZS1hZGRpbmctd29ya2xldC1tb2R1bGUuaHRtbCBpZiBHaWdhY2FnZSBpcyBub3Qg ZW5hYmxlZApJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2J5dGVjb2RlL09iamVjdFByb3Bl cnR5Q29uZGl0aW9uU2V0LmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUv Ynl0ZWNvZGUvT2JqZWN0UHJvcGVydHlDb25kaXRpb25TZXQuY3BwCShyZXZpc2lvbiAyNjY0OTIp CisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvZGUvT2JqZWN0UHJvcGVydHlDb25kaXRp b25TZXQuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC00MDAsNyArNDAwLDEwIEBAIE9iamVjdFByb3Bl cnR5Q29uZGl0aW9uU2V0IGdlbmVyYXRlQ29uZGkKICAgICAgICAgICAgICAgICAgICAgLy8gbm90 aWNlcyBhIGN1c3RvbSwgaXQgbXVzdCBiZSBhIEN1c3RvbUdldHRlclNldHRlclR5cGUgY2VsbCBv ciBzb21ldGhpbmcKICAgICAgICAgICAgICAgICAgICAgLy8gaW4gdGhlIHN0YXRpYyBwcm9wZXJ0 eSB0YWJsZS4gQ3VzdG9tIHZhbHVlcyBnZXQgcmVpZmllZCBpbnRvIEN1c3RvbUdldHRlclNldHRl cnMuCiAgICAgICAgICAgICAgICAgICAgIEpTVmFsdWUgdmFsdWUgPSBvYmplY3QtPmdldERpcmVj dChvZmZzZXQpOwotICAgICAgICAgICAgICAgICAgICBBU1NFUlRfVU5VU0VEKHZhbHVlLCB2YWx1 ZS5pc0NlbGwoKSAmJiB2YWx1ZS5hc0NlbGwoKS0+dHlwZSgpID09IEN1c3RvbUdldHRlclNldHRl clR5cGUpOworCisgICAgICAgICAgICAgICAgICAgIGlmICghdmFsdWUuaXNDZWxsKCkgfHwgdmFs dWUuYXNDZWxsKCktPnR5cGUoKSAhPSBDdXN0b21HZXR0ZXJTZXR0ZXJUeXBlKQorICAgICAgICAg ICAgICAgICAgICAgICAgcmV0dXJuIGZhbHNlOworCiAgICAgICAgICAgICAgICAgICAgIGtpbmQg PSBQcm9wZXJ0eUNvbmRpdGlvbjo6RXF1aXZhbGVuY2U7CiAgICAgICAgICAgICAgICAgfSBlbHNl IGlmIChzdHJ1Y3R1cmUtPmZpbmRQcm9wZXJ0eUhhc2hFbnRyeSh1aWQpKQogICAgICAgICAgICAg ICAgICAgICBraW5kID0gUHJvcGVydHlDb25kaXRpb246OkN1c3RvbUZ1bmN0aW9uRXF1aXZhbGVu Y2U7CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvdG9vbHMvSlNEb2xsYXJWTS5jcHAKPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL3Rvb2xzL0pTRG9sbGFyVk0uY3BwCShy ZXZpc2lvbiAyNjY0OTIpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvdG9vbHMvSlNEb2xsYXJW TS5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTE0ODUsNiArMTQ4NSwyMyBAQCBzdGF0aWMgYm9vbCBj dXN0b21TZXRWYWx1ZShKU0dsb2JhbE9iamVjCiAgICAgcmV0dXJuIHRydWU7CiB9CiAKK3N0YXRp YyBib29sIGN1c3RvbUZ1bmN0aW9uU2V0dGVyKEpTR2xvYmFsT2JqZWN0KiBnbG9iYWxPYmplY3Qs IEVuY29kZWRKU1ZhbHVlLCBFbmNvZGVkSlNWYWx1ZSBlbmNvZGVkVmFsdWUpCit7CisgICAgRG9s bGFyVk1Bc3NlcnRTY29wZSBhc3NlcnRTY29wZTsKKyAgICBWTSYgdm0gPSBnbG9iYWxPYmplY3Qt PnZtKCk7CisKKyAgICBKU1ZhbHVlIHZhbHVlID0gSlNWYWx1ZTo6ZGVjb2RlKGVuY29kZWRWYWx1 ZSk7CisgICAgSlNGdW5jdGlvbiogZnVuY3Rpb24gPSBqc0R5bmFtaWNDYXN0PEpTRnVuY3Rpb24q Pih2bSwgdmFsdWUpOworICAgIGlmICghZnVuY3Rpb24pCisgICAgICAgIHJldHVybiBmYWxzZTsK KworICAgIGF1dG8gY2FsbERhdGEgPSBnZXRDYWxsRGF0YSh2bSwgZnVuY3Rpb24pOworICAgIE1h cmtlZEFyZ3VtZW50QnVmZmVyIGFyZ3M7CisgICAgY2FsbChnbG9iYWxPYmplY3QsIGZ1bmN0aW9u LCBjYWxsRGF0YSwganNVbmRlZmluZWQoKSwgYXJncyk7CisKKyAgICByZXR1cm4gdHJ1ZTsKK30K Kwogdm9pZCBKU1Rlc3RDdXN0b21HZXR0ZXJTZXR0ZXI6OmZpbmlzaENyZWF0aW9uKFZNJiB2bSkK IHsKICAgICBEb2xsYXJWTUFzc2VydFNjb3BlIGFzc2VydFNjb3BlOwpAQCAtMTQ5OSw2ICsxNTE2 LDkgQEAgdm9pZCBKU1Rlc3RDdXN0b21HZXR0ZXJTZXR0ZXI6OmZpbmlzaENyZQogICAgIHB1dERp cmVjdEN1c3RvbUFjY2Vzc29yKHZtLCBJZGVudGlmaWVyOjpmcm9tU3RyaW5nKHZtLCAiY3VzdG9t QWNjZXNzb3JHbG9iYWxPYmplY3QiKSwKICAgICAgICAgQ3VzdG9tR2V0dGVyU2V0dGVyOjpjcmVh dGUodm0sIGN1c3RvbUdldEFjY2Vzc29yR2xvYmFsT2JqZWN0LCBudWxscHRyKSwgc3RhdGljX2Nh c3Q8dW5zaWduZWQ+KFByb3BlcnR5QXR0cmlidXRlOjpDdXN0b21BY2Nlc3NvcikpOwogCisgICAg cHV0RGlyZWN0Q3VzdG9tQWNjZXNzb3Iodm0sIElkZW50aWZpZXI6OmZyb21TdHJpbmcodm0sICJj dXN0b21GdW5jdGlvbiIpLAorICAgICAgICBDdXN0b21HZXR0ZXJTZXR0ZXI6OmNyZWF0ZSh2bSwg Y3VzdG9tR2V0QWNjZXNzb3IsIGN1c3RvbUZ1bmN0aW9uU2V0dGVyKSwgc3RhdGljX2Nhc3Q8dW5z aWduZWQ+KFByb3BlcnR5QXR0cmlidXRlOjpDdXN0b21BY2Nlc3NvcikpOworCiB9CiAKIGNvbnN0 IENsYXNzSW5mbyBFbGVtZW50OjpzX2luZm8gPSB7ICJFbGVtZW50IiwgJkJhc2U6OnNfaW5mbywg bnVsbHB0ciwgbnVsbHB0ciwgQ1JFQVRFX01FVEhPRF9UQUJMRShFbGVtZW50KSB9Owo=