225094 2021-04-27 01:39:16 -0700 Don't pass DontBuildStrings to next token after parsing an empty parameter list 2022-09-26 14:16:35 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build All All RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=245657 InRadar P2 Normal --- 1 zhunkibatu saam ashvayka ews-watchlist fpizlo keith_miller mark.lam msaboff saam tzagallo webkit-bug-importer ysuzuki oldest_to_newest 1754528 0 427128 zhunkibatu 2021-04-27 01:39:16 -0700 Created attachment 427128 the minimal poc the following poc can crash latest jsc. function main() { class a { g = [].toString() 'a'() { } } function gen() { let it = a(); } let g = gen(); } main(); 1754795 1 ap 2021-04-27 14:52:15 -0700 I reproduce the crash with just the first four lines of the test: function main() { class a { g = [].toString() 'a'() Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x00000001b7a51f00 JSC::SyntaxChecker::ClassExpression JSC::Parser<JSC::Lexer<unsigned char> >::parseClass<JSC::SyntaxChecker>(JSC::SyntaxChecker&, JSC::FunctionNameRequirements, JSC::ParserClassInfo<JSC::SyntaxChecker>&) + 3208 1 com.apple.JavaScriptCore 0x00000001b7a51c94 JSC::SyntaxChecker::ClassExpression JSC::Parser<JSC::Lexer<unsigned char> >::parseClass<JSC::SyntaxChecker>(JSC::SyntaxChecker&, JSC::FunctionNameRequirements, JSC::ParserClassInfo<JSC::SyntaxChecker>&) + 2588 2 com.apple.JavaScriptCore 0x00000001b7a4e778 JSC::SyntaxChecker::Statement JSC::Parser<JSC::Lexer<unsigned char> >::parseClassDeclaration<JSC::SyntaxChecker>(JSC::SyntaxChecker&, JSC::Parser<JSC::Lexer<unsigned char> >::ExportType, JSC::DeclarationDefaultContext) + 248 3 com.apple.JavaScriptCore 0x00000001b7a4d5a8 JSC::SyntaxChecker::Statement JSC::Parser<JSC::Lexer<unsigned char> >::parseStatementListItem<JSC::SyntaxChecker>(JSC::SyntaxChecker&, JSC::Identifier const*&, unsigned int*) + 752 4 com.apple.JavaScriptCore 0x00000001b7a4ce7c JSC::SyntaxChecker::SourceElements JSC::Parser<JSC::Lexer<unsigned char> >::parseSourceElements<JSC::SyntaxChecker>(JSC::SyntaxChecker&, JSC::SourceElementsMode) + 148 5 com.apple.JavaScriptCore 0x00000001b7a408f4 bool JSC::Parser<JSC::Lexer<unsigned char> >::parseFunctionInfo<JSC::ASTBuilder>(JSC::ASTBuilder&, JSC::FunctionNameRequirements, JSC::SourceParseMode, bool, JSC::ConstructorKind, JSC::SuperBinding, int, JSC::ParserFunctionInfo<JSC::ASTBuilder>&, JSC::Parser<JSC::Lexer<unsigned char> >::FunctionDefinitionType, WTF::Optional<int>) + 6040 6 com.apple.JavaScriptCore 0x00000001b7a6ea5c JSC::ASTBuilder::Statement JSC::Parser<JSC::Lexer<unsigned char> >::parseFunctionDeclaration<JSC::ASTBuilder>(JSC::ASTBuilder&, JSC::Parser<JSC::Lexer<unsigned char> >::FunctionDeclarationType, JSC::Parser<JSC::Lexer<unsigned char> >::ExportType, JSC::DeclarationDefaultContext, WTF::Optional<int>) + 460 7 com.apple.JavaScriptCore 0x00000001b7a6dcd4 JSC::ASTBuilder::Statement JSC::Parser<JSC::Lexer<unsigned char> >::parseStatementListItem<JSC::ASTBuilder>(JSC::ASTBuilder&, JSC::Identifier const*&, unsigned int*) + 788 8 com.apple.JavaScriptCore 0x00000001b7a229d0 JSC::ASTBuilder::SourceElements JSC::Parser<JSC::Lexer<unsigned char> >::parseSourceElements<JSC::ASTBuilder>(JSC::ASTBuilder&, JSC::SourceElementsMode) + 204 9 com.apple.JavaScriptCore 0x00000001b7a1d5c4 JSC::Parser<JSC::Lexer<unsigned char> >::parseInner(JSC::Identifier const&, JSC::SourceParseMode, JSC::ParsingContext, WTF::Optional<int>, WTF::Vector<JSC::JSTextPosition, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const*) + 1008 10 com.apple.JavaScriptCore 0x00000001b738fc7c std::__1::unique_ptr<JSC::ProgramNode, std::__1::default_delete<JSC::ProgramNode> > JSC::Parser<JSC::Lexer<unsigned char> >::parse<JSC::ProgramNode>(JSC::ParserError&, JSC::Identifier const&, JSC::SourceParseMode, JSC::ParsingContext, WTF::Optional<int>, JSC::VariableEnvironment const*, WTF::Vector<JSC::JSTextPosition, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const*) + 140 11 com.apple.JavaScriptCore 0x00000001b7b47c80 std::__1::unique_ptr<JSC::ProgramNode, std::__1::default_delete<JSC::ProgramNode> > JSC::parse<JSC::ProgramNode>(JSC::VM&, JSC::SourceCode const&, JSC::Identifier const&, JSC::JSParserBuiltinMode, JSC::JSParserStrictMode, JSC::JSParserScriptMode, JSC::SourceParseMode, JSC::SuperBinding, JSC::ParserError&, JSC::JSTextPosition*, JSC::ConstructorKind, JSC::DerivedContextType, JSC::EvalContextType, JSC::DebuggerParseData*, JSC::VariableEnvironment const*, WTF::Vector<JSC::JSTextPosition, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const*, bool) + 304 12 com.apple.JavaScriptCore 0x00000001b7b41a94 JSC::checkSyntax(JSC::VM&, JSC::SourceCode const&, JSC::ParserError&) + 156 1754796 2 webkit-bug-importer 2021-04-27 14:52:32 -0700 <rdar://problem/77231778> 1800814 3 440283 saam 2021-10-05 15:44:36 -0700 Created attachment 440283 Patch 1800825 4 440283 ysuzuki 2021-10-05 16:00:00 -0700 Comment on attachment 440283 Patch r=me 1800948 5 ews-feeder 2021-10-05 22:20:14 -0700 Committed r283600 (242552@main): <https://commits.webkit.org/242552@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 440283. 427128 2021-04-27 01:39:16 -0700 2021-04-27 01:39:16 -0700 the minimal poc poc.js text/javascript 183 zhunkibatu ZnVuY3Rpb24gbWFpbigpIHsKICAgIGNsYXNzIGEgewogICAgICAgIGcgPSBbXS50b1N0cmluZygp CiAgICAgICAgJ2EnKCkKICAgICAgICB7CiAgICAgICAgfQogICAgfQoKICAgIGZ1bmN0aW9uIGdl bigpCiAgICB7CiAgICAgICAgbGV0IGl0ID0gYSgpOwogICAgfQoKICAgIGxldCBnID0gZ2VuKCk7 Cn0KCm1haW4oKTsK 440283 2021-10-05 15:44:36 -0700 2021-10-05 22:20:15 -0700 Patch c-backup.diff text/plain 2663 saam SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyODM1ODEpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDE2IEBACisyMDIxLTEwLTA1ICBTYWFtIEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUu Y29tPgorCisgICAgICAgIERvbid0IHBhc3MgRG9udEJ1aWxkU3RyaW5ncyB0byBuZXh0IHRva2Vu IGFmdGVyIHBhcnNpbmcgYW4gZW1wdHkgcGFyYW1ldGVyIGxpc3QKKyAgICAgICAgaHR0cHM6Ly9i dWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyNTA5NAorICAgICAgICA8cmRhcjovL3By b2JsZW0vNzcyMzE3Nzg+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisK KyAgICAgICAgKiBzdHJlc3MvZG9udC1wYXNzLURvbnRCdWlsZFN0cmluZ3Mtd2hlbi1idWlsZGlu Zy1lbXB0eS1hcmd1bWVudHMtbGlzdC5qczogQWRkZWQuCisgICAgICAgIChtYWluLmEucHJvdG90 eXBlLmcudG9TdHJpbmcuc3RyaW5nX2FwcGVhcmVkX2hlcmUpOgorICAgICAgICAobWFpbi5hKToK KyAgICAgICAgKG1haW4pOgorCiAyMDIxLTEwLTA1ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxl LmNvbT4KIAogICAgICAgICBDb2RlQmxvY2sgc2hvdWxkIG5vdCBhZGQvcmVtb3ZlIExvb3BIaW50 RXhlY3V0aW9uQ291bnRlcnMuCkluZGV4OiBKU1Rlc3RzL3N0cmVzcy9kb250LXBhc3MtRG9udEJ1 aWxkU3RyaW5ncy13aGVuLWJ1aWxkaW5nLWVtcHR5LWFyZ3VtZW50cy1saXN0LmpzCj09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT0KLS0tIEpTVGVzdHMvc3RyZXNzL2RvbnQtcGFzcy1Eb250QnVpbGRTdHJpbmdzLXdoZW4tYnVp bGRpbmctZW1wdHktYXJndW1lbnRzLWxpc3QuanMJKG5vbmV4aXN0ZW50KQorKysgSlNUZXN0cy9z dHJlc3MvZG9udC1wYXNzLURvbnRCdWlsZFN0cmluZ3Mtd2hlbi1idWlsZGluZy1lbXB0eS1hcmd1 bWVudHMtbGlzdC5qcwkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDcgQEAKKy8vIFRoaXMgc2hv dWxkIG5vdCBjcmFzaCB0aGUgcGFyc2VyLgorZnVuY3Rpb24gbWFpbigpIHsKKyAgICBjbGFzcyBh IHsKKyAgICAgICAgZyA9IFtdLnRvU3RyaW5nKCkKKyAgICAgICAgJ2EnKCl7fQorICAgIH0KK30K SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjgzNTY5KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBA CisyMDIxLTEwLTA1ICBTYWFtIEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUuY29tPgorCisgICAgICAg IERvbid0IHBhc3MgRG9udEJ1aWxkU3RyaW5ncyB0byBuZXh0IHRva2VuIGFmdGVyIHBhcnNpbmcg YW4gZW1wdHkgcGFyYW1ldGVyIGxpc3QKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTIyNTA5NAorICAgICAgICA8cmRhcjovL3Byb2JsZW0vNzcyMzE3Nzg+ CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgV2UgbWln aHQgbmVlZCB0aGUgc3RyaW5nLCBpdCB0dXJucyBvdXQhCisKKyAgICAgICAgKiBwYXJzZXIvUGFy c2VyLmNwcDoKKyAgICAgICAgKEpTQzo6UGFyc2VyPExleGVyVHlwZT46OnBhcnNlQXJndW1lbnRz KToKKwogMjAyMS0xMC0wNSAgTWFyayBMYW0gIDxtYXJrLmxhbUBhcHBsZS5jb20+CiAKICAgICAg ICAgQ29kZUJsb2NrIHNob3VsZCBub3QgYWRkL3JlbW92ZSBMb29wSGludEV4ZWN1dGlvbkNvdW50 ZXJzLgpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL3BhcnNlci9QYXJzZXIuY3BwCj09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9wYXJzZXIvUGFyc2VyLmNwcAkocmV2aXNp b24gMjgzNTY5KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL3BhcnNlci9QYXJzZXIuY3BwCSh3 b3JraW5nIGNvcHkpCkBAIC00OTgwLDcgKzQ5ODAsNyBAQCB0ZW1wbGF0ZSA8Y2xhc3MgVHJlZUJ1 aWxkZXI+IFRyZWVBcmd1bWVuCiAgICAgY29uc3VtZU9yRmFpbFdpdGhGbGFncyhPUEVOUEFSRU4s IFRyZWVCdWlsZGVyOjpEb250QnVpbGRTdHJpbmdzLCAiRXhwZWN0ZWQgb3BlbmluZyAnKCcgYXQg c3RhcnQgb2YgYXJndW1lbnQgbGlzdCIpOwogICAgIEpTVG9rZW5Mb2NhdGlvbiBsb2NhdGlvbih0 b2tlbkxvY2F0aW9uKCkpOwogICAgIGlmIChtYXRjaChDTE9TRVBBUkVOKSkgewotICAgICAgICBu ZXh0KFRyZWVCdWlsZGVyOjpEb250QnVpbGRTdHJpbmdzKTsKKyAgICAgICAgbmV4dCgpOwogICAg ICAgICByZXR1cm4gY29udGV4dC5jcmVhdGVBcmd1bWVudHMoKTsKICAgICB9CiAgICAgYXV0byBh cmd1bWVudHNTdGFydCA9IG1fdG9rZW4ubV9zdGFydFBvc2l0aW9uOwo=