25785 2009-05-14 02:46:23 -0700 Segfault in mark when using JSObjectMakeConstructor 2009-05-14 04:15:02 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) PC Linux RESOLVED FIXED HasReduction P2 Normal --- 1 racarr webkit-unassigned mrowe oldest_to_newest 121239 0 racarr 2009-05-14 02:46:23 -0700 Making two constructors of a class with JSObjectMakeConstructor, setting them on an object, and then creating/releasing a context, reliably produces a segfault in GC Mark with r43686 on Linux. Not setting either of the constructs on the object, OR passing NULL as the class argument to JSObjectMakeConstructor prevents the segfault from happening. Attached is a test case which triggers the segfault. 121240 1 30321 racarr 2009-05-14 02:47:16 -0700 Created attachment 30321 Test case 121244 2 mrowe 2009-05-14 02:50:16 -0700 This also crashes on i386 Mac OS X. 121248 3 30326 mrowe 2009-05-14 03:06:47 -0700 Created attachment 30326 Further reduction I hit the following assertion in a debug build: 0x000bb760 in JSC::JSObject::putDirect (this=0x4a1260, propertyName=@0x5047e8, value={m_ptr = 0x0}, attributes=14, checkReadOnly=false, slot=@0xbffff6e0) at JSObject.h:389 389 ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this)); This attached file is all that is necessary to reproduce the assertion failure, which is likely to be the root cause of this crash during GC. 121250 4 30327 mrowe 2009-05-14 03:45:35 -0700 Created attachment 30327 Patch 121256 5 mrowe 2009-05-14 04:15:02 -0700 Fixed in r43692. 30321 2009-05-14 02:47:16 -0700 2009-05-14 02:47:16 -0700 Test case jscore-segfault.c text/plain 2527 racarr I2luY2x1ZGUgPEphdmFTY3JpcHRDb3JlL0phdmFTY3JpcHQuaD4KI2luY2x1ZGUgPHN0ZGlvLmg+ CiNpbmNsdWRlIDxzdGRsaWIuaD4KCkpTQ29udGV4dEdyb3VwUmVmIGdyb3VwOwpKU0NvbnRleHRS ZWYgY3R4OwoKSlNDbGFzc1JlZiBmb29fY2xhc3M7CkpTQ2xhc3NSZWYgYmF6X2NsYXNzOwoKSlNP YmplY3RSZWYgZm9vX2NvbnN0cnVjdG9yOwpKU09iamVjdFJlZiBiYXpfY29uc3RydWN0b3I7CgpK U09iamVjdFJlZiBiYXI7CgpKU0NvbnRleHRSZWYgY3R4MjsKCkpTQ2xhc3NEZWZpbml0aW9uIGZv b19kZWYgPSB7CiAgICAwLAkJCQkvKiBWZXJzaW9uLCBhbHdheXMgMCAqLwogICAgMCwKICAgICJm b28iLAkJLyogQ2xhc3MgTmFtZSAqLwogICAgTlVMTCwJCQkJLyogUGFyZW50IENsYXNzICovCiAg ICBOVUxMLAkJCQkvKiBTdGF0aWMgVmFsdWVzICovCiAgICBOVUxMLAkJCQkvKiBTdGF0aWMgRnVu Y3Rpb25zICovCiAgICBOVUxMLAogICAgTlVMTCwJCQkJLyogRmluYWxpemUgKi8KICAgIE5VTEws CQkJCS8qIEhhcyBQcm9wZXJ0eSAqLwogICAgTlVMTCwJCQkJLyogR2V0IFByb3BlcnR5ICovCiAg ICBOVUxMLAkJCQkvKiBTZXQgUHJvcGVydHkgKi8KICAgIE5VTEwsCQkJCS8qIERlbGV0ZSBQcm9w ZXJ0eSAqLwogICAgTlVMTCwJCQkJLyogR2V0IFByb3BlcnR5IE5hbWVzICovCiAgICBOVUxMLAkJ CQkvKiBDYWxsIEFzIEZ1bmN0aW9uICovCiAgICBOVUxMLAogICAgTlVMTCwJCQkJLyogSGFzIElu c3RhbmNlICovCiAgICBOVUxMCQkJCS8qIENvbnZlcnQgVG8gVHlwZSAqLwp9OwoKSlNDbGFzc0Rl ZmluaXRpb24gYmF6X2RlZiA9IHsKICAgIDAsCQkJCS8qIFZlcnNpb24sIGFsd2F5cyAwICovCiAg ICAwLAogICAgImJheiIsCQkvKiBDbGFzcyBOYW1lICovCiAgICBOVUxMLAkJCQkvKiBQYXJlbnQg Q2xhc3MgKi8KICAgIE5VTEwsCQkJCS8qIFN0YXRpYyBWYWx1ZXMgKi8KICAgIE5VTEwsCQkJCS8q IFN0YXRpYyBGdW5jdGlvbnMgKi8KICAgIE5VTEwsCiAgICBOVUxMLAkJCQkvKiBGaW5hbGl6ZSAq LwogICAgTlVMTCwJCQkJLyogSGFzIFByb3BlcnR5ICovCiAgICBOVUxMLAkJCQkvKiBHZXQgUHJv cGVydHkgKi8KICAgIE5VTEwsCQkJCS8qIFNldCBQcm9wZXJ0eSAqLwogICAgTlVMTCwJCQkJLyog RGVsZXRlIFByb3BlcnR5ICovCiAgICBOVUxMLAkJCQkvKiBHZXQgUHJvcGVydHkgTmFtZXMgKi8K ICAgIE5VTEwsCQkJCS8qIENhbGwgQXMgRnVuY3Rpb24gKi8KICAgIE5VTEwsCiAgICBOVUxMLAkJ CQkvKiBIYXMgSW5zdGFuY2UgKi8KICAgIE5VTEwJCQkJLyogQ29udmVydCBUbyBUeXBlICovCn07 Cgp2b2lkCmNvbnN0cnVjdF9mb28gKHZvaWQpCnsKfQoKdm9pZApjb25zdHJ1Y3RfYmF6ICh2b2lk KQp7Cn0KCnZvaWQKb2JqZWN0X3NldF9wcm9wZXJ0eSAoSlNDb250ZXh0UmVmIGN0eCwgSlNPYmpl Y3RSZWYgb2JqZWN0LAoJCSAgICAgY29uc3QgY2hhciAqIG5hbWUsIEpTVmFsdWVSZWYgdmFsdWUp CnsKICBKU1N0cmluZ1JlZiBqbmFtZSA9IEpTU3RyaW5nQ3JlYXRlV2l0aFVURjhDU3RyaW5nIChu YW1lKTsKICBKU1ZhbHVlUmVmIGV4Y2VwdGlvbiA9IE5VTEw7CgogIGlmICh2YWx1ZSkKICAgIHsK ICAgICAgSlNPYmplY3RTZXRQcm9wZXJ0eSAoY3R4LCBvYmplY3QsIGpuYW1lLCB2YWx1ZSwgMCwg JmV4Y2VwdGlvbik7CiAgICB9CgogIEpTU3RyaW5nUmVsZWFzZSAoam5hbWUpOwp9CgppbnQgbWFp biAoaW50IGFyZ2MsIGNoYXIgKiphcmd2KQp7CiAgZ3JvdXAgPSBKU0NvbnRleHRHcm91cENyZWF0 ZSAoKTsKICBjdHggPSBKU0dsb2JhbENvbnRleHRDcmVhdGVJbkdyb3VwIChncm91cCwgTlVMTCk7 CiAgCiAgYmFyID0gSlNPYmplY3RNYWtlIChjdHgsIE5VTEwsIE5VTEwpOwogIAogIGZvb19jbGFz cyA9IEpTQ2xhc3NDcmVhdGUoJmZvb19kZWYpOwogIGJhel9jbGFzcyA9IEpTQ2xhc3NDcmVhdGUo JmJhel9kZWYpOwogIAogIGZvb19jb25zdHJ1Y3RvciA9IEpTT2JqZWN0TWFrZUNvbnN0cnVjdG9y IChjdHgsIGZvb19jbGFzcywgY29uc3RydWN0X2Zvbyk7CiAgYmF6X2NvbnN0cnVjdG9yID0gSlNP YmplY3RNYWtlQ29uc3RydWN0b3IgKGN0eCwgYmF6X2NsYXNzLCBjb25zdHJ1Y3RfYmF6KTsKICAv LyBVc2luZyB0aGlzIGluc3RlYWQgcHJldmVudHMgc2VnZmF1bHQuCiAgLy9mb29fY29uc3RydWN0 b3IgPSBKU09iamVjdE1ha2VDb25zdHJ1Y3RvciAoY3R4LCBOVUxMLCBjb25zdHJ1Y3RfZm9vKTsK ICAvL2Jhel9jb25zdHJ1Y3RvciA9IEpTT2JqZWN0TWFrZUNvbnN0cnVjdG9yIChjdHgsIE5VTEws IGNvbnN0cnVjdF9iYXopOwogIAogIG9iamVjdF9zZXRfcHJvcGVydHkgKGN0eCwgYmFyLCAiRm9v IiwgZm9vX2NvbnN0cnVjdG9yKTsKICBvYmplY3Rfc2V0X3Byb3BlcnR5IChjdHgsIGJhciwgIkJh eiIsIGJhel9jb25zdHJ1Y3Rvcik7CiAgCiAgY3R4MiA9IEpTR2xvYmFsQ29udGV4dENyZWF0ZUlu R3JvdXAgKGdyb3VwLCBOVUxMKTsKICBKU0dsb2JhbENvbnRleHRSZWxlYXNlICgoSlNHbG9iYWxD b250ZXh0UmVmKWN0eDIpOwp9Cg== 30326 2009-05-14 03:06:47 -0700 2009-05-14 03:06:47 -0700 Further reduction bug-25785.c application/octet-stream 260 mrowe I2luY2x1ZGUgPEphdmFTY3JpcHRDb3JlL0phdmFTY3JpcHQuaD4KCmludCBtYWluIChpbnQgYXJn YywgY2hhciAqKmFyZ3YpCnsKICBKU0dsb2JhbENvbnRleHRSZWYgY3R4ID0gSlNHbG9iYWxDb250 ZXh0Q3JlYXRlKDApOwogIEpTQ2xhc3NSZWYgY2xhc3MgPSBKU0NsYXNzQ3JlYXRlKCZrSlNDbGFz c0RlZmluaXRpb25FbXB0eSk7CiAgSlNPYmplY3RSZWYgY29uc3RydWN0b3IgPSBKU09iamVjdE1h a2VDb25zdHJ1Y3RvcihjdHgsIGNsYXNzLCAwKTsKfQo= 30327 2009-05-14 03:45:35 -0700 2009-05-14 03:46:50 -0700 Patch bug-25785-v2.patch text/plain 3614 mrowe ZGlmZiAtLWdpdCBhL0phdmFTY3JpcHRDb3JlL0FQSS9KU09iamVjdFJlZi5jcHAgYi9KYXZhU2Ny aXB0Q29yZS9BUEkvSlNPYmplY3RSZWYuY3BwCmluZGV4IGU4MWU1MTIuLjkxNTUwOTYgMTAwNjQ0 Ci0tLSBhL0phdmFTY3JpcHRDb3JlL0FQSS9KU09iamVjdFJlZi5jcHAKKysrIGIvSmF2YVNjcmlw dENvcmUvQVBJL0pTT2JqZWN0UmVmLmNwcApAQCAtMTA1LDEwICsxMDUsMTAgQEAgSlNPYmplY3RS ZWYgSlNPYmplY3RNYWtlQ29uc3RydWN0b3IoSlNDb250ZXh0UmVmIGN0eCwgSlNDbGFzc1JlZiBq c0NsYXNzLCBKU09iamUKICAgICBleGVjLT5nbG9iYWxEYXRhKCkuaGVhcC5yZWdpc3RlclRocmVh ZCgpOwogICAgIEpTTG9jayBsb2NrKGV4ZWMpOwogCi0gICAgSlNWYWx1ZVB0ciBqc1Byb3RvdHlw ZSA9IGpzQ2xhc3MgCi0gICAgICAgID8ganNDbGFzcy0+cHJvdG90eXBlKGV4ZWMpCi0gICAgICAg IDogZXhlYy0+bGV4aWNhbEdsb2JhbE9iamVjdCgpLT5vYmplY3RQcm90b3R5cGUoKTsKLSAgICAK KyAgICBKU1ZhbHVlUHRyIGpzUHJvdG90eXBlID0ganNDbGFzcyA/IGpzQ2xhc3MtPnByb3RvdHlw ZShleGVjKSA6IDA7CisgICAgaWYgKCFqc1Byb3RvdHlwZSkKKyAgICAgICAganNQcm90b3R5cGUg PSBleGVjLT5sZXhpY2FsR2xvYmFsT2JqZWN0KCktPm9iamVjdFByb3RvdHlwZSgpOworCiAgICAg SlNDYWxsYmFja0NvbnN0cnVjdG9yKiBjb25zdHJ1Y3RvciA9IG5ldyAoZXhlYykgSlNDYWxsYmFj a0NvbnN0cnVjdG9yKGV4ZWMtPmxleGljYWxHbG9iYWxPYmplY3QoKS0+Y2FsbGJhY2tDb25zdHJ1 Y3RvclN0cnVjdHVyZSgpLCBqc0NsYXNzLCBjYWxsQXNDb25zdHJ1Y3Rvcik7CiAgICAgY29uc3Ry dWN0b3ItPnB1dERpcmVjdChleGVjLT5wcm9wZXJ0eU5hbWVzKCkucHJvdG90eXBlLCBqc1Byb3Rv dHlwZSwgRG9udEVudW0gfCBEb250RGVsZXRlIHwgUmVhZE9ubHkpOwogICAgIHJldHVybiB0b1Jl Zihjb25zdHJ1Y3Rvcik7CmRpZmYgLS1naXQgYS9KYXZhU2NyaXB0Q29yZS9BUEkvdGVzdHMvdGVz dGFwaS5jIGIvSmF2YVNjcmlwdENvcmUvQVBJL3Rlc3RzL3Rlc3RhcGkuYwppbmRleCA0OGM4NTgz Li5kZDc5NWFiIDEwMDY0NAotLS0gYS9KYXZhU2NyaXB0Q29yZS9BUEkvdGVzdHMvdGVzdGFwaS5j CisrKyBiL0phdmFTY3JpcHRDb3JlL0FQSS90ZXN0cy90ZXN0YXBpLmMKQEAgLTk1Myw2ICs5NTMs MTMgQEAgaW50IG1haW4oaW50IGFyZ2MsIGNoYXIqIGFyZ3ZbXSkKICAgICBBU1NFUlQoSlNWYWx1 ZUlzRXF1YWwoY29udGV4dCwgdiwgbywgTlVMTCkpOwogICAgIEpTU3RyaW5nUmVsZWFzZShzY3Jp cHQpOwogCisgICAgLy8gVmVyaWZ5IHRoYXQgY3JlYXRpbmcgYSBjb25zdHJ1Y3RvciBmb3IgYSBj bGFzcyB3aXRoIG5vIHN0YXRpYyBmdW5jdGlvbnMgZG9lcyBub3QgdHJpZ2dlcgorICAgIC8vIGFu IGFzc2VydCBpbnNpZGUgcHV0RGlyZWN0IG9yIGxlYWQgdG8gYSBjcmFzaCBkdXJpbmcgR0MuIDxo dHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjU3ODU+CisgICAgbnVsbERl ZmluaXRpb24gPSBrSlNDbGFzc0RlZmluaXRpb25FbXB0eTsKKyAgICBudWxsQ2xhc3MgPSBKU0Ns YXNzQ3JlYXRlKCZudWxsRGVmaW5pdGlvbik7CisgICAgbXlDb25zdHJ1Y3RvciA9IEpTT2JqZWN0 TWFrZUNvbnN0cnVjdG9yKGNvbnRleHQsIG51bGxDbGFzcywgMCk7CisgICAgSlNDbGFzc1JlbGVh c2UobnVsbENsYXNzKTsKKwogICAgIGNoYXIqIHNjcmlwdFVURjggPSBjcmVhdGVTdHJpbmdXaXRo Q29udGVudHNPZkZpbGUoc2NyaXB0UGF0aCk7CiAgICAgaWYgKCFzY3JpcHRVVEY4KQogICAgICAg ICBwcmludGYoIkZBSUw6IFRlc3Qgc2NyaXB0IGNvdWxkIG5vdCBiZSBsb2FkZWQuXG4iKTsKQEAg LTk3OCw2ICs5ODUsNyBAQCBpbnQgbWFpbihpbnQgYXJnYywgY2hhciogYXJndltdKQogICAgIHYg PSBOVUxMOwogICAgIG8gPSBOVUxMOwogICAgIGdsb2JhbE9iamVjdCA9IE5VTEw7CisgICAgbXlD b25zdHJ1Y3RvciA9IE5VTEw7CiAKICAgICBKU1N0cmluZ1JlbGVhc2UoanNFbXB0eUlTdHJpbmcp OwogICAgIEpTU3RyaW5nUmVsZWFzZShqc09uZUlTdHJpbmcpOwpkaWZmIC0tZ2l0IGEvSmF2YVNj cmlwdENvcmUvQ2hhbmdlTG9nIGIvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCmluZGV4IGEzMWQ2 ZWYuLmZlMzUyMzUgMTAwNjQ0Ci0tLSBhL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZworKysgYi9K YXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxOCBAQAorMjAwOS0wNS0xNCAgTWFy ayBSb3dlICA8bXJvd2VAYXBwbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo T09QUyEpLgorCisgICAgICAgIEZpeCA8aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcu Y2dpP2lkPTI1Nzg1Pi4KKyAgICAgICAgQnVnIDI1Nzg1OiBTZWdmYXVsdCBpbiBtYXJrIHdoZW4g dXNpbmcgSlNPYmplY3RNYWtlQ29uc3RydWN0b3IKKworICAgICAgICAqIEFQSS9KU09iamVjdFJl Zi5jcHA6CisgICAgICAgIChKU09iamVjdE1ha2VDb25zdHJ1Y3Rvcik6IE9wYXF1ZUpTQ2xhc3M6 OnByb3RvdHlwZSBjYW4gcmV0dXJuIDAuICBXZSBuZWVkIHRvIHVzZSB0aGUgZGVmYXVsdCBvYmpl Y3QgcHJvdG90eXBlIHdoZW4gaXQgZG9lcy4KKyAgICAgICAgKiBBUEkvdGVzdHMvdGVzdGFwaS5j OgorICAgICAgICAobWFpbik6IEFkZCBhIHRlc3QgY2FzZS4KKyAgICAgICAgKiBydW50aW1lL0pT T2JqZWN0Lmg6CisgICAgICAgIChKU0M6OkpTT2JqZWN0OjpwdXREaXJlY3QpOiBBZGQgYSBjbGVh cmVyIGFzc2VydGlvbiBmb3IgYSBudWxsIHZhbHVlLiAgVGhlIGFzc2VydGlvbiBvbiB0aGUgbmV4 dCBsaW5lIGRvZXMgY2F0Y2ggdGhpcywKKyAgICAgICAgYnV0IHRoZSBjYXVzZSBvZiB0aGUgZmFp bHVyZSBpcyBub3QgY2xlYXIgZnJvbSB0aGUgYXNzZXJ0aW9uIGl0c2VsZi4KKwogMjAwOS0wMy0w NCAgTWFyayBSb3dlICA8bXJvd2VAYXBwbGUuY29tPgogCiAgICAgICAgIFJldmlld2VkIGJ5IE9s aXZlciBIdW50LgpkaWZmIC0tZ2l0IGEvSmF2YVNjcmlwdENvcmUvcnVudGltZS9KU09iamVjdC5o IGIvSmF2YVNjcmlwdENvcmUvcnVudGltZS9KU09iamVjdC5oCmluZGV4IDIwMjQyY2UuLmY0ZDMy ZDMgMTAwNjQ0Ci0tLSBhL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvSlNPYmplY3QuaAorKysgYi9K YXZhU2NyaXB0Q29yZS9ydW50aW1lL0pTT2JqZWN0LmgKQEAgLTM4Niw2ICszODYsNyBAQCBpbmxp bmUgdm9pZCBKU09iamVjdDo6cHV0RGlyZWN0KGNvbnN0IElkZW50aWZpZXImIHByb3BlcnR5TmFt ZSwgSlNWYWx1ZVB0ciB2YWx1ZQogCiBpbmxpbmUgdm9pZCBKU09iamVjdDo6cHV0RGlyZWN0KGNv bnN0IElkZW50aWZpZXImIHByb3BlcnR5TmFtZSwgSlNWYWx1ZVB0ciB2YWx1ZSwgdW5zaWduZWQg YXR0cmlidXRlcywgYm9vbCBjaGVja1JlYWRPbmx5LCBQdXRQcm9wZXJ0eVNsb3QmIHNsb3QpCiB7 CisgICAgQVNTRVJUKHZhbHVlKTsKICAgICBBU1NFUlQoIUhlYXA6OmhlYXAodmFsdWUpIHx8IEhl YXA6OmhlYXAodmFsdWUpID09IEhlYXA6OmhlYXAodGhpcykpOwogCiAgICAgaWYgKG1fc3RydWN0 dXJlLT5pc0RpY3Rpb25hcnkoKSkgewo=