285158 2024-12-25 19:46:29 -0800 Null dereference under JSC::Structure::shouldConvertToPolyProto() 2024-12-26 11:59:13 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 cdumez cdumez darin webkit-bug-importer oldest_to_newest 2083943 0 cdumez 2024-12-25 19:46:29 -0800 Null deference under JSC::Structure::shouldConvertToPolyProto(), which is undefined behavior. This was found by adding a RELEASE_ASSERT() under `RefPtr::operator->()`: ``` Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 JavaScriptCore 0x12ede77f4 WTFCrashWithInfo(int, char const*, char const*, int) + 132 (Assertions.h:902) 1 JavaScriptCore 0x12f58f1c4 WTF::RefPtr<WTF::Box<JSC::InlineWatchpointSet>::Data, WTF::RawPtrTraits<WTF::Box<JSC::InlineWatchpointSet>::Data>, WTF::DefaultRefDerefTraits<WTF::Box<JSC::InlineWatchpointSet>::Data>>::operator->() const + 140 (RefPtr.h:69) 2 JavaScriptCore 0x12f642378 WTF::Box<JSC::InlineWatchpointSet>::get() const + 28 (Box.h:58) 3 JavaScriptCore 0x12f64209c JSC::Structure::shouldConvertToPolyProto(JSC::Structure const*, JSC::Structure const*) + 284 (StructureInlines.h:727) 4 JavaScriptCore 0x12f6d0090 JSC::StructureStubInfo::upgradeForPolyProtoIfNecessary(JSC::GCSafeConcurrentJSLocker const&, JSC::VM&, JSC::CodeBlock*, WTF::Vector<JSC::AccessCase*, 16ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, JSC::AccessCase&)::$_0::operator()(JSC::Structure*, JSC::Structure*) const + 48 (StructureStubInfo.cpp:119) 5 JavaScriptCore 0x12f6cff70 JSC::StructureStubInfo::upgradeForPolyProtoIfNecessary(JSC::GCSafeConcurrentJSLocker const&, JSC::VM&, JSC::CodeBlock*, WTF::Vector<JSC::AccessCase*, 16ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, JSC::AccessCase&) + 252 (StructureStubInfo.cpp:135) 6 JavaScriptCore 0x12f6d05a0 JSC::StructureStubInfo::addAccessCase(JSC::GCSafeConcurrentJSLocker const&, JSC::JSGlobalObject*, JSC::CodeBlock*, JSC::ECMAMode, JSC::CacheableIdentifier, WTF::RefPtr<JSC::AccessCase, WTF::RawPtrTraits<JSC::AccessCase>, WTF::DefaultRefDerefTraits<JSC::AccessCase>>)::$_0::operator()(WTF::Ref<JSC::AccessCase, WTF::RawPtrTraits<JSC::AccessCase>, WTF::DefaultRefDerefTraits<JSC::AccessCase>>&&) const + 196 (StructureStubInfo.cpp:159) ``` 2083944 1 cdumez 2024-12-25 19:48:05 -0800 Pull request: https://github.com/WebKit/WebKit/pull/38379 2083993 2 ews-feeder 2024-12-26 11:58:03 -0800 Committed 288298@main (b88f3785dca4): <https://commits.webkit.org/288298@main> Reviewed commits have been landed. Closing PR #38379 and removing active labels. 2083994 3 webkit-bug-importer 2024-12-26 11:59:13 -0800 <rdar://problem/142069909>