Bug 118664 – ASSERTION FAILED: m_startOffset >= m_divotLineStart in JSC::ResolveNode::ResolveNode

• Component: JavaScriptCore
• Status: RESOLVED DUPLICATE

[Renata Hodovan]

The following test crashes on the assertion above:

function toFuzz() {
    for (var conf = new ConfigObject({
    }) in str1.localeCompare) {
    }
}

toFuzz();


Tested on Linux 13.04 PC, x86_64


The backtrace:
==============

Program received signal SIGSEGV, Segmentation fault.
0x0000000000435185 in WTFCrash () at /home/reni/Data/REPOS/webkitnix/Source/WTF/wtf/Assertions.cpp:339
339	    *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt 
#0  0x0000000000435185 in WTFCrash () at /home/reni/Data/REPOS/webkitnix/Source/WTF/wtf/Assertions.cpp:339
#1  0x000000000073878b in JSC::ResolveNode::ResolveNode (this=0xeeded0, location=..., ident=..., startOffset=33, divotLine=3, divotLineStart=59)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/NodeConstructors.h:112
#2  0x000000000073b4d9 in JSC::ForInNode::ForInNode (this=0xeede88, vm=0xecfb60, location=..., ident=..., in=0xeedd90, expr=0xeede30, statement=0xeede68, 
    divot=38, startOffset=5, endOffset=27, divotLine=3, divotLineStart=59)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/NodeConstructors.h:828
#3  0x000000000073d779 in JSC::ASTBuilder::createForInLoop (this=0x7fffffffba00, location=..., ident=0xeefc10, initializer=0xeedd90, iter=0xeede30, 
    statements=0xeede68, start=33, divot=66, end=87, initStart=38, initEnd=65, startLine=2, endLine=3, divotLine=3, divotLineStart=59)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/ASTBuilder.h:381
#4  0x000000000074cc3f in JSC::Parser<JSC::Lexer<unsigned char> >::parseForStatement<JSC::ASTBuilder> (this=0x7fffffffc000, context=...)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:394
#5  0x0000000000749958 in JSC::Parser<JSC::Lexer<unsigned char> >::parseStatement<JSC::ASTBuilder> (this=0x7fffffffc000, context=..., 
    directive=@0x7fffffffb818: 0x0, directiveLiteralLength=0x7fffffffb800) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:761
#6  0x0000000000753756 in JSC::Parser<JSC::Lexer<unsigned char> >::parseSourceElements<(JSC::SourceElementsMode)1, JSC::ASTBuilder> (this=0x7fffffffc000, 
    context=...) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:172
#7  0x000000000074b4fd in JSC::Parser<JSC::Lexer<unsigned char> >::parseBlockStatement<JSC::ASTBuilder> (this=0x7fffffffc000, context=...)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:724
#8  0x00000000007497f2 in JSC::Parser<JSC::Lexer<unsigned char> >::parseStatement<JSC::ASTBuilder> (this=0x7fffffffc000, context=..., 
    directive=@0x7fffffffb948: 0x0, directiveLiteralLength=0x7fffffffb930) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:741
#9  0x0000000000747a53 in JSC::Parser<JSC::Lexer<unsigned char> >::parseSourceElements<(JSC::SourceElementsMode)0, JSC::ASTBuilder> (this=0x7fffffffc000, 
    context=...) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:172
#10 0x0000000000740a91 in JSC::Parser<JSC::Lexer<unsigned char> >::parseInner (this=0x7fffffffc000)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.cpp:118
#11 0x0000000000624de8 in JSC::Parser<JSC::Lexer<unsigned char> >::parse<JSC::FunctionBodyNode> (this=0x7fffffffc000, error=...)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.h:1023
#12 0x000000000062426b in JSC::parse<JSC::FunctionBodyNode> (vm=0xecfb60, source=..., parameters=0xedd1f0, name=..., strictness=JSC::JSParseNormal, 
    parserMode=JSC::JSParseFunctionCode, error=...) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/parser/Parser.h:1091
#13 0x0000000000621fc9 in JSC::generateFunctionCodeBlock (vm=..., scope=0x7ffff7f5f870, executable=0x7fffb437ff90, source=..., kind=JSC::CodeForCall, 
    debuggerMode=JSC::DebuggerOff, profilerMode=JSC::ProfilerOff, error=...)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp:52
#14 0x0000000000622ade in JSC::UnlinkedFunctionExecutable::codeBlockFor (this=0x7fffb437ff90, vm=..., scope=0x7ffff7f5f870, source=..., 
    specializationKind=JSC::CodeForCall, debuggerMode=JSC::DebuggerOff, profilerMode=JSC::ProfilerOff, error=...)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp:161
#15 0x00000000004eda7e in JSC::FunctionExecutable::produceCodeBlockFor (this=0x7fffb43bfd70, scope=0x7ffff7f5f870, specializationKind=JSC::CodeForCall, 
    exception=@0x7fffffffcb98: 0x0) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/runtime/Executable.cpp:503
#16 0x00000000004eddcd in JSC::FunctionExecutable::compileForCallInternal (this=0x7fffb43bfd70, exec=0x7fffb44020a0, scope=0x7ffff7f5f870, 
    jitType=JSC::JITCode::BaselineJIT, bytecodeIndex=4294967295) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/runtime/Executable.cpp:533
#17 0x0000000000498b08 in JSC::FunctionExecutable::compileForCall (this=0x7fffb43bfd70, exec=0x7fffb44020a0, scope=0x7ffff7f5f870)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/runtime/Executable.h:612
#18 0x00000000004b4ad2 in JSC::FunctionExecutable::compileFor (this=0x7fffb43bfd70, exec=0x7fffb44020a0, scope=0x7ffff7f5f870, kind=JSC::CodeForCall)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/runtime/Executable.h:670
#19 0x00000000007abff4 in JSC::LLInt::setUpCall (execCallee=0x7fffb44020a0, pc=0xeed568, kind=JSC::CodeForCall, calleeAsValue=<incomplete type>, 
    callLinkInfo=0xef0520) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1392
#20 0x00000000007ac391 in JSC::LLInt::genericCall (exec=0x7fffb4402058, pc=0xeed568, kind=JSC::CodeForCall)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1434
#21 0x00000000007a9667 in JSC::LLInt::llint_slow_path_call (exec=0x7fffb4402058, pc=0xeed568)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1440
#22 0x00000000005d4185 in llint_op_call ()
#23 0x00007fffb4402058 in ?? ()
#24 0x0000000000edf610 in ?? ()
#25 0x00007fffffffce00 in ?? ()
#26 0x000000000049aa77 in JSC::JSStack::installTrapsAfterFrame (this=0x0, frame=0x0)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/interpreter/JSStackInlines.h:212
---Type <return> to continue, or q <return> to quit---
#27 0x0000000000497fec in JSC::JITCode::execute (this=0x7fffb43bfe90, stack=0xedf610, callFrame=0x7fffb4402058, vm=0xecfb60)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/jit/JITCode.h:135
#28 0x000000000049405c in JSC::Interpreter::execute (this=0xedf600, program=0x7fffb43bfe70, callFrame=0x7ffff7f5f8d8, thisObj=0x7ffff7e6feb0)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/interpreter/Interpreter.cpp:948
#29 0x00000000004e9785 in JSC::evaluate (exec=0x7ffff7f5f8d8, source=..., thisValue=<incomplete type>, returnedException=0x7fffffffd970)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/runtime/Completion.cpp:83
#30 0x000000000041f710 in runWithScripts (globalObject=0x7ffff7f5f870, scripts=..., dump=false)
    at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/jsc.cpp:600
#31 0x00000000004205b6 in jscmain (argc=2, argv=0x7fffffffdc38) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/jsc.cpp:816
#32 0x000000000041f50d in main (argc=2, argv=0x7fffffffdc38) at /home/reni/Data/REPOS/webkitnix/Source/JavaScriptCore/jsc.cpp:558

[Renata Hodovan]

Created attachment 206648 [details]
Test case

[Mark Lam]

ref: <rdar://problem/14423494>

[Mark Lam]

The test case is different, but this is a duplicate of https://bugs.webkit.org/show_bug.cgi?id=118662.  Closing as dup.

*** This bug has been marked as a duplicate of bug 118662 ***