Bug 141187 – Crash in JSC::createTypeError

• Component: JavaScriptCore
• Status: NEW

[Han Choongwoo]

this code crashes.
----
new
function f() {
for (f in [1])({})();
}
----

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7ae324f in JSC::createTypeError(JSC::JSGlobalObject*, WTF::String const&) ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
(gdb) bt
#0  0x00007ffff7ae324f in JSC::createTypeError(JSC::JSGlobalObject*, WTF::String const&) ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#1  0x00007ffff7aea152 in JSC::createError(JSC::ExecState*, JSC::JSObject* (*)(JSC::ExecState*, WTF::String const&), JSC::JSValue, WTF::String const&) ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#2  0x00007ffff7aeaa27 in JSC::createNotAFunctionError(JSC::ExecState*, JSC::JSValue) ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#3  0x00007ffff7bf7f8d in JSC::LLInt::handleHostCall(JSC::ExecState*, JSC::Instruction*, JSC::JSValue, JSC::CodeSpecializationKind) [clone .isra.113] ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#4  0x00007ffff7bff460 in llint_slow_path_call ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#5  0x00007ffff7c09fdd in llint_entry ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#6  0x00007ffff7c0a0e8 in llint_entry ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#7  0x00007ffff7c046c9 in vmEntryToJavaScript ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#8  0x00007ffff7998854 in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#9  0x00007ffff797b47d in JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#10 0x00007ffff7ad062a in JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) ()
   from /development/tunz/javascript/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#11 0x000000000040c489 in jscmain(int, char**) ()
#12 0x0000000000406da8 in main ()

ASSERTION FAILED: cell->isObject()
/development/tunz/javascript/webkit/Source/JavaScriptCore/runtime/JSObject.h(1190) : JSC::JSObject* JSC::asObject(JSC::JSCell*)
1   0x7fe551c86394 /development/tunz/javascript/webkit/WebKitDebug/Debug/lib/libjavascriptcoregtk-4.0.so.18(WTFCrash+0x1e) [0x7fe551c86394]
2   0x42f983 ../jsc_d(_ZN3JSC8asObjectEPNS_6JSCellE+0x3d) [0x42f983]
3   0x42f9b1 ../jsc_d(_ZN3JSC8asObjectENS_7JSValueE+0x20) [0x42f9b1]
4   0x43014f ../jsc_d(_ZNK3JSC8Register8functionEv+0x4d) [0x43014f]
5   0x42c700 ../jsc_d(_ZNK3JSC9ExecState6calleeEv+0x1c) [0x42c700]
6   0x4311f6 ../jsc_d(_ZNK3JSC9ExecState2vmEv+0x18) [0x4311f6]
7   0x7fe551ad9dae /development/tunz/javascript/webkit/WebKitDebug/Debug/lib/libjavascriptcoregtk-4.0.so.18(+0x1262dae) [0x7fe551ad9dae]
8   0x7fe551c37c49 /development/tunz/javascript/webkit/WebKitDebug/Debug/lib/libjavascriptcoregtk-4.0.so.18(+0x13c0c49) [0x7fe551c37c49]
Segmentation fault

Also, 
----
new
function f() {
for (f in [1]);
print(f);
}
----

Output of above code should be 
----
function f() {
for (f in [1]);
print(f);
}
----

But, in JSC, output is 0.

found with afl-fuzz.

[Radar WebKit Bug Importer]

<rdar://problem/24469697>