Bug 196305 – Assertion failed at Source/JavaScriptCore/runtime/ExceptionHelpers.cpp:278

• Component: JavaScriptCore
• Status: REOPENED

[Suyoung Lee]

The debug build of JavaScriptCore failed assertion at Source/JavaScriptCore/runtime/ExceptionHelpers.cpp:278.

PoC:
const var_1 = 'a'.padStart(2147483648 - 1);
new var_1();

Commit: 6369975
OS: Ubuntu 18.04.1 LTS
Arch: x86_64

[Alexey Proskuryakov]

JSObject* createError(ExecState* exec, JSValue value, const String& message, ErrorInstance::SourceAppender appender)
{
    VM& vm = exec->vm();
    auto scope = DECLARE_CATCH_SCOPE(vm);

    String valueDescription = errorDescriptionForValue(exec, value);
    ASSERT(scope.exception() || !!valueDescription); // Line 278

[Alexey Proskuryakov]

Sorry, didn't mean to mark this one as invalid.

[Alexey Proskuryakov]

Test crashes shipping Safari:

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x00007fff3f8b6edf JSC::errorDescriptionForValue(JSC::ExecState*, JSC::JSValue) + 559
1   com.apple.JavaScriptCore      	0x00007fff3f8b72f5 JSC::createError(JSC::ExecState*, JSC::JSValue, WTF::String const&, WTF::String (*)(WTF::String const&, WTF::String const&, JSC::RuntimeType, JSC::ErrorInstance::SourceTextWhereErrorOccurred)) + 53
2   com.apple.JavaScriptCore      	0x00007fff3ef0e9e8 JSC::createNotAConstructorError(JSC::ExecState*, JSC::JSValue) + 56
3   com.apple.JavaScriptCore      	0x00007fff3f7776cb JSC::LLInt::setUpCall(JSC::ExecState*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*) + 187
4   com.apple.JavaScriptCore      	0x00007fff3f13ea8f llint_entry + 63468

[Radar WebKit Bug Importer]

<rdar://problem/49387382>

[Tadeu Zagallo]

Created attachment 366267 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 366267 [details]
Patch

Clearing flags on attachment: 366267

Committed r243665: <https://trac.webkit.org/changeset/243665>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Ryan Haddad]

Reverted r243665 for reason:

Caused iOS JSC tests to exit with an exception.

Committed r243955: <https://trac.webkit.org/changeset/243955>

[Ryan Haddad]

(In reply to Ryan Haddad from comment #8)
> Reverted r243665 for reason:
> 
> Caused iOS JSC tests to exit with an exception.
> 
> Committed r243955: <https://trac.webkit.org/changeset/243955>
See radar for details.