Summary: | [JSC] LazyJSValue should be robust for empty JSValue | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | zhunkibatu | ||||
Component: | JavaScriptCore | Assignee: | Yusuke Suzuki <ysuzuki> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | ews-watchlist, fpizlo, keith_miller, mark.lam, msaboff, saam, tzagallo, webkit-bug-importer, ysuzuki | ||||
Priority: | P2 | Keywords: | InRadar | ||||
Version: | WebKit Local Build | ||||||
Hardware: | All | ||||||
OS: | All | ||||||
Attachments: |
|
Description
zhunkibatu
2019-08-02 03:43:10 PDT
REproduces in shipping Safari. Thread 9 Crashed:: DFG Worklist Worker Thread 0 com.apple.JavaScriptCore 0x00007fff30522a78 JSC::DFG::LazyJSValue::strictEqual(JSC::DFG::LazyJSValue const&) const + 408 1 com.apple.JavaScriptCore 0x00007fff2febf028 JSC::DFG::CFGSimplificationPhase::run() + 2504 2 com.apple.JavaScriptCore 0x00007fff30471ca8 bool JSC::DFG::runPhase<JSC::DFG::CFGSimplificationPhase>(JSC::DFG::Graph&) + 72 3 com.apple.JavaScriptCore 0x00007fff305c2aa9 JSC::DFG::Plan::compileInThreadImpl() + 2633 4 com.apple.JavaScriptCore 0x00007fff305c17fe JSC::DFG::Plan::compileInThread(JSC::DFG::ThreadData*) + 382 5 com.apple.JavaScriptCore 0x00007fff3060fa8c JSC::DFG::Worklist::ThreadBody::work() + 300 6 com.apple.JavaScriptCore 0x00007fff2ffa2a00 WTF::Function<void ()>::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0>::call() + 304 7 com.apple.JavaScriptCore 0x00007fff2ffd57f2 WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) + 194 8 com.apple.JavaScriptCore 0x00007fff2fdf4c39 WTF::wtfThreadEntryPoint(void*) + 9 9 libsystem_pthread.dylib 0x00007fff58cb62eb _pthread_body + 126 10 libsystem_pthread.dylib 0x00007fff58cb9249 _pthread_start + 66 11 libsystem_pthread.dylib 0x00007fff58cb540d thread_start + 13 Created attachment 375460 [details]
Patch
Committed r248185: <https://trac.webkit.org/changeset/248185> |