Bug 106690 – Python implementation reports "MemoryError" instead of doing things

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Oliver Hunt]

Going to http://syntensity.com/static/python.html in a debug build crashes reliably for me.  

ASSERTION FAILED: from.isCell() && from.asCell()->JSCell::inherits(&WTF::RemovePointer<To>::Type::s_info)
/Volumes/Data/git/WebKit/OpenSource/Source/JavaScriptCore/runtime/JSCell.h(346) : To JSC::jsCast(JSC::JSValue) [To = JSC::JSObject *]
1   0x1176e72f9 JSC::JSObject* JSC::jsCast<JSC::JSObject*>(JSC::JSValue)
2   0x1176e66c9 JSC::JSScope::resolvePut(JSC::ExecState*, JSC::JSValue, JSC::Identifier const&, JSC::JSValue, JSC::PutToBaseOperation*)
3   0x11765262b cti_op_put_to_base
4   0x117659040 jscGeneratedNativeCode
5   0x117615194 JSC::JITCode::execute(JSC::JSStack*, JSC::ExecState*, JSC::JSGlobalData*)
6   0x117612328 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
7   0x117423b3c JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
8   0x11767ac61 JSC::boundFunctionCall(JSC::ExecState*)
9   0x117612352 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
10  0x117423b3c JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
11  0x11904abc2 WebCore::JSMainThreadExecState::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
12  0x119b1ed34 WebCore::ScheduledAction::executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue, WebCore::ScriptExecutionContext*)
13  0x119b1e8d2 WebCore::ScheduledAction::execute(WebCore::Document*)
14  0x119b1e719 WebCore::ScheduledAction::execute(WebCore::ScriptExecutionContext*)
15  0x118a87057 WebCore::DOMTimer::fired()
16  0x119ec6cfb WebCore::ThreadTimers::sharedTimerFiredInternal()
17  0x119ec6a89 WebCore::ThreadTimers::sharedTimerFired()
18  0x119be65f3 WebCore::timerFired(__CFRunLoopTimer*, void*)
19  0x7fff82f6ae14 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__
20  0x7fff82f6a925 __CFRunLoopDoTimer
21  0x7fff82f50686 __CFRunLoopRun
22  0x7fff82f4fe29 CFRunLoopRunSpecific
23  0x7fff8e5cd524 RunCurrentEventLoopInMode
24  0x7fff8e5cd2c1 ReceiveNextEventCommon
25  0x7fff8e6e0917 _BlockUntilNextEventMatchingListInModeWithFilter
26  0x7fff88d16281 _DPSNextEvent
27  0x7fff88d158ae -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:]
28  0x7fff88d0db2f -[NSApplication run]
29  0x7fff88cb65e6 NSApplicationMain
30  0x7fff8232bfa3 _xpc_main
31  0x7fff8240cee4 xpc_main


It looks like the base in a put_to_base operation is undefined which should not be possible (we should have thrown an exception already if that were the case).

The ResolvePutOperation seems to imply we're putting a global property down, but the base is undefined

[Filip Pizlo]

I fixed the crash, but it appears that we're still doing bad things.  Renaming the bug accordingly.

[Filip Pizlo]

Created attachment 182459 [details]
the patch

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/139687