Bug 154378 – Crash on SES selftest page when loading the page while WebInspector is open

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Chris Dumez]

Crash on SES selftest page when loading the page while WebInspector is open:
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x000000010a901f81 JSC::JSObject::getOwnPropertyDescriptor(JSC::ExecState*, JSC::PropertyName, JSC::PropertyDescriptor&) + 449
1   com.apple.JavaScriptCore      	0x000000010a9bee88 JSC::objectConstructorGetOwnPropertyDescriptor(JSC::ExecState*, JSC::JSObject*, JSC::Identifier const&) + 72
2   com.apple.JavaScriptCore      	0x000000010a9bd336 JSC::objectConstructorGetOwnPropertyDescriptor(JSC::ExecState*) + 550
3   ???                           	0x00003a5d9d601028 0 + 64173746688040
4   com.apple.JavaScriptCore      	0x000000010a99baeb llint_entry + 23561
5   com.apple.JavaScriptCore      	0x000000010a99bb5d llint_entry + 23675
6   com.apple.JavaScriptCore      	0x000000010a99baeb llint_entry + 23561
7   com.apple.JavaScriptCore      	0x000000010a99baeb llint_entry + 23561
8   com.apple.JavaScriptCore      	0x000000010a995cff vmEntryToJavaScript + 299
9   com.apple.JavaScriptCore      	0x000000010a88389e JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 158

[Radar WebKit Bug Importer]

<rdar://problem/24713422>

[Chris Dumez]

Looks like there were 2 checks like this in putDirectInternal:
 if ((attributes & Accessor) != (currentAttributes & Accessor))

And I only updated one of them :/

[Chris Dumez]

This time it seems we hit the following assertion in getOwnPropertyDescriptor():
ASSERT(maybeGetterSetter);

So we have a slot with CustomAccessor attribute but getDirect() returns no value somehow.

|this| is a DebuggerScope and the propertyName is “document”.

[Chris Dumez]

I think the issue is that DebuggerScope::getOwnPropertySlot() does not only return *own* properties. It searches the prototype chain, like JSDOMWindow used to do before r196676. We used to have a check at the top of GetOwnPropertyDescriptor() to return early if getOwnPropertySlot() returned a non-own property but Gavin dropped it in r 196676, assuming the workaround was only needed for JSDOMWindow...

We probably need to add the following check back:
    if (slot.slotBase() != this && slot.slotBase()) {
        if (!proxy || proxy->target() != slot.slotBase())
            return false;
    }

I will verify.

[Chris Dumez]

Created attachment 271663 [details]
Patch

[Mark Lam]

Comment on attachment 271663 [details]
Patch

r=me

[Chris Dumez]

Comment on attachment 271663 [details]
Patch

Clearing flags on attachment: 271663

Committed r196760: <http://trac.webkit.org/changeset/196760>

[Chris Dumez]

All reviewed patches have been landed.  Closing bug.