* SUMMARY CRASH under JSC::DebuggerCallFrame::thisValue when hitting breakpoint * STEPS TO REPRODUCE 1. Inspect about:blank 2. Right click in the toolbar and select Inspect Element to open inspector² 3. In inspector²: Do a global search for “class CallFrameView” 4. In inspector²: Set a breakpoint on the first line of the constructor 5. In inspector¹: js> console.count() => Inspector Processes crash * CRASH Crashed Thread: 0 Dispatch queue: com.apple.main-thread Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000000 Exception Note: EXC_CORPSE_NOTIFY External Modification Warnings: Debugger attached to process. VM Regions Near 0: --> __TEXT 000000010fd12000-000000010fd14000 [ 8K] r-x/rwx SM=COW /Users/USER/*/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.Development.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development Global Trace Buffer (reverse chronological seconds): 390.605015 CFNetwork 0x00007fff93162ddf Explicitly setting CF cookie storage singleton 390.605302 CFNetwork 0x00007fff9319978d Explicitly setting cookie storage singleton Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x00000001133b9cdc JSC::JSCell::structure(JSC::VM&) const + 44 (JSCellInlines.h:107) 1 com.apple.JavaScriptCore 0x00000001134bcdfd JSC::JSCell::methodTable(JSC::VM&) const + 29 (JSCellInlines.h:213) 2 com.apple.JavaScriptCore 0x00000001134bcac2 JSC::JSValue::toThis(JSC::ExecState*, JSC::ECMAMode) const + 82 (JSCJSValueInlines.h:756) 3 com.apple.JavaScriptCore 0x00000001136ff9b4 JSC::DebuggerCallFrame::thisValueForCallFrame(JSC::ExecState*) + 132 (DebuggerCallFrame.cpp:265) 4 com.apple.JavaScriptCore 0x00000001136ff91b JSC::DebuggerCallFrame::thisValue() const + 91 (DebuggerCallFrame.cpp:174) 5 com.apple.JavaScriptCore 0x0000000113e62f54 Inspector::JavaScriptCallFrame::thisValue() const + 36 (JavaScriptCallFrame.h:57) 6 com.apple.JavaScriptCore 0x0000000113e628d1 Inspector::JSJavaScriptCallFrame::thisObject(JSC::ExecState*) const + 33 (JSJavaScriptCallFrame.cpp:175) 7 com.apple.JavaScriptCore 0x0000000113e68906 Inspector::jsJavaScriptCallFrameAttributeThisObject(JSC::ExecState*) + 358 (JSJavaScriptCallFramePrototype.cpp:171) 8 com.apple.JavaScriptCore 0x0000000113f89eda vmEntryToNative + 340 9 com.apple.JavaScriptCore 0x0000000113d282cc JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 1164 (Interpreter.cpp:1022) 10 com.apple.JavaScriptCore 0x00000001135fd23e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 190 (CallData.cpp:40) 11 com.apple.JavaScriptCore 0x0000000113c481ed JSC::callGetter(JSC::ExecState*, JSC::JSValue, JSC::JSValue) + 221 (GetterSetter.cpp:85) 12 com.apple.JavaScriptCore 0x000000011413a840 JSC::PropertySlot::functionGetter(JSC::ExecState*) const + 144 (PropertySlot.cpp:33) 13 com.apple.JavaScriptCore 0x00000001134c15c2 JSC::PropertySlot::getValue(JSC::ExecState*, JSC::PropertyName) const + 98 (PropertySlot.h:297) 14 com.apple.JavaScriptCore 0x00000001134c13cb JSC::JSValue::get(JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) const + 91 (JSCJSValueInlines.h:768) 15 com.apple.JavaScriptCore 0x0000000113f800cc llint_slow_path_get_by_id + 236 (LLIntSlowPaths.cpp:569) 16 com.apple.JavaScriptCore 0x0000000113f8ceac llint_entry + 12120 17 com.apple.JavaScriptCore 0x0000000113f90c4e llint_entry + 27898 18 com.apple.JavaScriptCore 0x0000000113f89d3e vmEntryToJavaScript + 334 19 com.apple.JavaScriptCore 0x0000000113d950ea JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 218 (JITCode.cpp:80) 20 com.apple.JavaScriptCore 0x0000000113d2828c JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 1100 (Interpreter.cpp:1020) 21 com.apple.JavaScriptCore 0x00000001135fd23e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 190 (CallData.cpp:40) 22 com.apple.JavaScriptCore 0x00000001135fd2a3 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 83 (CallData.cpp:45) 23 com.apple.WebCore 0x00000001177d827b WebCore::JSMainThreadExecState::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 107 (JSMainThreadExecState.h:57) 24 com.apple.WebCore 0x0000000117a6c18d WebCore::functionCallHandlerFromAnyThread(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 109 (JSMainThreadExecState.cpp:44) 25 com.apple.JavaScriptCore 0x000000011418f5be Deprecated::ScriptFunctionCall::call(bool&) + 478 (ScriptFunctionCall.cpp:124) 26 com.apple.JavaScriptCore 0x0000000113c7bfdf Inspector::InjectedScriptBase::callFunctionWithEvalEnabled(Deprecated::ScriptFunctionCall&, bool&) const + 95 (InjectedScriptBase.cpp:80) 27 com.apple.JavaScriptCore 0x0000000113c788f6 Inspector::InjectedScript::wrapCallFrames(JSC::JSValue) const + 310 (InjectedScript.cpp:221) 28 com.apple.JavaScriptCore 0x0000000113ce73bb Inspector::InspectorDebuggerAgent::currentCallFrames(Inspector::InjectedScript const&) + 187 (InspectorDebuggerAgent.cpp:612) 29 com.apple.JavaScriptCore 0x0000000113ce81f5 Inspector::InspectorDebuggerAgent::didPause(JSC::ExecState&, JSC::JSValue, JSC::JSValue) + 821 (InspectorDebuggerAgent.cpp:721)
<rdar://problem/24172015>
Created attachment 278311 [details] [PATCH] Fix Without Test This fixes the issue and things look alright. But I really need to understand what is going wrong, and ideally write a test so that this won't happen again.
"this" can be JSValue() in a constructor before calling super(). Is that what's happening here?
(In reply to comment #3) > "this" can be JSValue() in a constructor before calling super(). > Is that what's happening here? Those were my thoughts exactly!
Created attachment 278439 [details] [PATCH] Proposed Fix
Comment on attachment 278439 [details] [PATCH] Proposed Fix View in context: https://bugs.webkit.org/attachment.cgi?id=278439&action=review r=me > Source/JavaScriptCore/ChangeLog:12 > + When the thisValue is JSValue() return undefined and avoid calling > + toThisValue which would lead to a crash. I think it's worth stating why this was the case in the change log. I.e, we were in a ES6 class constructor
Created attachment 278479 [details] [PATCH] For Landing
Comment on attachment 278479 [details] [PATCH] For Landing Clearing flags on attachment: 278479 Committed r200617: <http://trac.webkit.org/changeset/200617>