Bug 201186 - Crash under WebCore::jsNotificationConstructorPermission
Summary: Crash under WebCore::jsNotificationConstructorPermission
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Chris Dumez
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2019-08-27 10:33 PDT by Chris Dumez
Modified: 2019-08-27 11:59 PDT (History)
6 users (show)

See Also:

Attachments
Patch (5.28 KB, patch)
2019-08-27 10:36 PDT, Chris Dumez 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Dumez 2019-08-27 10:33:01 PDT 
Crash under WebCore::jsNotificationConstructorPermission:
Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000000038
Exception Note:        EXC_CORPSE_NOTIFY

Termination Signal:    Segmentation fault: 11
Termination Reason:    Namespace SIGNAL, Code 0xb
Terminating Process:   exc handler [34936]
 
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x00000001041a0e6c WebCore::jsNotificationConstructorPermission(JSC::ExecState*, long long, JSC::PropertyName) + 108
1   com.apple.JavaScriptCore      	0x00000001072922b2 llint_slow_path_get_by_id + 6386
2   com.apple.JavaScriptCore      	0x0000000107445d24 llint_entry + 38139
3   com.apple.JavaScriptCore      	0x0000000107453355 llint_entry + 92972
4   com.apple.JavaScriptCore      	0x0000000107453355 llint_entry + 92972
5   com.apple.JavaScriptCore      	0x00000001074533d1 llint_entry + 93096
6   com.apple.JavaScriptCore      	0x00000001074533d1 llint_entry + 93096
7   com.apple.JavaScriptCore      	0x00000001074542ff llint_entry + 96982
8   ???                           	0x00003a5acd63fdb0 0 + 64161667349936
9   com.apple.JavaScriptCore      	0x00000001074542ff llint_entry + 96982
10  com.apple.JavaScriptCore      	0x00000001074533d1 llint_entry + 93096
11  com.apple.JavaScriptCore      	0x00000001074533d1 llint_entry + 93096
12  com.apple.JavaScriptCore      	0x00000001074533d1 llint_entry + 93096
13  com.apple.JavaScriptCore      	0x00000001074533d1 llint_entry + 93096
14  com.apple.JavaScriptCore      	0x00000001074533d1 llint_entry + 93096
15  com.apple.JavaScriptCore      	0x00000001074533d1 llint_entry + 93096
16  com.apple.JavaScriptCore      	0x00000001074533d1 llint_entry + 93096
17  com.apple.JavaScriptCore      	0x0000000107453355 llint_entry + 92972
18  com.apple.JavaScriptCore      	0x00000001074533d1 llint_entry + 93096
19  com.apple.JavaScriptCore      	0x00000001074533d1 llint_entry + 93096
20  com.apple.JavaScriptCore      	0x0000000107453355 llint_entry + 92972
21  com.apple.JavaScriptCore      	0x0000000107453355 llint_entry + 92972
22  com.apple.JavaScriptCore      	0x00000001074533d1 llint_entry + 93096
23  com.apple.JavaScriptCore      	0x0000000107453355 llint_entry + 92972
24  com.apple.JavaScriptCore      	0x0000000107453355 llint_entry + 92972
25  com.apple.JavaScriptCore      	0x000000010743c67f vmEntryToJavaScript + 200
26  com.apple.JavaScriptCore      	0x00000001071200d1 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 417
27  com.apple.JavaScriptCore      	0x0000000107bef93b JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 187
28  com.apple.WebCore             	0x0000000104894e28 WebCore::JSExecState::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 152
29  com.apple.WebCore             	0x00000001048ad210 WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) + 1680
30  com.apple.WebCore             	0x0000000104b5a71c WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::DumbPtrTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 16ul>, WebCore::EventTarget::EventInvokePhase) + 1196
31  com.apple.WebCore             	0x0000000104b580f2 WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) + 594
32  com.apple.WebCore             	0x0000000104b5a245 WebCore::EventTarget::dispatchEvent(WebCore::Event&) + 181
33  com.apple.WebCore             	0x00000001039856de WebCore::PostMessageTimer::fired() + 1262
Comment 1 Chris Dumez 2019-08-27 10:33:14 PDT 
<rdar://problem/53962833>
Comment 2 Chris Dumez 2019-08-27 10:36:22 PDT 
Created attachment 377349 [details]
Patch
Comment 3 Chris Dumez 2019-08-27 11:38:46 PDT 
Comment on attachment 377349 [details]
Patch

Clearing flags on attachment: 377349

Committed r249156: <https://trac.webkit.org/changeset/249156>
Comment 4 Chris Dumez 2019-08-27 11:38:47 PDT 
All reviewed patches have been landed.  Closing bug.