Bug 243103 – ASSERTION FAILED: bytecodeIndex.offset() < instructions().size()

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Mikhail R. Gadelha]

Created attachment 461144 [details]
Testcase

Found by Igalia Fuzzing Campaign.

The attached test case fails with the following message:


./WebKitBuildBase/Debug/bin/jsc foo.js.txt 
ASSERTION FAILED: bytecodeIndex.offset() < instructions().size()
../../Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp(225) : void JSC::UnlinkedCodeBlock::expressionRangeForBytecodeIndex(JSC::BytecodeIndex, int&, int&, int&, unsigned int&, unsigned int&) const
Aborted (core dumped)

Tested on Linux x86_64 and ARMv7. It seems like it was introduced in the last couple of days.

[Radar WebKit Bug Importer]

<rdar://problem/97445560>

[Mikhail R. Gadelha]

I tried to bisect the issue, but I end up with another assertion failure:

$ ./WebKitBuildBase/Debug/bin/jsc bar.js
ASSERTION FAILED: results.size() == results.capacity()
../../Source/JavaScriptCore/interpreter/Interpreter.cpp(453) : void JSC::Interpreter::getStackTrace(JSC::JSCell*, WTF::Vector<JSC::StackFrame>&, size_t, size_t)
Aborted (core dumped)

This crash seems to have been introduced in https://github.com/WebKit/WebKit/pull/2607/files

[Mikhail R. Gadelha]

I start to get the error after Yusuke's fix of the ASSERTION FAILED: bytecodeIndex.offset() < instructions().size() fix in 700b13b162339206b1308a3c774caf82c6676f91.

[Yusuke Suzuki]

Let's make it non security since it is not shipped yet.

[Yusuke Suzuki]

Pull request: https://github.com/WebKit/WebKit/pull/2666

[EWS]

Committed 252751@main (87b1e4a822c7): <https://commits.webkit.org/252751@main>

Reviewed commits have been landed. Closing PR #2666 and removing active labels.