Bug 25785 - Segfault in mark when using JSObjectMakeConstructor
Summary: Segfault in mark when using JSObjectMakeConstructor
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC Linux
: P2 Normal
Assignee: Nobody
URL:
Keywords: HasReduction
Depends on:
Blocks:
 
Reported: 2009-05-14 02:46 PDT by Robert Carr
Modified: 2009-05-14 04:15 PDT (History)
1 user (show)

See Also:


Attachments
Test case (2.47 KB, text/plain)
2009-05-14 02:47 PDT, Robert Carr
no flags Details
Further reduction (260 bytes, application/octet-stream)
2009-05-14 03:06 PDT, Mark Rowe (bdash)
no flags Details
Patch (3.53 KB, patch)
2009-05-14 03:45 PDT, Mark Rowe (bdash)
oliver: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Carr 2009-05-14 02:46:23 PDT
Making two constructors of a class with JSObjectMakeConstructor, setting them on an object, and then creating/releasing a context, reliably produces a segfault in GC Mark with r43686 on Linux.

Not setting either of the constructs on the object, OR passing NULL as the class argument to JSObjectMakeConstructor prevents the segfault from happening.

Attached is a test case which triggers the segfault.
Comment 1 Robert Carr 2009-05-14 02:47:16 PDT
Created attachment 30321 [details]
Test case
Comment 2 Mark Rowe (bdash) 2009-05-14 02:50:16 PDT
This also crashes on i386 Mac OS X.
Comment 3 Mark Rowe (bdash) 2009-05-14 03:06:47 PDT
Created attachment 30326 [details]
Further reduction

I hit the following assertion in a debug build:
0x000bb760 in JSC::JSObject::putDirect (this=0x4a1260, propertyName=@0x5047e8, value={m_ptr = 0x0}, attributes=14, checkReadOnly=false, slot=@0xbffff6e0) at JSObject.h:389
389	    ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));

This attached file is all that is necessary to reproduce the assertion failure, which is likely to be the root cause of this crash during GC.
Comment 4 Mark Rowe (bdash) 2009-05-14 03:45:35 PDT
Created attachment 30327 [details]
Patch
Comment 5 Mark Rowe (bdash) 2009-05-14 04:15:02 PDT
Fixed in r43692.