| Summary: | ASSERTION FAILED: baseValue.isObject() | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Mikhail R. Gadelha <mikhail> | ||||
| Component: | JavaScriptCore | Assignee: | Yusuke Suzuki <ysuzuki> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | bfulgham, webkit-bug-importer, ysuzuki | ||||
| Priority: | P2 | Keywords: | InRadar | ||||
| Version: | WebKit Nightly Build | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Attachments: |
|
||||||
Removing security tag since this is JSC shell only deterministic crash issue. Pull request: https://github.com/WebKit/WebKit/pull/5343 Committed 255553@main (96ac9c31b19e): <https://commits.webkit.org/255553@main> Reviewed commits have been landed. Closing PR #5343 and removing active labels. |
Created attachment 462013 [details] Testcase Tested on linux intel 64 and ARMv7. Running the attached test case fails with the following message: #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140737313221504) at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=140737313221504) at ./nptl/pthread_kill.c:78 #2 __GI___pthread_kill (threadid=140737313221504, signo=signo@entry=6) at ./nptl/pthread_kill.c:89 #3 0x00007ffff755e476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #4 0x00007ffff75447f3 in __GI_abort () at ./stdlib/abort.c:79 #5 0x000055555562a8a7 in WTFCrashWithInfo () at /home/mgadelha/tools/WebKit/WebKitBuild/Debug/WTF/Headers/wtf/Assertions.h:754 #6 0x0000555556639b95 in JSC::LLInt::llint_slow_path_put_by_val_direct (callFrame=0x7fffffffd310, pc=0x55555939a17e) at /home/mgadelha/tools/WebKit/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1239 #7 0x00005555570f18e7 in llint_op_put_by_val_direct () at /home/mgadelha/tools/WebKit/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm:118 #8 0x0000000000000000 in ?? () When disabling LLInt, we get: #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140737313221504) at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=140737313221504) at ./nptl/pthread_kill.c:78 #2 __GI___pthread_kill (threadid=140737313221504, signo=signo@entry=6) at ./nptl/pthread_kill.c:89 #3 0x00007ffff755e476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #4 0x00007ffff75447f3 in __GI_abort () at ./stdlib/abort.c:79 #5 0x000055555562a8a7 in WTFCrashWithInfo () at /home/mgadelha/tools/WebKit/WebKitBuild/Debug/WTF/Headers/wtf/Assertions.h:754 #6 0x000055555657ccf1 in JSC::directPutByValOptimize (globalObject=0x5555593132b8, codeBlock=0x5555593ac580, baseValue=..., subscript=..., value=..., stubInfo=0x5555593d3888, profile=0x5555593d3f98, ecmaMode=...) at /home/mgadelha/tools/WebKit/Source/JavaScriptCore/jit/JITOperations.cpp:1168 #7 0x000055555657d3ab in JSC::operationDirectPutByValStrictOptimize (globalObject=0x5555593132b8, encodedBaseValue=10, encodedSubscript=-562949953421312, encodedValue=10, stubInfo=0x5555593d3888, profile=0x5555593d3f98) at /home/mgadelha/tools/WebKit/Source/JavaScriptCore/jit/JITOperations.cpp:1218 ... #56 0x00005555570e2406 in vmEntryToJavaScript () at /home/mgadelha/tools/WebKit/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm:367 Found by Igalia Fuzzing Campaign.