Repository navigation
v8::internal::JSReceiver::DefineOwnProperty exception cause a crash #14335
Copy link
Copy link
Closed
Labels
invalidIssues and PRs that are invalid.Issues and PRs that are invalid.questionIssues asking questions about Node.js.Issues asking questions about Node.js.
Description
- Version: node-v6.10.2
- Platform: CentOS 7.1
my issue details :
- stack info:
(gdb) bt
#0 0x0000000000d577ca in operator* (this=<optimized out>) at ../deps/v8/src/handles.h:50
#1 operator* (this=<optimized out>) at ../deps/v8/src/handles.h:114
#2 operator-> (this=<optimized out>) at ../deps/v8/src/handles.h:110
#3 v8::internal::JSArray::DefineOwnProperty (isolate=0x3c0acf0, o=..., name=..., desc=0x7fffc1a5ae60, should_throw=v8::internal::Object::THROW_ON_ERROR) at ../deps/v8/src/objects.cc:6877
#4 0x0000000000d57a1d in v8::internal::JSReceiver::DefineOwnProperty (isolate=isolate@entry=0x3c0acf0, object=..., object@entry=..., key=..., key@entry=..., desc=desc@entry=0x7fffc1a5ae60,
should_throw=should_throw@entry=v8::internal::Object::THROW_ON_ERROR) at ../deps/v8/src/objects.cc:6444
#5 0x0000000000d57b34 in v8::internal::JSReceiver::DefineProperty (isolate=isolate@entry=0x3c0acf0, object=object@entry=..., key=..., key@entry=..., attributes=..., attributes@entry=...)
at ../deps/v8/src/objects.cc:6348
#6 0x0000000000e6a83a in __RT_impl_Runtime_ObjectDefineProperty (isolate=0x3c0acf0, args=...) at ../deps/v8/src/runtime/runtime-object.cc:1239
#7 v8::internal::Runtime_ObjectDefineProperty (args_length=<optimized out>, args_object=0x7fffc1a5afa8, isolate=0x3c0acf0) at ../deps/v8/src/runtime/runtime-object.cc:1233
- v8/src/objects.cc :
Maybe<bool> JSArray::DefineOwnProperty(Isolate* isolate, Handle<JSArray> o,
Handle<Object> name,
PropertyDescriptor* desc,
ShouldThrow should_throw) {
// 1. Assert: IsPropertyKey(P) is true. ("P" is |name|.)
// 2. If P is "length", then:
// TODO(jkummerow): Check if we need slow string comparison.
if (*name == isolate->heap()->length_string()) {
// 2a. Return ArraySetLength(A, Desc).
return ArraySetLength(isolate, o, desc, should_throw);
}
// 3. Else if P is an array index, then:
uint32_t index = 0;
if (PropertyKeyToArrayIndex(name, &index)) {
// 3a. Let oldLenDesc be OrdinaryGetOwnProperty(A, "length").
PropertyDescriptor old_len_desc;
Maybe<bool> success = GetOwnPropertyDescriptor(
isolate, o, isolate->factory()->length_string(), &old_len_desc);
// 3b. (Assert)
DCHECK(success.FromJust());
USE(success);
// 3c. Let oldLen be oldLenDesc.[[Value]].
uint32_t old_len = 0;
**CHECK(old_len_desc.value()->ToArrayLength(&old_len));**The crash reason: old_len_desc.value() is null.
The macro ASSIGN_RETURN_ON_EXCEPTION condition is true in the Object :: GetPropertyWithAccessor
, returns an empty object, why?
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
invalidIssues and PRs that are invalid.Issues and PRs that are invalid.questionIssues asking questions about Node.js.Issues asking questions about Node.js.
Activity
TimothyGu commentedon Jul 18, 2017
Can you provide a reproducible test case?
kisondu commentedon Jul 18, 2017
@TimothyGu
The probability of 50% appears. I suspect that isolate usage is problematic,trouble to help me check the following code,thanks
bnoordhuis commentedon Jul 18, 2017
Please move this over to https://github.com/nodejs/help/issues. This bug tracker is for reporting bugs in node.js, not general support.