[quickjs-devel] Segfault in JS_GetPropertyStr

  • From: Petter Strandmark <petter.strandmark@xxxxxxxxx>
  • To: quickjs-devel@xxxxxxxxxxxxx
  • Date: Sun, 12 Jan 2020 16:18:36 +0100

The following code (called with a valid context) gives a segfault:


JS_GetPropertyStr(context, JS_UNDEFINED, "test");


After looking at the stacktrace in gdb, this looks like a bug:

#0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:62
#1  0x00007ffffc552144 in JS_NewString (ctx=ctx@entry=0xcea530, str=0x0) at
third-party/quickjs.c:3756
#2  0x00007ffffc5482bf in build_backtrace (ctx=ctx@entry=0xcea530,
error_obj=..., filename=filename@entry=0x0, line_num=line_num@entry=0,
backtrace_flags=<optimized out>, backtrace_flags@entry=0) at
third-party/quickjs.c:6236
#3  0x00007ffffc548676 in JS_ThrowError2 (ctx=0xcea530,
error_num=<optimized out>, fmt=<optimized out>, ap=<optimized out>,
add_backtrace=1) at third-party/quickjs.c:6279
#4  0x00007ffffc548cbc in JS_ThrowTypeError (ctx=<optimized out>,
fmt=fmt@entry=0x7ffffc5af1a5 "value has no property") at
third-party/quickjs.c:6315
#5  0x00007ffffc545d72 in JS_GetPropertyInternal (ctx=ctx@entry=0xcea530,
obj=..., prop=prop@entry=439, this_obj=..., throw_ref_error=0) at
third-party/quickjs.c:6672
#6  0x00007ffffc57bbc9 in JS_GetProperty (prop=439, this_obj=...,
ctx=0xcea530) at third-party/quickjs.h:690
#7  JS_GetPropertyStr (ctx=ctx@entry=0xcea530, this_obj=...,
prop=prop@entry=0x7ffffc5a17e0
"test") at third-party/quickjs.c:7547

Because it looks like QuickJS tries to throw an exception ("value has no
property") and crashes instead.

Cheers,
Petter

Other related posts:

  • » [quickjs-devel] Segfault in JS_GetPropertyStr - Petter Strandmark