Assertion 'prop_p->type == ECMA_PROPERTY_NAMEDACCESSOR' failed in ecma_is_property_configurable

[renatahodovan]

Jerry version:

Checked revision: aaeec7f
Build: debug.linux

OS:

Ubuntu 14.04, x86_64

Test case:

var v_1 = [,];
Object.defineProperty(v_1, "0", {
    set: function() {},
});

Backtrace:

ICE: Assertion 'prop_p->type == ECMA_PROPERTY_NAMEDACCESSOR' failed at jerryscript/jerry-core/ecma/base/ecma-helpers.cpp(ecma_is_property_configurable):1121.
Error: ERR_FAILED_INTERNAL_ASSERTION
[Inferior 1 (process 11923) exited with code 0170]
(gdb) bt
#0  ecma_is_property_configurable (prop_p=0x7e97f8 <_ZL13mem_heap_area.4015+184>)
    at jerryscript/jerry-core/ecma/base/ecma-helpers.cpp:1121
#1  0x000000000046010e in ecma_op_general_object_define_own_property (obj_p=0x7e97c0 <_ZL13mem_heap_area.4015+128>, 
    property_name_p=0x7e9b68 <_ZL13mem_heap_area.4015+1064>, property_desc_p=0x7fffffffd060, is_throw=false)
    at jerryscript/jerry-core/ecma/operations/ecma-objects-general.cpp:760
#2  0x00000000004739bc in ecma_op_array_object_define_own_property (obj_p=0x7e97c0 <_ZL13mem_heap_area.4015+128>, 
    property_name_p=0x7e9b68 <_ZL13mem_heap_area.4015+1064>, property_desc_p=0x7fffffffd060, is_throw=true)
    at jerryscript/jerry-core/ecma/operations/ecma-array-object.cpp:430
#3  0x000000000047b188 in ecma_op_object_define_own_property (obj_p=0x7e97c0 <_ZL13mem_heap_area.4015+128>, 
    property_name_p=0x7e9b68 <_ZL13mem_heap_area.4015+1064>, property_desc_p=0x7fffffffd060, is_throw=true)
    at jerryscript/jerry-core/ecma/operations/ecma-objects.cpp:451
#4  0x0000000000495c51 in ecma_builtin_object_object_define_property(unsigned int, unsigned int, unsigned int, unsigned int) [clone .19522] (
    this_arg=111, arg1=67, arg2=534, arg3=539) at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-object.cpp:438
#5  0x00000000004a0573 in ecma_builtin_object_dispatch_routine (builtin_routine_id=50, this_arg_value=111, 
    arguments_list=0x8296d0 <_ZL13mem_heap_area.4015+262032>, arguments_number=3)
    at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtin-object.inc.h:73
#6  0x00000000004a907d in ecma_builtin_dispatch_routine (builtin_object_id=ECMA_BUILTIN_ID_OBJECT, builtin_routine_id=50, this_arg_value=111, 
    arguments_list=0x8296d0 <_ZL13mem_heap_area.4015+262032>, arguments_number=3)
    at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.inc.h:29
#7  0x00000000004a884b in ecma_builtin_dispatch_call (obj_p=0x7e9860 <_ZL13mem_heap_area.4015+288>, this_arg_value=111, 
    arguments_list_p=0x8296d0 <_ZL13mem_heap_area.4015+262032>, arguments_list_len=3)
    at jerryscript/jerry-core/ecma/builtin-objects/ecma-builtins.cpp:398
#8  0x0000000000468908 in ecma_op_function_call (func_obj_p=0x7e9860 <_ZL13mem_heap_area.4015+288>, this_arg_value=111, 
    arguments_list_p=0x8296d0 <_ZL13mem_heap_area.4015+262032>, arguments_list_len=3)
    at jerryscript/jerry-core/ecma/operations/ecma-function-object.cpp:607
#9  0x000000000045acf5 in opfunc_call_n (opdata=..., int_data=0x7fffffffd590) at jerryscript/jerry-core/vm/opcodes.cpp:694
#10 0x00000000004bfa60 in run_int_loop (int_data=0x7fffffffd590) at jerryscript/jerry-core/vm/vm.cpp:440
#11 0x00000000004b678d in run_int_from_pos (start_pos=0, this_binding_value=15, lex_env_p=0x7e9770 <_ZL13mem_heap_area.4015+48>, is_strict=false, 
    is_eval_code=false) at jerryscript/jerry-core/vm/vm.cpp:513
#12 0x00000000004bf82e in run_int () at jerryscript/jerry-core/vm/vm.cpp:381
#13 0x00000000004bd4d0 in jerry_run () at jerryscript/jerry-core/jerry.cpp:1243
#14 0x00000000004bbaff in main (argc=2, argv=0x7fffffffd938) at jerryscript/main-linux.cpp:248

[galpeter]

During the debugging of the #132 issue I think I've found out the cause of this issue:
In the ecma_op_general_object_define_own_property method (ecma-objects-general.cpp line ~751) there is a call to the ecma_delete_property method and after that there are calls to the ecma_is_property_enumerable and ecma_is_property_configurable methods. But the delete property call will shift the elements in the property linked list, thus these property calls will check a different property.

So I think a patch like this would solve the problem:

diff --git a/jerry-core/ecma/operations/ecma-objects-general.cpp b/jerry-core/ecma/operations/ecma-objects-general.cpp
index c9a193f..1be997c 100644
--- a/jerry-core/ecma/operations/ecma-objects-general.cpp
+++ b/jerry-core/ecma/operations/ecma-objects-general.cpp
@@ -747,6 +747,9 @@ ecma_op_general_object_define_own_property (ecma_object_t *obj_p, /**< the objec
       return ecma_reject (is_throw);
     }

+    bool was_enumerable = ecma_is_property_enumerable (current_p);
+    bool was_configurable = ecma_is_property_configurable (current_p);
+
     ecma_delete_property (obj_p, current_p);

     if (is_current_data_descriptor)
@@ -757,8 +760,8 @@ ecma_op_general_object_define_own_property (ecma_object_t *obj_p, /**< the objec
                                                        property_name_p,
                                                        NULL,
                                                        NULL,
-                                                       ecma_is_property_enumerable (current_p),
-                                                       ecma_is_property_configurable (current_p));
+                                                       was_enumerable,
+                                                       was_configurable);
     }
     else
     {
@@ -767,8 +770,8 @@ ecma_op_general_object_define_own_property (ecma_object_t *obj_p, /**< the objec
       current_p = ecma_create_named_data_property (obj_p,
                                                    property_name_p,
                                                    false,
-                                                   ecma_is_property_enumerable (current_p),
-                                                   ecma_is_property_configurable (current_p));
+                                                   was_enumerable,
+                                                   was_configurable);
     }
   }
   else if (is_property_desc_data_descriptor && is_current_data_descriptor)

What do you think?

[ruben-ayrapetyan]

@galpeter, your investigation is correct.

The property, pointed by current_p was freed, so, the pointer couldn't be used to get [[Enumerable]] and [[Configurable]] attributes.

Patch, fixing this issue, looks good to me.

[galpeter]

Ok, then I'll create a pull request for it later today.