Skip to content

JS_NewContextRaw + JS_Eval always segfaults #914

@bnoordhuis

Description

@bnoordhuis

Almost certainly because the global object is not actually an object; see below. Fix coming up.

#include "quickjs.h"
int main(void) {
  JSRuntime *rt = JS_NewRuntime();
  JSContext *ctx = JS_NewContextRaw(rt);
  JS_AddIntrinsicEval(ctx);
  JSValue val = JS_Eval(ctx, "globalThis", 10, "", JS_EVAL_TYPE_GLOBAL); // crash
  JS_FreeValue(ctx, val);
  JS_FreeContext(ctx);
  JS_FreeRuntime(rt);
  return 0;
}

Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x000055555559060b in find_own_property (atom=140, p=0x0, ppr=0x7fffffffd460) at /home/bnoordhuis/src/quickjs/quickjs.c:5365
5365        sh = p->shape;
(gdb) bt
#0  0x000055555559060b in find_own_property (atom=140, p=0x0, ppr=0x7fffffffd460) at /home/bnoordhuis/src/quickjs/quickjs.c:5365
#1  JS_GetGlobalVar (ctx=0x555555685d10, prop=140, throw_ref_error=true) at /home/bnoordhuis/src/quickjs/quickjs.c:9872
#2  0x00005555555a352c in JS_CallInternal (caller_ctx=0x555555685d10, func_obj=..., this_obj=..., new_target=..., argc=0, argv=0x0, flags=2) at /home/bnoordhuis/src/quickjs/quickjs.c:15578
#3  0x00005555555ae848 in JS_CallFree (ctx=0x555555685d10, func_obj=..., this_obj=..., argc=0, argv=0x0) at /home/bnoordhuis/src/quickjs/quickjs.c:17366
#4  0x00005555555db4a6 in JS_EvalFunctionInternal (ctx=0x555555685d10, fun_obj=..., this_obj=..., var_refs=0x0, sf=0x0) at /home/bnoordhuis/src/quickjs/quickjs.c:33196
<snip>

Frame 2:

#2  0x00005555555a352c in JS_CallInternal (caller_ctx=0x555555685d10, func_obj=..., this_obj=..., new_target=..., argc=0, argv=0x0, flags=2) at /home/bnoordhuis/src/quickjs/quickjs.c:15578
15578                   val = JS_GetGlobalVar(ctx, atom, opcode - OP_get_var_undef);

Where the opcode is:

(gdb) p (OPCodeEnum)opcode
$1 = OP_get_var

And the global object is the zero int (tag == JS_TAG_INT):

(gdb) p ctx->global_obj
$2 = {u = {int32 = 0, float64 = 0, ptr = 0x0}, tag = 0}

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions