Segmentation fault when running test cases on 64bit linux

Bug #504406 reported by Yathi Raj on 2010-01-07
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
PyJavaScriptCore
Medium
Martin Soto
Nominated for Trunk by Cory Dodt

Bug Description

When running the testcase provided with the 64 bit ubuntu linux (AMD 64) i get segmentation fault. Attached below are the warnings that I get while I compile javascript core ,gdb backtraces a error messages.

I would like to help you in debugging this but I am new to Pyrex

Regards
Yathi

Martin Soto (soto255) wrote :

Could you please test again with the current bzr version? I just fixed a bug that may be the cause for the problems you are observing.

Changed in pyjavascriptcore:
importance: Undecided → Medium
assignee: nobody → Martin Soto (soto255)
Yathi Raj (yathib) wrote :

Problem still persists.

Martin Soto (soto255) wrote :

Second try: looking at your compile messages, I noticed a bug in my code that doesn't affect 32-bit platforms but that quite certainly affects 64-bit platforms. Could you test again with the current trunk and let me know what happens? If you still get a segfault, I'd appreciate you to log the compile messages and stack trace as you did for the initial report and attach them to your answer.

Martin Soto (soto255) on 2010-04-12
Changed in pyjavascriptcore:
status: New → Confirmed
Friedrich Weber (fredreichbier) wrote :

Hi there,

I could reproduce this exact bug in a 64bit environment, too. Seems like `JSObjectIsFunction` is called on a `jsResult` that is a `JSObjectRef` instance, but only a `JSValueRef` instance. A quick check if `jsResult` is a `JSObjectRef` (via `JSValueIsObject`) fixes it for me. I pushed a fix to my branch:

https://code.launchpad.net/~fredreichbier/+junk/pyjavascriptcore

However, it's strange that this code works under 32bit. My guess is that the virtual table of `JSValue` contains a function pointer without arguments and with a boolean return value at the position of `isFunction` (which is called by `JSObjectIsFunction`) in JSObject on 32bit, so a wrong function returning a correct result (`false`) is called for `isFunction`. Maybe the virtual table layout is a bit different on 64bit and contains a crappy function pointer at this address.
As said, that's only a guess, and it works with the patch above.

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers