Bug 695876 – Stack corruption in seed_closure_invoke{,_with_context}

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 695876 - Stack corruption in seed_closure_invoke{,_with_context}


Summary:	Stack corruption in seed_closure_invoke{,_with_context}


Status:	RESOLVED FIXED

Product:	seed
Classification:	Bindings
Component:	libseed
Version:	git master
Hardware:	Other Linux

Importance:	Normal normal
Target Milestone:	---
Assigned To:	Gustavo Noronha (kov)
QA Contact:	seed-maint

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2013-03-14 20:22 UTC by Gustavo Noronha (kov)
Modified:	2013-03-15 15:50 UTC

See Also:
GNOME target:	---
GNOME version:	---

Attachments
Append user data to the new arguments array, not the source one (1.37 KB, patch) 2013-03-14 20:40 UTC, Gustavo Noronha (kov)	committed	Details \| Review
Remove duplicated code, call function instead (2.10 KB, patch) 2013-03-14 20:49 UTC, Gustavo Noronha (kov)	committed	Details \| Review

Description Gustavo Noronha (kov) 2013-03-14 20:22:02 UTC

Patch coming. This is one of the stack traces I've gotten for this problem:

Program received signal SIGSEGV, Segmentation fault.
JSObjectCallAsFunction (ctx=0x3, object=0xbfffdbd0, thisObject=0xbfffdc40,
    argumentCount=<unknown type>, arguments=0xb7eaf05b <seed_closure_invoke+43>,
    exception=0xb1d3ec28) at ../Source/JavaScriptCore/API/APICast.h:70
70      ../Source/JavaScriptCore/API/APICast.h: No such file or directory.
(gdb) bt

+ Trace 231644

#0 JSObjectCallAsFunction
at ../Source/JavaScriptCore/API/APICast.h line 70
#1 seed_closure_invoke
at seed-closure.c line 384
#2 pending_notify
at module.c line 294
#3 ??
from /lib/i386-linux-gnu/libdbus-1.so.3
#4 ??
from /lib/i386-linux-gnu/libdbus-1.so.3
#5 dbus_connection_dispatch
from /lib/i386-linux-gnu/libdbus-1.so.3
#6 ??
from /usr/lib/i386-linux-gnu/libdbus-glib-1.so.2
#7 g_main_context_dispatch
from /lib/i386-linux-gnu/libglib-2.0.so.0
#8 ??
from /lib/i386-linux-gnu/libglib-2.0.so.0
#9 g_main_loop_run
from /lib/i386-linux-gnu/libglib-2.0.so.0
#10 ffi_call_SYSV
from /usr/lib/i386-linux-gnu/libffi.so.6
#11 ffi_call
from /usr/lib/i386-linux-gnu/libffi.so.6
#12 g_callable_info_invoke
from /usr/lib/libgirepository-1.0.so.1
#13 g_function_info_invoke
from /usr/lib/libgirepository-1.0.so.1
#14 seed_gobject_method_invoked
at seed-engine.c line 668
#15 JSC::JSCallbackObject<JSC::JSDestructibleObject>::call(JSC::ExecState*)
at ../Source/WTF/wtf/Vector.h line 260
#16 cti_op_call_NotJSFunction
at ../Source/JavaScriptCore/jit/JITStubs.cpp line 2275
#17 ??
#18 JSC::Interpreter::execute
#19 JSC::evaluate
at ../Source/JavaScriptCore/runtime/Completion.cpp line 75

Comment 1 Gustavo Noronha (kov) 2013-03-14 20:40:53 UTC

Created attachment 238923 [details] [review]
Append user data to the new arguments array, not the source one

Comment 2 Gustavo Noronha (kov) 2013-03-14 20:49:32 UTC

Created attachment 238926 [details] [review]
Remove duplicated code, call function instead

Small re-factoring to make the two sister functions share their core statements by having one call the other, more code reuse, less problems with forgetting to apply fixes to both.

Comment 3 Alan Knowles 2013-03-14 23:11:11 UTC

Feel free to commit stuff like this directly if you can.

Regards
Alan

Comment 4 Gustavo Noronha (kov) 2013-03-15 15:50:35 UTC

Comment on attachment 238923 [details] [review]
Append user data to the new arguments array, not the source one

Thanks =)