v8::internal::JSReceiver::DefineOwnProperty exception cause a crash #14335
Description
- Version: node-v6.10.2
- Platform: CentOS 7.1
my issue details :
- stack info:
(gdb) bt #0 0x0000000000d577ca in operator* (this=<optimized out>) at ../deps/v8/src/handles.h:50 #1 operator* (this=<optimized out>) at ../deps/v8/src/handles.h:114 #2 operator-> (this=<optimized out>) at ../deps/v8/src/handles.h:110 #3 v8::internal::JSArray::DefineOwnProperty (isolate=0x3c0acf0, o=..., name=..., desc=0x7fffc1a5ae60, should_throw=v8::internal::Object::THROW_ON_ERROR) at ../deps/v8/src/objects.cc:6877 #4 0x0000000000d57a1d in v8::internal::JSReceiver::DefineOwnProperty (isolate=isolate@entry=0x3c0acf0, object=..., object@entry=..., key=..., key@entry=..., desc=desc@entry=0x7fffc1a5ae60, should_throw=should_throw@entry=v8::internal::Object::THROW_ON_ERROR) at ../deps/v8/src/objects.cc:6444 #5 0x0000000000d57b34 in v8::internal::JSReceiver::DefineProperty (isolate=isolate@entry=0x3c0acf0, object=object@entry=..., key=..., key@entry=..., attributes=..., attributes@entry=...) at ../deps/v8/src/objects.cc:6348 #6 0x0000000000e6a83a in __RT_impl_Runtime_ObjectDefineProperty (isolate=0x3c0acf0, args=...) at ../deps/v8/src/runtime/runtime-object.cc:1239 #7 v8::internal::Runtime_ObjectDefineProperty (args_length=<optimized out>, args_object=0x7fffc1a5afa8, isolate=0x3c0acf0) at ../deps/v8/src/runtime/runtime-object.cc:1233 - v8/src/objects.cc :
Maybe<bool> JSArray::DefineOwnProperty(Isolate* isolate, Handle<JSArray> o, Handle<Object> name, PropertyDescriptor* desc, ShouldThrow should_throw) { // 1. Assert: IsPropertyKey(P) is true. ("P" is |name|.) // 2. If P is "length", then: // TODO(jkummerow): Check if we need slow string comparison. if (*name == isolate->heap()->length_string()) { // 2a. Return ArraySetLength(A, Desc). return ArraySetLength(isolate, o, desc, should_throw); } // 3. Else if P is an array index, then: uint32_t index = 0; if (PropertyKeyToArrayIndex(name, &index)) { // 3a. Let oldLenDesc be OrdinaryGetOwnProperty(A, "length"). PropertyDescriptor old_len_desc; Maybe<bool> success = GetOwnPropertyDescriptor( isolate, o, isolate->factory()->length_string(), &old_len_desc); // 3b. (Assert) DCHECK(success.FromJust()); USE(success); // 3c. Let oldLen be oldLenDesc.[[Value]]. uint32_t old_len = 0; **CHECK(old_len_desc.value()->ToArrayLength(&old_len));**The crash reason: old_len_desc.value() is null.
The macro ASSIGN_RETURN_ON_EXCEPTION condition is true in the Object :: GetPropertyWithAccessor
, returns an empty object, why?