Spidermonkey

Spidermonkey

关注
发信
关注(28)粉丝(399)

c++ - JS_NewContext 中的 JSAPI 段错误

我正在编写一个嵌入 SpiderMonkey 的简单 C++ 程序。不幸的是，它在 JS_NewContext() 中出现了段错误。

程序(另存为 jsapi_use.cpp ):

#define __STDC_LIMIT_MACROS
#include <js/Initialization.h>
#include <jsapi.h>
#include <stdint.h>

static JSClass global_class = {
#if 0
    .name = "global",
    .flags = JSCLASS_GLOBAL_FLAGS,
    .addProperty = nullptr,
    .delProperty = nullptr,
    .getProperty = nullptr,
    .setProperty = nullptr,
    .enumerate = nullptr,
    .resolve = nullptr,
    .mayResolve = nullptr,
    .finalize = nullptr,
    .call = nullptr,
    .hasInstance = nullptr,
    .construct = nullptr,
    .trace = JS_GlobalObjectTraceHook,
#else
    "global", JSCLASS_GLOBAL_FLAGS,
    nullptr,  nullptr,
    nullptr,  nullptr,
    nullptr,  nullptr,
    nullptr,  nullptr,
    nullptr,  nullptr,
    nullptr,  JS_GlobalObjectTraceHook,
    {0},
#endif
};

int main() {
  if (!JS_Init())
    return 1;
  JSRuntime *rt =
      JS_NewRuntime(8L * 1024 * 1024 /*, JS::DefaultHeapMaxBytes, nullptr*/);
  if (nullptr == rt)
    return 1;
  JSContext *cx = JS_NewContext(rt, 8192);
  if (!cx) {
    return 1;
  }
  {
    JSAutoRequest ar(cx);
    JS::RootedObject global(cx, JS_NewGlobalObject(cx, &global_class, nullptr,
                                                   JS::FireOnNewGlobalHook));

    if (!global)
      return 1;

    JS::RootedValue rval(cx);
    {
      JSAutoCompartment ac(cx, global);
      JS_InitStandardClasses(cx, global);

      const char *script = "'hello'+'world, it is '+new Date();";
      const char *filename = "noname";
      auto lineno = 1U;
      JS::CompileOptions opts(cx);
      opts.setFileAndLine(filename, lineno);
      bool ok = JS::Evaluate(cx, opts, script, strlen(script), &rval);
      if (!ok)
        return 1;
    }
    if (rval.isString()) {
      JSString *string = rval.toString();
      puts(JS_EncodeString(cx, string));
    }
  }
  JS_DestroyContext(cx);
  JS_DestroyRuntime(rt);
  JS_ShutDown();
  return 0;
}

它在 JS_NewContext 崩溃。

我的生成文件:
MAKEFLAGS := -r -R
CXX := g++

CXXFLAGS += -g3 -std=gnu++14

TARGET = $(subst ','\'',$@)#')
SOURCE = $(subst ','\'',$<)#')
PKG_CFLAGS=$(shell pkg-config --cflags mozjs-45)
PKG_LDFLAGS=$(shell pkg-config --libs mozjs-45)
%.o: %.cpp Makefile
    $(CXX) $(CPPFLAGS) -c -o $(TARGET) $(CXXFLAGS) $(PKG_CFLAGS) $(SOURCE)

%: %.o
    $(CXX) -o $(TARGET) $(SOURCE) $(PKG_LDFLAGS) -lz -lpthread -ldl

%.iii: %.cpp Makefile
    cpp $(CPPFLAGS) -dD -CC -o $(TARGET) $(PKG_CFLAGS) $(SOURCE)
    clang-format -i -- $(TARGET)

在 make jsapi_use; ./jsapi_use gdb` 中运行 Segmentation fault (core dumped). 结果表明，由于取消引用了一个 NULL 指针，该程序在 SpiderMonkey 内部深处发生了段错误。

我在 Fedora 24 Linux 上使用来自 mozjs45 的 SpiderMonkey。

GDB 回溯
Thread 1 "jsapi_use" received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()
#0  0x0000000000000000 in ?? ()
#1  0x00007ffff7a6adb5 in js::ScriptBytecodeHasher::hash (l=<synthetic pointer>, l=<synthetic pointer>) at /usr/src/debug/firefox-45.4.0esr/js/src/jsscript.h:2412
#2  js::detail::HashTable<js::SharedScriptData* const, js::HashSet<js::SharedScriptData*, js::ScriptBytecodeHasher, js::SystemAllocPolicy>::SetOps, js::SystemAllocPolicy>::prepareHash (l=<synthetic pointer>) at ../../dist/include/js/HashTable.h:1126
#3  js::detail::HashTable<js::SharedScriptData* const, js::HashSet<js::SharedScriptData*, js::ScriptBytecodeHasher, js::SystemAllocPolicy>::SetOps, js::SystemAllocPolicy>::lookupForAdd (l=<synthetic pointer>, this=<optimized out>) at ../../dist/include/js/HashTable.h:1638
#4  js::HashSet<js::SharedScriptData*, js::ScriptBytecodeHasher, js::SystemAllocPolicy>::lookupForAdd (l=<synthetic pointer>, this=<optimized out>) at ../../dist/include/js/HashTable.h:386
#5  SaveSharedScriptData (cx=cx@entry=0x639ed0, script=..., ssd=<optimized out>, nsrcnotes=1) at /usr/src/debug/firefox-45.4.0esr/js/src/jsscript.cpp:2502
#6  0x00007ffff7a6b2f7 in JSScript::fullyInitTrivial (cx=cx@entry=0x639ed0, script=..., script@entry=...) at /usr/src/debug/firefox-45.4.0esr/js/src/jsscript.cpp:2886
#7  0x00007ffff7a2a451 in CreateFunctionPrototype(JSContext *, enum JSProtoKey) (cx=0x639ed0, key=<optimized out>) at /usr/src/debug/firefox-45.4.0esr/js/src/jsfun.cpp:785
#8  0x00007ffff7ae37b3 in js::GlobalObject::resolveConstructor (cx=0x639ed0, global=..., key=<optimized out>) at /usr/src/debug/firefox-45.4.0esr/js/src/vm/GlobalObject.cpp:158
#9  0x00007ffff7ae3da7 in js::GlobalObject::ensureConstructor (cx=cx@entry=0x639ed0, global=..., global@entry=..., key=key@entry=JSProto_Function) at /usr/src/debug/firefox-45.4.0esr/js/src/vm/GlobalObject.cpp:98
#10 0x00007ffff79677ed in CreateObjectConstructor(JSContext *, enum JSProtoKey) (cx=0x639ed0, key=<optimized out>) at /usr/src/debug/firefox-45.4.0esr/js/src/builtin/Object.cpp:1035
#11 0x00007ffff7ae382f in js::GlobalObject::resolveConstructor (cx=0x639ed0, global=..., key=<optimized out>) at /usr/src/debug/firefox-45.4.0esr/js/src/vm/GlobalObject.cpp:166
#12 0x00007ffff772dda6 in CreateArrayPrototype(JSContext *, enum JSProtoKey) (cx=0x639ed0, key=<optimized out>) at /usr/src/debug/firefox-45.4.0esr/js/src/vm/GlobalObject.h:342
#13 0x00007ffff7ae18ce in InitBareBuiltinCtor(JSContext *, JS::Handle<js::GlobalObject*>, enum JSProtoKey) (cx=cx@entry=0x639ed0, global=..., global@entry=..., protoKey=protoKey@entry=JSProto_Array) at /usr/src/debug/firefox-45.4.0esr/js/src/vm/GlobalObject.cpp:368
#14 0x00007ffff7ae1b08 in js::GlobalObject::initSelfHostingBuiltins (cx=cx@entry=0x639ed0, global=global@entry=..., builtins=builtins@entry=0x7ffff7dbefa0 <intrinsic_functions>) at /usr/src/debug/firefox-45.4.0esr/js/src/vm/GlobalObject.cpp:413
#15 0x00007ffff7b5041f in JSRuntime::createSelfHostingGlobal (cx=cx@entry=0x639ed0) at /usr/src/debug/firefox-45.4.0esr/js/src/vm/SelfHosting.cpp:1730
#16 0x00007ffff7b5056f in JSRuntime::initSelfHosting (this=0x617850, cx=0x639ed0) at /usr/src/debug/firefox-45.4.0esr/js/src/vm/SelfHosting.cpp:1754
#17 0x00007ffff79e2103 in js::NewContext (rt=rt@entry=0x617850, stackChunkSize=stackChunkSize@entry=8192) at /usr/src/debug/firefox-45.4.0esr/js/src/jscntxt.cpp:122
#18 0x00007ffff79e21ba in JS_NewContext (rt=rt@entry=0x617850, stackChunkSize=stackChunkSize@entry=8192) at /usr/src/debug/firefox-45.4.0esr/js/src/jsapi.cpp:566
#19 0x0000000000400e4f in main () at jsapi_use.cpp:41

最佳答案

问题 是由 Spidermonkey 库中 undefined symbol 引起的。即， HashBytes() 函数没有在 libmozjs-45.so 中定义。此函数由调试回溯中显示的 js::ScriptBytecodeHasher::hash() 函数调用。

如果您列出库符号，您将看到 HashBytes 只是“弱定义”。

$nm -gC libmozjs-45.so | grep HashBytes
    w mozilla::HashBytes(void const*, unsigned long)

“w”符号是一个弱符号，没有被特别标记为弱对象符号。

要解决这个问题 您需要将 mfbt 库链接到 libmozjs-45.so 。
您可以通过更改 js/src/moz.build 文件并重建 Spidermonkey 来实现。

在 moz.build 中替换
if not CONFIG['JS_STANDALONE']:

和
if CONFIG['JS_STANDALONE']:
    DEFINES['IMPL_MFBT'] = True
    USE_LIBS += [
        'mfbt',
    ]
else:

你会得到:
if CONFIG['JS_STANDALONE']:
    DEFINES['IMPL_MFBT'] = True
    USE_LIBS += [
        'mfbt',
    ]
else:
    CONFIGURE_SUBST_FILES += [
        '../../config/autoconf-js.mk',
        '../../config/emptyvars-js.mk',
    ]

重建后，您将拥有:
$nm -gC libmozjs-45.so | grep HashBytes
0000000000b66e07 T mozilla::HashBytes(void const*, unsigned long)

关于c++ - JS_NewContext 中的 JSAPI 段错误，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/40540492/

10-09 05:36
Powered by LMLPHP ©2024 Spidermonkey 0.034387