119339 2013-07-31 06:20:12 -0700 [Win] JavaScript crash. 2013-07-31 11:02:39 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) PC Unspecified RESOLVED FIXED P2 Normal --- 1 peavo msaboff bfulgham commit-queue msaboff oliver ossy zan oldest_to_newest 913342 0 peavo 2013-07-31 06:20:12 -0700 I'm frequently getting JavaScript crashes (access violations) in the latest builds. The crash occurs in JIT generated code. This is the stack I'm getting: JavaScriptCore.dll!JSC::Interpreter::execute(JSC::ProgramExecutable * program, JSC::ExecState * callFrame, JSC::JSObject * thisObj) Line 858 C++ JavaScriptCore.dll!JSC::evaluate(JSC::ExecState * exec, const JSC::SourceCode & source, JSC::JSValue thisValue, JSC::JSValue * returnedException) Line 85 C++ WebKit.dll!WebCore::JSMainThreadExecState::evaluate(JSC::ExecState * exec, const JSC::SourceCode & source, JSC::JSValue thisValue, JSC::JSValue * exception) Line 74 + 0x1b bytes C++ WebKit.dll!WebCore::ScriptController::evaluateInWorld(const WebCore::ScriptSourceCode & sourceCode, WebCore::DOMWrapperWorld * world) Line 142 + 0x34 bytes C++ WebKit.dll!WebCore::ScriptController::evaluate(const WebCore::ScriptSourceCode & sourceCode) Line 158 + 0x40 bytes C++ WebKit.dll!WebCore::ScriptElement::executeScript(const WebCore::ScriptSourceCode & sourceCode) Line 316 + 0x16 bytes C++ WebKit.dll!WebCore::HTMLScriptRunner::executePendingScriptAndDispatchEvent(WebCore::PendingScript & pendingScript) Line 151 C++ WebKit.dll!WebCore::HTMLScriptRunner::executeParsingBlockingScripts() Line 201 + 0x1b bytes C++ WebKit.dll!WebCore::HTMLScriptRunner::executeScriptsWaitingForLoad(WebCore::CachedResource * cachedScript) Line 211 C++ WebKit.dll!WebCore::HTMLDocumentParser::notifyFinished(WebCore::CachedResource * cachedResource) Line 935 C++ WebKit.dll!WebCore::CachedResource::checkNotify() Line 369 + 0xa bytes C++ WebKit.dll!WebCore::CachedResource::finishLoading(WebCore::ResourceBuffer * __formal) Line 386 C++ WebKit.dll!WebCore::CachedScript::finishLoading(WebCore::ResourceBuffer * data) Line 94 + 0x8 bytes C++ WebKit.dll!WebCore::SubresourceLoader::didFinishLoading(double finishTime) Line 284 C++ WebKit.dll!WebCore::ResourceLoader::didFinishLoading(WebCore::ResourceHandle * __formal, double finishTime) Line 489 C++ WebKit.dll!WebCore::ResourceHandleManager::downloadTimerCallback(WebCore::Timer<WebCore::ResourceHandleManager> * __formal) Line 568 C++ WebKit.dll!WebCore::Timer<WebCore::IconDatabase>::fired() Line 114 + 0xb bytes C++ WebKit.dll!WebCore::ThreadTimers::sharedTimerFiredInternal() Line 132 C++ WebKit.dll!WebCore::TimerWindowWndProc(HWND__ * hWnd, unsigned int message, unsigned int wParam, long lParam) Line 111 C++ 913344 1 207847 peavo 2013-07-31 06:27:14 -0700 Created attachment 207847 Patch 913346 2 peavo 2013-07-31 06:28:53 -0700 The rationale behind this patch is to implement the function ctiVMThrowTrampolineSlowpath the same way as the gcc x86 version does. 913347 3 zan 2013-07-31 06:29:06 -0700 Possibly related to bug #119140. The patch touches sibling code at least. 913348 4 zan 2013-07-31 06:30:17 -0700 (In reply to comment #2) > The rationale behind this patch is to implement the function ctiVMThrowTrampolineSlowpath the same way as the gcc x86 version does. The GCC-specific implementation might not be entirely correct (as, again, bug #119140 shows). Would be interesting though to know if the proposed patch fixes the issue on Windows? 913377 5 bfulgham 2013-07-31 08:50:46 -0700 Michael, can you review this patch? 913401 6 207857 msaboff 2013-07-31 10:22:22 -0700 Created attachment 207857 Updated Patch peavo, thanks for finding the issue. There is one other place that needs a similar change. 913404 7 commit-queue 2013-07-31 10:25:53 -0700 Attachment 207857 did not pass style-queue: Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'Source/JavaScriptCore/ChangeLog', u'Source/JavaScriptCore/jit/JITStubsX86.h']" exit_code: 1 Source/JavaScriptCore/ChangeLog:9: Line contains tab character. [whitespace/tab] [5] Total errors found: 1 in 2 files If any of these errors are false positives, please file a bug against check-webkit-style. 913407 8 207859 msaboff 2013-07-31 10:30:54 -0700 Created attachment 207859 Patch with tab character removed 913410 9 207859 mhahnenberg 2013-07-31 10:39:32 -0700 Comment on attachment 207859 Patch with tab character removed r=me 913423 10 207859 commit-queue 2013-07-31 11:02:37 -0700 Comment on attachment 207859 Patch with tab character removed Clearing flags on attachment: 207859 Committed r153527: <http://trac.webkit.org/changeset/153527> 913424 11 commit-queue 2013-07-31 11:02:39 -0700 All reviewed patches have been landed. Closing bug. 207847 2013-07-31 06:27:14 -0700 2013-07-31 10:22:22 -0700 Patch bug-119339-20130731152704.patch text/plain 1283 peavo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTUzNTIwKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEyIEBA CisyMDEzLTA3LTMxICBwZWF2b0BvdXRsb29rLmNvbSAgPHBlYXZvQG91dGxvb2suY29tPgorCisg ICAgICAgIFtXaW5dIEphdmFTY3JpcHQgY3Jhc2guCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMTkzMzkKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP RFkgKE9PUFMhKS4KKworICAgICAgICAqIGppdC9KSVRTdHVic1g4Ni5oOiBJbXBsZW1lbnQgY3Rp Vk1UaHJvd1RyYW1wb2xpbmVTbG93cGF0aCB0aGUgc2FtZSB3YXkgYXMgdGhlIGdjYyB4ODYgdmVy c2lvbiBkb2VzLiAKKwogMjAxMy0wNy0zMCAgTWFyayBIYWhuZW5iZXJnICA8bWhhaG5lbmJlcmdA YXBwbGUuY29tPgogCiAgICAgICAgIEdldEJ5VmFsIG9uIEFyZ3VtZW50cyBkb2VzIHRoZSB3cm9u ZyBzaXplIGxvYWQgd2hlbiBjaGVja2luZyB0aGUgQXJndW1lbnRzIG9iamVjdCBsZW5ndGgKSW5k ZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklUU3R1YnNYODYuaAo9PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0t LSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L0pJVFN0dWJzWDg2LmgJKHJldmlzaW9uIDE1MzUx MikKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklUU3R1YnNYODYuaAkod29ya2luZyBj b3B5KQpAQCAtMzE1LDExICszMTUsNiBAQCBleHRlcm4gIkMiIHsKICAgICAgICAgICAgIG1vdiBl Y3gsIGVkaTsKICAgICAgICAgICAgIGNhbGwgY3RpX3ZtX3Rocm93X3Nsb3dwYXRoOwogICAgICAg ICAgICAgLy8gV2hlbiBjdGlfdm1fdGhyb3dfc2xvd3BhdGggcmV0dXJucywgZWF4IGhhcyBjYWxs RnJhbWUgYW5kIGVkeCBoYXMgaGFuZGxlciBhZGRyZXNzCi0gICAgICAgICAgICBhZGQgZXNwLCAw eDNjOwotICAgICAgICAgICAgcG9wIGVieDsKLSAgICAgICAgICAgIHBvcCBlZGk7Ci0gICAgICAg ICAgICBwb3AgZXNpOwotICAgICAgICAgICAgcG9wIGVicDsKICAgICAgICAgICAgIGptcCBlZHgK ICAgICAgICAgICAgIHJldDsKICAgICAgICAgfQo= 207857 2013-07-31 10:22:22 -0700 2013-07-31 10:30:54 -0700 Updated Patch 119339-2.patch text/plain 1599 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTUzNTI1KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBA CisyMDEzLTA3LTMxICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIFtXaW5dIEphdmFTY3JpcHQgY3Jhc2guCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQu b3JnL3Nob3dfYnVnLmNnaT9pZD0xMTkzMzkKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkg KE9PUFMhKS4KKworICAgICAgICAqIGppdC9KSVRTdHVic1g4Ni5oOiBJbXBsZW1lbnQgY3RpVk1U aHJvd1RyYW1wb2xpbmUgYW5kCisJY3RpVk1UaHJvd1RyYW1wb2xpbmVTbG93cGF0aCB0aGUgc2Ft ZSB3YXkgYXMgdGhlIGdjYyB4ODYgdmVyc2lvbiBkb2VzLgorCiAyMDEzLTA3LTMwICBNYXJrIEhh aG5lbmJlcmcgIDxtaGFobmVuYmVyZ0BhcHBsZS5jb20+CiAKICAgICAgICAgR2V0QnlWYWwgb24g QXJndW1lbnRzIGRvZXMgdGhlIHdyb25nIHNpemUgbG9hZCB3aGVuIGNoZWNraW5nIHRoZSBBcmd1 bWVudHMgb2JqZWN0IGxlbmd0aApJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2ppdC9KSVRT dHVic1g4Ni5oCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklUU3R1 YnNYODYuaAkocmV2aXNpb24gMTUzNTE2KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2ppdC9K SVRTdHVic1g4Ni5oCSh3b3JraW5nIGNvcHkpCkBAIC0zMDAsMTIgKzMwMCw3IEBAIGV4dGVybiAi QyIgewogICAgICAgICBfX2FzbSB7CiAgICAgICAgICAgICBtb3YgZWN4LCBlc3A7CiAgICAgICAg ICAgICBjYWxsIGN0aV92bV90aHJvdzsKLSAgICAgICAgICAgIGFkZCBlc3AsIDB4M2M7Ci0gICAg ICAgICAgICBwb3AgZWJ4OwotICAgICAgICAgICAgcG9wIGVkaTsKLSAgICAgICAgICAgIHBvcCBl c2k7Ci0gICAgICAgICAgICBwb3AgZWJwOwotICAgICAgICAgICAgcmV0OworICAgICAgICAgICAg aW50IDM7CiAgICAgICAgIH0KICAgICB9CiAKQEAgLTMxNSwxMyArMzEwLDcgQEAgZXh0ZXJuICJD IiB7CiAgICAgICAgICAgICBtb3YgZWN4LCBlZGk7CiAgICAgICAgICAgICBjYWxsIGN0aV92bV90 aHJvd19zbG93cGF0aDsKICAgICAgICAgICAgIC8vIFdoZW4gY3RpX3ZtX3Rocm93X3Nsb3dwYXRo IHJldHVybnMsIGVheCBoYXMgY2FsbEZyYW1lIGFuZCBlZHggaGFzIGhhbmRsZXIgYWRkcmVzcwot ICAgICAgICAgICAgYWRkIGVzcCwgMHgzYzsKLSAgICAgICAgICAgIHBvcCBlYng7Ci0gICAgICAg ICAgICBwb3AgZWRpOwotICAgICAgICAgICAgcG9wIGVzaTsKLSAgICAgICAgICAgIHBvcCBlYnA7 CiAgICAgICAgICAgICBqbXAgZWR4Ci0gICAgICAgICAgICByZXQ7CiAgICAgICAgIH0KICAgICB9 CiAK 207859 2013-07-31 10:30:54 -0700 2013-07-31 11:02:36 -0700 Patch with tab character removed 119339-3.patch text/plain 1606 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTUzNTI1KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBA CisyMDEzLTA3LTMxICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIFtXaW5dIEphdmFTY3JpcHQgY3Jhc2guCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQu b3JnL3Nob3dfYnVnLmNnaT9pZD0xMTkzMzkKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkg KE9PUFMhKS4KKworICAgICAgICAqIGppdC9KSVRTdHVic1g4Ni5oOiBJbXBsZW1lbnQgY3RpVk1U aHJvd1RyYW1wb2xpbmUgYW5kCisgICAgICAgIGN0aVZNVGhyb3dUcmFtcG9saW5lU2xvd3BhdGgg dGhlIHNhbWUgd2F5IGFzIHRoZSBnY2MgeDg2IHZlcnNpb24gZG9lcy4KKwogMjAxMy0wNy0zMCAg TWFyayBIYWhuZW5iZXJnICA8bWhhaG5lbmJlcmdAYXBwbGUuY29tPgogCiAgICAgICAgIEdldEJ5 VmFsIG9uIEFyZ3VtZW50cyBkb2VzIHRoZSB3cm9uZyBzaXplIGxvYWQgd2hlbiBjaGVja2luZyB0 aGUgQXJndW1lbnRzIG9iamVjdCBsZW5ndGgKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9q aXQvSklUU3R1YnNYODYuaAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaml0 L0pJVFN0dWJzWDg2LmgJKHJldmlzaW9uIDE1MzUxNikKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29y ZS9qaXQvSklUU3R1YnNYODYuaAkod29ya2luZyBjb3B5KQpAQCAtMzAwLDEyICszMDAsNyBAQCBl eHRlcm4gIkMiIHsKICAgICAgICAgX19hc20gewogICAgICAgICAgICAgbW92IGVjeCwgZXNwOwog ICAgICAgICAgICAgY2FsbCBjdGlfdm1fdGhyb3c7Ci0gICAgICAgICAgICBhZGQgZXNwLCAweDNj OwotICAgICAgICAgICAgcG9wIGVieDsKLSAgICAgICAgICAgIHBvcCBlZGk7Ci0gICAgICAgICAg ICBwb3AgZXNpOwotICAgICAgICAgICAgcG9wIGVicDsKLSAgICAgICAgICAgIHJldDsKKyAgICAg ICAgICAgIGludCAzOwogICAgICAgICB9CiAgICAgfQogCkBAIC0zMTUsMTMgKzMxMCw3IEBAIGV4 dGVybiAiQyIgewogICAgICAgICAgICAgbW92IGVjeCwgZWRpOwogICAgICAgICAgICAgY2FsbCBj dGlfdm1fdGhyb3dfc2xvd3BhdGg7CiAgICAgICAgICAgICAvLyBXaGVuIGN0aV92bV90aHJvd19z bG93cGF0aCByZXR1cm5zLCBlYXggaGFzIGNhbGxGcmFtZSBhbmQgZWR4IGhhcyBoYW5kbGVyIGFk ZHJlc3MKLSAgICAgICAgICAgIGFkZCBlc3AsIDB4M2M7Ci0gICAgICAgICAgICBwb3AgZWJ4Owot ICAgICAgICAgICAgcG9wIGVkaTsKLSAgICAgICAgICAgIHBvcCBlc2k7Ci0gICAgICAgICAgICBw b3AgZWJwOwogICAgICAgICAgICAgam1wIGVkeAotICAgICAgICAgICAgcmV0OwogICAgICAgICB9 CiAgICAgfQogCg==