124481 2013-11-17 23:55:11 -0800 ARM64 CRASH: Improper offset in getHostCallReturnValue() to access callerFrame in CallFrame 2013-11-18 10:17:08 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 116888 1 msaboff msaboff aestes oldest_to_newest 951503 0 msaboff 2013-11-17 23:55:11 -0800 In jit/JITOperations.cpp, the ARM64 version of getHostCallReturnValue() has the improper offset of -32. It should be changed to 0. #elif CPU(ARM64) asm ( ".text" "\n" ".align 2" "\n" ".globl " SYMBOL_STRING(getHostCallReturnValue) "\n" HIDE_SYMBOL(getHostCallReturnValue) "\n" SYMBOL_STRING(getHostCallReturnValue) ":" "\n" "ldur x25, [x25, #-32]" "\n" <== This should be "ldur x25, [x25, #0]" "mov x0, x25" "\n" "b " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n" ); 951506 1 aestes 2013-11-17 23:57:39 -0800 I'm building this change now. 951525 2 aestes 2013-11-18 01:09:10 -0800 Now we're just running in to this problem in MacroAssemblerARM64.h: void pop(RegisterID) NO_RETURN_DUE_TO_CRASH { CRASH(); } void push(RegisterID) NO_RETURN_DUE_TO_CRASH { CRASH(); } void push(Address) NO_RETURN_DUE_TO_CRASH { CRASH(); } void push(TrustedImm32) NO_RETURN_DUE_TO_CRASH { CRASH(); } Did you have a fix for this too? 951538 3 aestes 2013-11-18 01:59:42 -0800 After commenting out emitPointerValidation() in ThunkGenerators.cpp, I could successfully load apple.com. 951594 4 msaboff 2013-11-18 07:15:08 -0800 (In reply to comment #3) > After commenting out emitPointerValidation() in ThunkGenerators.cpp, I could successfully load apple.com. I'll post a patch soon. 951643 5 217206 msaboff 2013-11-18 10:04:34 -0800 Created attachment 217206 Patch 951646 6 217206 mark.lam 2013-11-18 10:10:11 -0800 Comment on attachment 217206 Patch r=me 951651 7 msaboff 2013-11-18 10:17:08 -0800 Committed r159428: <http://trac.webkit.org/changeset/159428> 217206 2013-11-18 10:04:34 -0800 2013-11-18 10:10:11 -0800 Patch 124481.patch text/plain 1399 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTU5NDI3KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBA CisyMDEzLTExLTE4ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIEFSTTY0IENSQVNIOiBJbXByb3BlciBvZmZzZXQgaW4gZ2V0SG9zdENhbGxSZXR1cm5WYWx1 ZSgpIHRvIGFjY2VzcyBjYWxsZXJGcmFtZSBpbiBDYWxsRnJhbWUKKyAgICAgICAgaHR0cHM6Ly9i dWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEyNDQ4MQorCisgICAgICAgIFJldmlld2Vk IGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEZpeGVkIHRoZSBvZmZzZXQgdG8gYWNjZXNz IENhbGxlckZyYW1lIGluIHRoZSBBUk02NCB2ZXJzaW9uIG9mIGdldEhvc3RDYWxsUmV0dXJuVmFs dWUoKSB0byBiZSAwCisgICAgICAgIHRvIGNvcnJlc3BvbmQgd2l0aCB0aGUgY2hhbmdlIGluIENh bGxGcmFtZSBsYXlvdXQgZG9uZSBpbiByMTU4MzE1LgorCisgICAgICAgICogaml0L0pJVE9wZXJh dGlvbnMuY3BwOgorCiAyMDEzLTExLTE4ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUu Y29tPgogCiAgICAgICAgIENyYXNoIGluIHZpcnR1YWxGb3JUaHVua0dlbmVyYXRvciBnZW5lcmF0 ZWQgY29kZSBvbiBBUk02NApJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2ppdC9KSVRPcGVy YXRpb25zLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L0pJVE9w ZXJhdGlvbnMuY3BwCShyZXZpc2lvbiAxNTk0MjIpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUv aml0L0pJVE9wZXJhdGlvbnMuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xNzY2LDcgKzE3NjYsNyBA QCBhc20gKAogIi5nbG9ibCAiIFNZTUJPTF9TVFJJTkcoZ2V0SG9zdENhbGxSZXR1cm5WYWx1ZSkg IlxuIgogSElERV9TWU1CT0woZ2V0SG9zdENhbGxSZXR1cm5WYWx1ZSkgIlxuIgogU1lNQk9MX1NU UklORyhnZXRIb3N0Q2FsbFJldHVyblZhbHVlKSAiOiIgIlxuIgotICAgICJsZHVyIHgyNSwgW3gy NSwgIy0zMl0iICJcbiIKKyAgICAibGR1ciB4MjUsIFt4MjUsICMwXSIgIlxuIgogICAgICAibW92 IHgwLCB4MjUiICJcbiIKICAgICAgImIgIiBMT0NBTF9SRUZFUkVOQ0UoZ2V0SG9zdENhbGxSZXR1 cm5WYWx1ZVdpdGhFeGVjU3RhdGUpICJcbiIKICk7Cg==