126557 2014-01-06 18:13:33 -0800 CStack Branch: ARM64 Crash in llint_function_for_call_arity_check running 3d-raytrace.js 2014-01-06 22:26:39 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 1 msaboff msaboff oldest_to_newest 964837 0 msaboff 2014-01-06 18:13:33 -0800 When running the sun spider test 3d-raytrace.js, we crash trying to validate the return PC in the frame after the frame was moved for arity in functionArityCheck() loadp CommonSlowPaths::ArityCheckData::returnPC[t1], t5 loadp CommonSlowPaths::ArityCheckData::paddedStackSpace[t1], t0 call t2 if ASSERT_ENABLED loadp ReturnPC[cfr], t0 loadp [t0], t0 <==== This fails due to a bad return PC value of 1. end 964838 1 220479 msaboff 2014-01-06 18:20:02 -0800 Created attachment 220479 Patch 964878 2 220479 ggaren 2014-01-06 21:30:27 -0800 Comment on attachment 220479 Patch r=me Would be nice to be able to assert that we match GPRInfo. 964885 3 msaboff 2014-01-06 22:06:12 -0800 Committed r161407: <http://trac.webkit.org/changeset/161407> 964893 4 msaboff 2014-01-06 22:26:39 -0800 (In reply to comment #2) > (From update of attachment 220479 [details]) > r=me > > Would be nice to be able to assert that we match GPRInfo. I agree. One thing we could do is modify the offline assembler to output some compile asserts before the inline assembly. 220479 2014-01-06 18:20:02 -0800 2014-01-06 21:30:27 -0800 Patch 126557.patch text/plain 2160 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTYxMzkxKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBA CisyMDE0LTAxLTA2ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIENTdGFjayBCcmFuY2g6IEFSTTY0IENyYXNoIGluIGxsaW50X2Z1bmN0aW9uX2Zvcl9jYWxs X2FyaXR5X2NoZWNrIHJ1bm5pbmcgM2QtcmF5dHJhY2UuanMKKyAgICAgICAgaHR0cHM6Ly9idWdz LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEyNjU1NworCisgICAgICAgIFJldmlld2VkIGJ5 IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFdlIHdlcmUgY3Jhc2hpbmcgZHVlIHRoZSB0byBk ZWZpbml0aW9uIG9mIHQ1IGluIHRoZSBvZmZsaW5lIGFzc2VtYmxlciBub3QKKyAgICAgICAgbWF0 Y2hpbmcgdGhlIGRlZmluaXRpb24gb2YgcmVnVDUgaW4gR1BSSW5mby5oLiAgVGhlIGNyYXNoIHdh cyBkdWUgdG8gcGFzc2luZworICAgICAgICB0aGUgc3R1YiByZXR1cm4gYWRkcmVzcyB0byB0aGUg Zml4dXAgdGh1bmsgaW4gcmVnVDUsIGJ1dCBpdCBjb250YWluZWQgZ2FyYmFnZS4KKyAgICAgICAg SSBjaGFuZ2VkIHRoZSBkZWZpbml0aW9ucyBvZiB0NCwgdDUgYW5kIHQ2IGluIHRoZSBBUk02NCBi YWNrIGVuZCBvZiB0aGUgb2ZmbGluZQorICAgICAgICBhc3NlbWJsZXIgdG8gbWF0Y2ggR1BSSW5m by5oLgorCisgICAgICAgICogb2ZmbGluZWFzbS9hcm02NC5yYjoKKwogMjAxNC0wMS0wNiAgTWlj aGFlbCBTYWJvZmYgIDxtc2Fib2ZmQGFwcGxlLmNvbT4KIAogICAgICAgICBDU3RhY2sgQnJhbmNo OiBEaXNhYmxlIEpJVCBzdGFjayBhbGlnbm1lbnQgY2hlY2sgZm9yIEFSTTY0CkluZGV4OiBTb3Vy Y2UvSmF2YVNjcmlwdENvcmUvb2ZmbGluZWFzbS9hcm02NC5yYgo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3Vy Y2UvSmF2YVNjcmlwdENvcmUvb2ZmbGluZWFzbS9hcm02NC5yYgkocmV2aXNpb24gMTYxMzg3KQor KysgU291cmNlL0phdmFTY3JpcHRDb3JlL29mZmxpbmVhc20vYXJtNjQucmIJKHdvcmtpbmcgY29w eSkKQEAgLTQwLDE0ICs0MCwxNCBAQCByZXF1aXJlICJyaXNjIgogIyAgeDEgID0+IHQxLCBhMSwg cjEKICMgIHgyICA9PiB0MiwgYTIKICMgIHgzICA9PiBhMworIyAgeDUgID0+IHQ1CisjICB4NiAg PT4gdDYKICMgIHg5ICA9PiAobm9uQXJnR1BSMSBpbiBiYXNlbGluZSkKLSMgeDEwICA9PiB0NCAo dW51c2VkIGluIGJhc2VsaW5lKQotIyB4MTEgID0+IHQ1ICh1bnVzZWQgaW4gYmFzZWxpbmUpCi0j IHgxMiAgPT4gdDYgKHVudXNlZCBpbiBiYXNlbGluZSkKICMgeDEzICA9PiBzY3JhdGNoICh1bnVz ZWQgaW4gYmFzZWxpbmUpCiAjIHgxNiAgPT4gc2NyYXRjaAogIyB4MTcgID0+IHNjcmF0Y2gKICMg eDIzICA9PiB0MworIyB4MjQgID0+IHQ0CiAjIHgyNyAgPT4gY3NyMSAodGFnVHlwZU51bWJlcikK ICMgeDI4ICA9PiBjc3IyICh0YWdNYXNrKQogIyB4MjkgID0+IGNmcgpAQCAtMTEzLDExICsxMTMs MTEgQEAgY2xhc3MgUmVnaXN0ZXJJRAogICAgICAgICB3aGVuICd0MycKICAgICAgICAgICAgIGFy bTY0R1BSTmFtZSgneDIzJywga2luZCkKICAgICAgICAgd2hlbiAndDQnCi0gICAgICAgICAgICBh cm02NEdQUk5hbWUoJ3gxMCcsIGtpbmQpCisgICAgICAgICAgICBhcm02NEdQUk5hbWUoJ3gyNCcs IGtpbmQpCiAgICAgICAgIHdoZW4gJ3Q1JwotICAgICAgICAgICAgYXJtNjRHUFJOYW1lKCd4MTEn LCBraW5kKQorICAgICAgICAgICAgYXJtNjRHUFJOYW1lKCd4NScsIGtpbmQpCiAgICAgICAgIHdo ZW4gJ3Q2JwotICAgICAgICAgICAgYXJtNjRHUFJOYW1lKCd4MTInLCBraW5kKQorICAgICAgICAg ICAgYXJtNjRHUFJOYW1lKCd4NicsIGtpbmQpCiAgICAgICAgIHdoZW4gJ2NmcicKICAgICAgICAg ICAgIGFybTY0R1BSTmFtZSgneDI5Jywga2luZCkKICAgICAgICAgd2hlbiAnY3NyMScK