132738 2014-05-09 05:18:53 -0700 REGRESSION(r167094): JSC crashes on ARM Traditional 2014-05-09 07:42:33 -0700 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 108645 131205 1 ossy mhodovan.u-szeged commit-queue mark.lam msaboff ossy zherczeg oldest_to_newest 1007952 0 ossy 2014-05-09 05:18:53 -0700 After r167094 JSC crashes at the beginning on ARM Traditional. Program received signal SIGSEGV, Segmentation fault. 0x0041e0ac in llint_entry () (gdb) bt #0 0x0041e0ac in llint_entry () #1 0x00000000 in ?? () 0x0041e09c <llint_entry+2680>: push {lr} 0x0041e0a0 <llint_entry+2684>: push {r11} 0x0041e0a4 <llint_entry+2688>: mov r11, sp 0x0041e0a8 <llint_entry+2692>: ldr r1, [r11, #8] => 0x0041e0ac <llint_entry+2696>: ldr r12, [r1, #316] ; 0x13c 0x0041e0b0 <llint_entry+2700>: adds r12, r12, #5 0x0041e0b4 <llint_entry+2704>: str r12, [r1, #316] ; 0x13c 0x0041e0b8 <llint_entry+2708>: bmi 0x41e0ec <llint_entry+2760> 0x0041e0bc <llint_entry+2712>: subs sp, sp, #8 0x0041e0c0 <llint_entry+2716>: mov r0, r11 0x0041e0c4 <llint_entry+2720>: mov r1, r9 0x0041e0c8 <llint_entry+2724>: bl 0x4dfab0 <llint_entry_osr> 0x0041e0cc <llint_entry+2728>: adds sp, sp, #8 0x0041e0d0 <llint_entry+2732>: tst r0, r0 0x0041e0d4 <llint_entry+2736>: beq 0x41e0e8 <llint_entry+2756> 0x0041e0d8 <llint_entry+2740>: mov sp, r11 0x0041e0dc <llint_entry+2744>: pop {r11} 0x0041e0e0 <llint_entry+2748>: pop {lr} The crash occurs inside the llint_program_prologue function. 1007963 1 mhodovan.u-szeged 2014-05-09 06:08:41 -0700 I managed to debug what happens here. The jump table contains invalid addresses and llint_program_prologue isn't called properly. The branch instruction jumps to 0x0041e0a2 instead of 0x0041e09c - the start of the function. 0x0041e0a2 isn't 4 bytes aligned, but the CPU starts executing this code from push {r11}, which breaks the stack and ldr tries to load from an invalid address. 1007966 2 231150 mhodovan.u-szeged 2014-05-09 06:22:05 -0700 Created attachment 231150 Proposed patch 1007972 3 231150 zherczeg 2014-05-09 07:10:55 -0700 Comment on attachment 231150 Proposed patch Nice catch. r=me 1007981 4 231150 commit-queue 2014-05-09 07:42:30 -0700 Comment on attachment 231150 Proposed patch Clearing flags on attachment: 231150 Committed r168530: <http://trac.webkit.org/changeset/168530> 1007982 5 commit-queue 2014-05-09 07:42:33 -0700 All reviewed patches have been landed. Closing bug. 231150 2014-05-09 06:22:05 -0700 2014-05-09 07:42:30 -0700 Proposed patch 0001-JSC-crashes-on-ARM-Traditional.patch text/plain 1726 mhodovan.u-szeged RnJvbSBmNzkyY2I5YWFmNzhhYmYxOThhZDQwMWU2NDhhODIxYzBjYzNmNTM2IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBtYXJ0aW4gPG1ob2RvdmFuLnUtc3plZ2VkQHBhcnRuZXIuc2Ft c3VuZy5jb20+CkRhdGU6IEZyaSwgOSBNYXkgMjAxNCAxNTowMjo0NiArMDIwMApTdWJqZWN0OiBb UEFUQ0hdIEpTQyBjcmFzaGVzIG9uIEFSTSBUcmFkaXRpb25hbAoKLS0tCiBTb3VyY2UvSmF2YVNj cmlwdENvcmUvQ2hhbmdlTG9nICAgICAgICAgICAgICAgICAgICAgfCAxMiArKysrKysrKysrKysK IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9sbGludC9Mb3dMZXZlbEludGVycHJldGVyLmFzbSB8ICAy ICstCiAyIGZpbGVzIGNoYW5nZWQsIDEzIGluc2VydGlvbnMoKyksIDEgZGVsZXRpb24oLSkKCmRp ZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFT Y3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCBhODUzMmE5Li45ZmFhYzhmIDEwMDY0NAotLS0gYS9T b3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29y ZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNSBAQAorMjAxNC0wNS0wOSAgTWFydGluIEhvZG92YW4g PG1ob2RvdmFuLnUtc3plZ2VkQHBhcnRuZXIuc2Ftc3VuZy5jb20+CisKKyAgICAgICAgUkVHUkVT U0lPTihyMTY3MDk0KTogSlNDIGNyYXNoZXMgb24gQVJNIFRyYWRpdGlvbmFsCisgICAgICAgIGh0 dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMzI3MzgKKworICAgICAgICBS ZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBQQyBpcyB0d28gaW5zdHJ1Y3Rp b25zIGFoZWFkIG9mIHRoZSBjdXJyZW50IGluc3RydWN0aW9uCisgICAgICAgIG9uIEFSTSBUcmFk aXRpb25hbCwgc28gdGhlIGRpc3RhbmNlIGlzIDggYnl0ZXMgbm90IDIuCisKKyAgICAgICAgKiBs bGludC9Mb3dMZXZlbEludGVycHJldGVyLmFzbToKKwogMjAxNC0wNS0wOSAgQWxiZXJ0byBHYXJj aWEgIDxiZXJ0b0BpZ2FsaWEuY29tPgogCiAgICAgICAgIGpzbWluLnB5IGxpY2Vuc2UgaGVhZGVy IGNvbmZ1c2luZywgbWVudGlvbnMgbm9uLWZyZWUgbGljZW5zZQpkaWZmIC0tZ2l0IGEvU291cmNl L0phdmFTY3JpcHRDb3JlL2xsaW50L0xvd0xldmVsSW50ZXJwcmV0ZXIuYXNtIGIvU291cmNlL0ph dmFTY3JpcHRDb3JlL2xsaW50L0xvd0xldmVsSW50ZXJwcmV0ZXIuYXNtCmluZGV4IDY1NTQ5OTYu LmZmZDEzODMgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9sbGludC9Mb3dMZXZl bEludGVycHJldGVyLmFzbQorKysgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvbGxpbnQvTG93TGV2 ZWxJbnRlcnByZXRlci5hc20KQEAgLTcwOSw3ICs3MDksNyBAQCBtYWNybyBpbml0UENSZWxhdGl2 ZShwY0Jhc2UpCiAgICAgZWxzaWYgQVJNIG9yIEFSTXY3X1RSQURJVElPTkFMCiAgICAgX3JlbGF0 aXZlUENCYXNlOgogICAgICAgICBtb3ZlIHBjLCBwY0Jhc2UKLSAgICAgICAgc3VicCAyLCBwY0Jh c2UKKyAgICAgICAgc3VicCA4LCBwY0Jhc2UKICAgICBlbHNpZiBNSVBTCiAgICAgICAgIGNyYXNo KCkgICMgTmVlZCB0byByZXBsYWNlIHdpdGggYW55IGluaXRpYWxpemF0aW9uIHN0ZXBzIG5lZWRl ZCB0byBzdGVwIHVwIFBDIHJlbGF0aXZlIGFkZHJlc3MgY2FsY3VsYXRpb24KICAgICBlbHNpZiBT SDQKLS0gCjEuOC4xLjIKCg==