137758 2014-10-15 16:53:05 -0700 REGRESSION(r174025): remote inspector crashes frequently when executing inspector frontend's JavaScript 2014-10-15 17:15:18 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 1 msaboff msaboff oldest_to_newest 1042007 0 msaboff 2014-10-15 16:53:05 -0700 Change set r174025 <http://trac.webkit.org/changeset/174025> is causing crashes with traceback similar to below. Determined that reverting the change to PutByOffset case in FixupPhase::fixupNode seems to fix the issue. case PutByOffset: { if (!node->child1()->hasStorageResult()) fixEdge<KnownCellUse>(node->child1()); fixEdge<KnownCellUse>(node->child2()); insertStoreBarrier(m_indexInBlock, node->child2() /*, node->child3() */); <== delete the third parameter and use the default parameter break; Using the default third parameter cause insertStoreBarrier() to always insert a barrier, which will revert r174025 for just this section of code. This bug is to temporarily fix the crashes to give time to address the real underlying issue. Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x0000000110bf88a2 JSC::JSObject::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 1586 1 com.apple.JavaScriptCore 0x0000000110d501ec operationPutByIdNonStrictBuildList + 300 2 ??? 0x00003a20f6615c81 0 + 63913246940289 3 ??? 0x00003a20f6637f93 0 + 63913247080339 4 com.apple.JavaScriptCore 0x000000011102d72c llint_entry + 22132 5 com.apple.JavaScriptCore 0x000000011102d72c llint_entry + 22132 6 com.apple.JavaScriptCore 0x000000011102d72c llint_entry + 22132 7 com.apple.JavaScriptCore 0x000000011102d72c llint_entry + 22132 8 com.apple.JavaScriptCore 0x000000011102d797 llint_entry + 22239 9 com.apple.JavaScriptCore 0x0000000111027ea8 vmEntryToJavaScript + 326 10 com.apple.JavaScriptCore 0x0000000110f9b149 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 169 11 com.apple.JavaScriptCore 0x0000000110c1de44 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 468 12 com.apple.JavaScriptCore 0x0000000110c1dc5e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 13 com.apple.JavaScriptCore 0x0000000110d56aaa JSC::boundFunctionCall(JSC::ExecState*) + 586 14 ??? 0x00003a20f6601034 0 + 63913246855220 15 com.apple.JavaScriptCore 0x000000011102d961 llint_entry + 22697 16 com.apple.JavaScriptCore 0x000000011102d72c llint_entry + 22132 17 com.apple.JavaScriptCore 0x000000011102d72c llint_entry + 22132 18 com.apple.JavaScriptCore 0x0000000111027ea8 vmEntryToJavaScript + 326 19 com.apple.JavaScriptCore 0x0000000110f9b149 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 169 20 com.apple.JavaScriptCore 0x0000000110c1de44 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 468 21 com.apple.JavaScriptCore 0x0000000110de07ef JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, JSC::JSValue*) + 63 22 com.apple.WebCore 0x000000011143abb9 WebCore::ScheduledAction::executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue, WebCore::ScriptExecutionContext*) + 537 23 com.apple.WebCore 0x000000011143a92d WebCore::ScheduledAction::execute(WebCore::Document*) + 141 24 com.apple.WebCore 0x000000011143a76b WebCore::DOMTimer::fired() + 299 25 com.apple.WebCore 0x00000001112b884d WebCore::ThreadTimers::sharedTimerFiredInternal() + 157 26 com.apple.WebCore 0x00000001112b8774 WebCore::timerFired(__CFRunLoopTimer*, void*) + 20 27 com.apple.CoreFoundation 0x00007fff92845b44 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20 28 com.apple.CoreFoundation 0x00007fff928457d3 __CFRunLoopDoTimer + 1059 29 com.apple.CoreFoundation 0x00007fff928b8d9d __CFRunLoopDoTimers + 301 30 com.apple.CoreFoundation 0x00007fff92802268 __CFRunLoopRun + 2024 31 com.apple.CoreFoundation 0x00007fff92801838 CFRunLoopRunSpecific + 296 32 com.apple.HIToolbox 0x00007fff92d1743f RunCurrentEventLoopInMode + 235 33 com.apple.HIToolbox 0x00007fff92d171ba ReceiveNextEventCommon + 431 34 com.apple.HIToolbox 0x00007fff92d16ffb _BlockUntilNextEventMatchingListInModeWithFilter + 71 35 com.apple.AppKit 0x00007fff97b67821 _DPSNextEvent + 964 36 com.apple.AppKit 0x00007fff97b66fd0 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 194 37 com.apple.AppKit 0x00007fff97b5af73 -[NSApplication run] + 594 38 com.apple.AppKit 0x00007fff97b46424 NSApplicationMain + 1832 39 libxpc.dylib 0x00007fff988eeef2 _xpc_objc_main + 793 40 libxpc.dylib 0x00007fff988f0a9d xpc_main + 490 41 com.apple.WebKit.WebContent.Development 0x00000001096a8620 0x1096a7000 + 5664 42 libdyld.dylib 0x00007fff939fe5c9 start + 1 1042009 1 239908 msaboff 2014-10-15 17:04:23 -0700 Created attachment 239908 Patch 1042016 2 msaboff 2014-10-15 17:15:05 -0700 Committed r174749: <http://trac.webkit.org/changeset/174749>. 239908 2014-10-15 17:04:23 -0700 2014-10-15 17:15:18 -0700 Patch 137758.patch text/plain 1365 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTc0NzQ1KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBA CisyMDE0LTEwLTE1ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIFJFR1JFU1NJT04ocjE3NDAyNSk6IHJlbW90ZSBpbnNwZWN0b3IgY3Jhc2hlcyBmcmVxdWVu dGx5IHdoZW4gZXhlY3V0aW5nIGluc3BlY3RvciBmcm9udGVuZCdzIEphdmFTY3JpcHQKKyAgICAg ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEzNzc1OAorCisgICAg ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFJldmVydGVkIHIxNzQw MjUgZm9yIGp1c3QgUHV0QnlPZmZzZXQgTm9kZXMuCisKKyAgICAgICAgKiBkZmcvREZHRml4dXBQ aGFzZS5jcHA6CisgICAgICAgIChKU0M6OkRGRzo6Rml4dXBQaGFzZTo6Zml4dXBOb2RlKToKKwog MjAxNC0xMC0xNCAgR3l1eW91bmcgS2ltICA8Z3l1eW91bmcua2ltQHNhbXN1bmcuY29tPgogCiAg ICAgICAgIENsZWFuIHVwIHVubmVjZXNzYXJ5IFBhc3NPd25QdHIuaCBpbmNsdXNpb24KSW5kZXg6 IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHRml4dXBQaGFzZS5jcHAKPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdGaXh1cFBoYXNlLmNwcAkocmV2aXNpb24g MTc0NzQ1KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdGaXh1cFBoYXNlLmNwcAko d29ya2luZyBjb3B5KQpAQCAtOTQzLDcgKzk0Myw3IEBAIHByaXZhdGU6CiAgICAgICAgICAgICBp ZiAoIW5vZGUtPmNoaWxkMSgpLT5oYXNTdG9yYWdlUmVzdWx0KCkpCiAgICAgICAgICAgICAgICAg Zml4RWRnZTxLbm93bkNlbGxVc2U+KG5vZGUtPmNoaWxkMSgpKTsKICAgICAgICAgICAgIGZpeEVk Z2U8S25vd25DZWxsVXNlPihub2RlLT5jaGlsZDIoKSk7Ci0gICAgICAgICAgICBpbnNlcnRTdG9y ZUJhcnJpZXIobV9pbmRleEluQmxvY2ssIG5vZGUtPmNoaWxkMigpLCBub2RlLT5jaGlsZDMoKSk7 CisgICAgICAgICAgICBpbnNlcnRTdG9yZUJhcnJpZXIobV9pbmRleEluQmxvY2ssIG5vZGUtPmNo aWxkMigpKTsKICAgICAgICAgICAgIGJyZWFrOwogICAgICAgICB9CiAgICAgICAgICAgICAK