141028 2015-01-29 01:38:12 -0800 Crash in JSC::DFG::StackLayoutPhase::run 2015-04-08 15:10:09 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED INVALID InRadar P2 Critical --- 1 cwhan.tunz webkit-unassigned fpizlo ggaren mark.lam msaboff oliver ossy webkit-bug-importer oldest_to_newest 1065189 0 cwhan.tunz 2015-01-29 01:38:12 -0800 --- function f(arguments) { arguments; f.apply(null, ['']); } f() --- This code crash. (also in safari) I think 'arguments' is problem. it may think 'arguments' as the origin 'arguments' object. I found it with afl-fuzz. ASSERTION FAILED: usesArguments() (gdb) bt #0 0x00007ffff73d9399 in WTFCrash () at /development/tunz/javascript/webkit/Source/WTF/wtf/Assertions.cpp:321 #1 0x00007ffff6d249fd in JSC::CodeBlock::argumentsRegister (this=0x7ffff7fbcb40) at /development/tunz/javascript/webkit/Source/JavaScriptCore/bytecode/CodeBlock.h:344 #2 0x00007ffff6e27d75 in JSC::DFG::Graph::argumentsRegisterFor (this=0x7ffffffef2e0, inlineCallFrame=0x7ffff7f9b5f0) at /development/tunz/javascript/webkit/Source/JavaScriptCore/dfg/DFGGraph.h:415 #3 0x00007ffff6ff9880 in JSC::DFG::StackLayoutPhase::run (this=0x7ffffffeed50) at /development/tunz/javascript/webkit/Source/JavaScriptCore/dfg/DFGStackLayoutPhase.cpp:112 #4 0x00007ffff6ffa8a2 in JSC::DFG::runAndLog<JSC::DFG::StackLayoutPhase> (phase=...) at /development/tunz/javascript/webkit/Source/JavaScriptCore/dfg/DFGPhase.h:77 #5 0x00007ffff6ffa742 in JSC::DFG::runPhase<JSC::DFG::StackLayoutPhase> (graph=...) at /development/tunz/javascript/webkit/Source/JavaScriptCore/dfg/DFGPhase.h:87 #6 0x00007ffff6ff8d66 in JSC::DFG::performStackLayout (graph=...) at /development/tunz/javascript/webkit/Source/JavaScriptCore/dfg/DFGStackLayoutPhase.cpp:272 #7 0x00007ffff6f4ee5b in JSC::DFG::Plan::compileInThreadImpl (this=0x7ffff7fbc6c0, longLivedState=...) at /development/tunz/javascript/webkit/Source/JavaScriptCore/dfg/DFGPlan.cpp:295 #8 0x00007ffff6f4e652 in JSC::DFG::Plan::compileInThread (this=0x7ffff7fbc6c0, longLivedState=..., threadData=0x0) at /development/tunz/javascript/webkit/Source/JavaScriptCore/dfg/DFGPlan.cpp:164 #9 0x00007ffff6e9dcb2 in JSC::DFG::compileImpl (vm=..., codeBlock=0x7ffff7fbc900, profiledDFGCodeBlock=0x0, mode=JSC::DFG::DFGMode, osrEntryBytecodeIndex=0, mustHandleValues=..., callback=...) at /development/tunz/javascript/webkit/Source/JavaScriptCore/dfg/DFGDriver.cpp:111 #10 0x00007ffff6e9ddce in JSC::DFG::compile (vm=..., codeBlock=0x7ffff7fbc900, profiledDFGCodeBlock=0x0, mode=JSC::DFG::DFGMode, osrEntryBytecodeIndex=0, mustHandleValues=..., passedCallback=...) at /development/tunz/javascript/webkit/Source/JavaScriptCore/dfg/DFGDriver.cpp:131 #11 0x00007ffff70eb83e in JSC::operationOptimize (exec=0x7ffffffefc90, bytecodeIndex=0) at /development/tunz/javascript/webkit/Source/JavaScriptCore/jit/JITOperations.cpp:1196 1065190 1 245614 cwhan.tunz 2015-01-29 01:40:17 -0800 Created attachment 245614 Patch 1066280 2 webkit-bug-importer 2015-02-02 15:51:40 -0800 <rdar://problem/19692411> 1066306 3 245915 cwhan.tunz 2015-02-02 17:36:53 -0800 Created attachment 245915 Patch 1083735 4 245915 fpizlo 2015-04-08 14:20:06 -0700 Comment on attachment 245915 Patch We removed this usesArguments() stuff. 1083747 5 245915 ggaren 2015-04-08 15:05:25 -0700 Comment on attachment 245915 Patch Should we still take these additional regression tests, since they presumably cover something that was not covered before? 1083749 6 fpizlo 2015-04-08 15:10:09 -0700 (In reply to comment #5) > Comment on attachment 245915 [details] > Patch > > Should we still take these additional regression tests, since they > presumably cover something that was not covered before? Nah. Previously, if you said "arguments" then the whole compiler - every compiler in every tier - would flip into this alternate reality world. So we were steadily converging towards having two versions of every test: one that said "arguments" and one that didn't. This isn't true anymore. Saying "arguments" only changes how the arguments themselves are accessed but after bytecode generation, none of the tiers really care. So, having tests for recursion using apply where you say "arguments" isn't really useful. There's nothing special about that anymore. 245614 2015-01-29 01:40:17 -0800 2015-02-02 17:36:53 -0800 Patch jsc_crash2.patch text/plain 1518 cwhan.tunz SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTc5MzM4KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBA CisyMDE1LTAxLTI5ICBIYW4gQ2hvb25nd29vICA8Y3doYW4udHVuekBnbWFpbC5jb20+CisKKyAg ICAgICAgQ3Jhc2ggaW4gSlNDOjpERkc6OlN0YWNrTGF5b3V0UGhhc2U6OnJ1bgorICAgICAgICBo dHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTQxMDI4CisKKyAgICAgICAg UmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBydW50aW1lL0V4ZWN1dGFi bGUuaDoKKyAgICAgICAgKEpTQzo6U2NyaXB0RXhlY3V0YWJsZTo6dXNlc0FyZ3VtZW50cyk6CisK IDIwMTUtMDEtMjggIEdlb2ZmcmV5IEdhcmVuICA8Z2dhcmVuQGFwcGxlLmNvbT4KIAogICAgICAg ICBSZW1vdmVkIGZhc3RNYWxsb2NGb3JiaWQgLyBmYXN0TWFsbG9jQWxsb3cKSW5kZXg6IFNvdXJj ZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0V4ZWN1dGFibGUuaAo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3Vy Y2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9FeGVjdXRhYmxlLmgJKHJldmlzaW9uIDE3OTMzOCkK KysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0V4ZWN1dGFibGUuaAkod29ya2luZyBj b3B5KQpAQCAtMzY1LDcgKzM2NSw3IEBAIHB1YmxpYzoKICAgICB1bnNpZ25lZCB0eXBlUHJvZmls aW5nRW5kT2Zmc2V0KCkgY29uc3QgeyByZXR1cm4gbV90eXBlUHJvZmlsaW5nRW5kT2Zmc2V0OyB9 CiAKICAgICBib29sIHVzZXNFdmFsKCkgY29uc3QgeyByZXR1cm4gbV9mZWF0dXJlcyAmIEV2YWxG ZWF0dXJlOyB9Ci0gICAgYm9vbCB1c2VzQXJndW1lbnRzKCkgY29uc3QgeyByZXR1cm4gbV9mZWF0 dXJlcyAmIEFyZ3VtZW50c0ZlYXR1cmU7IH0KKyAgICBib29sIHVzZXNBcmd1bWVudHMoKSBjb25z dCB7IHJldHVybiAobV9mZWF0dXJlcyAmIEFyZ3VtZW50c0ZlYXR1cmUpICYmICEobV9mZWF0dXJl cyAmIFNoYWRvd3NBcmd1bWVudHNGZWF0dXJlKTsgfQogICAgIGJvb2wgbmVlZHNBY3RpdmF0aW9u KCkgY29uc3QgeyByZXR1cm4gbV9oYXNDYXB0dXJlZFZhcmlhYmxlcyB8fCBtX2ZlYXR1cmVzICYg KEV2YWxGZWF0dXJlIHwgV2l0aEZlYXR1cmUgfCBDYXRjaEZlYXR1cmUpOyB9CiAgICAgYm9vbCBp c1N0cmljdE1vZGUoKSBjb25zdCB7IHJldHVybiBtX2ZlYXR1cmVzICYgU3RyaWN0TW9kZUZlYXR1 cmU7IH0KICAgICBFQ01BTW9kZSBlY21hTW9kZSgpIGNvbnN0IHsgcmV0dXJuIGlzU3RyaWN0TW9k ZSgpID8gU3RyaWN0TW9kZSA6IE5vdFN0cmljdE1vZGU7IH0K 245915 2015-02-02 17:36:53 -0800 2015-04-08 14:20:06 -0700 Patch jsc_crash2.patch text/plain 4293 cwhan.tunz SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTc5NTMwKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBA CisyMDE1LTAyLTAyICBIYW4gQ2hvb25nd29vICA8Y3doYW4udHVuekBnbWFpbC5jb20+CisKKyAg ICAgICAgQ3Jhc2ggaW4gSlNDOjpERkc6OlN0YWNrTGF5b3V0UGhhc2U6OnJ1bgorICAgICAgICBo dHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTQxMDI4CisKKyAgICAgICAg UmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBydW50aW1lL0V4ZWN1dGFi bGUuaDoKKyAgICAgICAgKEpTQzo6U2NyaXB0RXhlY3V0YWJsZTo6dXNlc0FyZ3VtZW50cyk6CisK IDIwMTUtMDItMDIgIEZpbGlwIFBpemxvICA8ZnBpemxvQGFwcGxlLmNvbT4KIAogICAgICAgICBb RlRMXSBpbmxpbmVkIEdldE15QXJndW1lbnRCeVZhbCB3aXRoIG5vIGFyZ3VtZW50cyBwYXNzZWQg Y2F1c2VzIGluc3RhbnQgY3Jhc2gKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1l L0V4ZWN1dGFibGUuaAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGlt ZS9FeGVjdXRhYmxlLmgJKHJldmlzaW9uIDE3OTUyOCkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29y ZS9ydW50aW1lL0V4ZWN1dGFibGUuaAkod29ya2luZyBjb3B5KQpAQCAtMzY1LDcgKzM2NSw3IEBA IHB1YmxpYzoKICAgICB1bnNpZ25lZCB0eXBlUHJvZmlsaW5nRW5kT2Zmc2V0KCkgY29uc3QgeyBy ZXR1cm4gbV90eXBlUHJvZmlsaW5nRW5kT2Zmc2V0OyB9CiAKICAgICBib29sIHVzZXNFdmFsKCkg Y29uc3QgeyByZXR1cm4gbV9mZWF0dXJlcyAmIEV2YWxGZWF0dXJlOyB9Ci0gICAgYm9vbCB1c2Vz QXJndW1lbnRzKCkgY29uc3QgeyByZXR1cm4gbV9mZWF0dXJlcyAmIEFyZ3VtZW50c0ZlYXR1cmU7 IH0KKyAgICBib29sIHVzZXNBcmd1bWVudHMoKSBjb25zdCB7IHJldHVybiAobV9mZWF0dXJlcyAm IEFyZ3VtZW50c0ZlYXR1cmUpICYmICEobV9mZWF0dXJlcyAmIFNoYWRvd3NBcmd1bWVudHNGZWF0 dXJlKTsgfQogICAgIGJvb2wgbmVlZHNBY3RpdmF0aW9uKCkgY29uc3QgeyByZXR1cm4gbV9oYXND YXB0dXJlZFZhcmlhYmxlcyB8fCBtX2ZlYXR1cmVzICYgKEV2YWxGZWF0dXJlIHwgV2l0aEZlYXR1 cmUgfCBDYXRjaEZlYXR1cmUpOyB9CiAgICAgYm9vbCBpc1N0cmljdE1vZGUoKSBjb25zdCB7IHJl dHVybiBtX2ZlYXR1cmVzICYgU3RyaWN0TW9kZUZlYXR1cmU7IH0KICAgICBFQ01BTW9kZSBlY21h TW9kZSgpIGNvbnN0IHsgcmV0dXJuIGlzU3RyaWN0TW9kZSgpID8gU3RyaWN0TW9kZSA6IE5vdFN0 cmljdE1vZGU7IH0KSW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBM YXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDE3OTUzMCkKKysrIExheW91dFRlc3RzL0No YW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBACisyMDE1LTAyLTAyICBIYW4g Q2hvb25nd29vICA8Y3doYW4udHVuekBnbWFpbC5jb20+CisKKyAgICAgICAgQ3Jhc2ggaW4gSlND OjpERkc6OlN0YWNrTGF5b3V0UGhhc2U6OnJ1bgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0 Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTQxMDI4CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisKKyAgICAgICAgKiBqcy9mdW5jdGlvbi1hcHBseS1hbGlhc2VkLWV4cGVjdGVk LnR4dDoKKyAgICAgICAgKiBqcy9zY3JpcHQtdGVzdHMvZnVuY3Rpb24tYXBwbHktYWxpYXNlZC5q czoKKyAgICAgICAgKHJlY3Vyc2VXaXRoUGFyYW1Bcmd1bWVudHMpOgorICAgICAgICAocmVjdXJz ZVdpdGhOb1BhcmFtQXJndW1lbnRzKToKKwogMjAxNS0wMi0wMiAgR3l1eW91bmcgS2ltICA8Z3l1 eW91bmcua2ltQHNhbXN1bmcuY29tPgogCiAgICAgICAgIFVucmV2aWV3ZWQsIEVGTCBnYXJkZW5p bmcuIFVwZGF0ZSBmbGFraW5lc3MgdGVzdHMgb24gVzNDIFNWRyAxLjEgdGVzdHMuCkluZGV4OiBM YXlvdXRUZXN0cy9qcy9mdW5jdGlvbi1hcHBseS1hbGlhc2VkLWV4cGVjdGVkLnR4dAo9PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09Ci0tLSBMYXlvdXRUZXN0cy9qcy9mdW5jdGlvbi1hcHBseS1hbGlhc2VkLWV4cGVjdGVkLnR4 dAkocmV2aXNpb24gMTc5NTI4KQorKysgTGF5b3V0VGVzdHMvanMvZnVuY3Rpb24tYXBwbHktYWxp YXNlZC1leHBlY3RlZC50eHQJKHdvcmtpbmcgY29weSkKQEAgLTI1LDYgKzI1LDggQEAgUEFTUyBt eUZ1bmN0aW9uV2l0aEFwcGx5LmFsaWFzZWRBcHBseShteQogUEFTUyBteUZ1bmN0aW9uLmFwcGx5 KG51bGwsIG5ldyBBcnJheSg1MDAwMDAwKSkgdGhyZXcgZXhjZXB0aW9uIFJhbmdlRXJyb3I6IE1h eGltdW0gY2FsbCBzdGFjayBzaXplIGV4Y2VlZGVkLi4KIFBBU1MgbXlGdW5jdGlvbi5hcHBseShu dWxsLCBuZXcgQXJyYXkoMSA8PCAzMCkpIHRocmV3IGV4Y2VwdGlvbiBSYW5nZUVycm9yOiBNYXhp bXVtIGNhbGwgc3RhY2sgc2l6ZSBleGNlZWRlZC4uCiBQQVNTIHJlY3Vyc2VBcmd1bWVudHMuYXBw bHkobnVsbCwgbmV3IEFycmF5KDUwMDAwKSkgdGhyZXcgZXhjZXB0aW9uIFJhbmdlRXJyb3I6IE1h eGltdW0gY2FsbCBzdGFjayBzaXplIGV4Y2VlZGVkLi4KK1BBU1MgcmVjdXJzZVdpdGhOb1BhcmFt QXJndW1lbnRzLmFwcGx5KG51bGwsIFsnJ10pIHRocmV3IGV4Y2VwdGlvbiBSYW5nZUVycm9yOiBN YXhpbXVtIGNhbGwgc3RhY2sgc2l6ZSBleGNlZWRlZC4uCitQQVNTIHJlY3Vyc2VXaXRoUGFyYW1B cmd1bWVudHMuYXBwbHkobnVsbCwgWycnXSkgdGhyZXcgZXhjZXB0aW9uIFJhbmdlRXJyb3I6IE1h eGltdW0gY2FsbCBzdGFjayBzaXplIGV4Y2VlZGVkLi4KIFBBU1Mgc3VjY2Vzc2Z1bGx5UGFyc2Vk IGlzIHRydWUKIAogVEVTVCBDT01QTEVURQpJbmRleDogTGF5b3V0VGVzdHMvanMvc2NyaXB0LXRl c3RzL2Z1bmN0aW9uLWFwcGx5LWFsaWFzZWQuanMKPT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMv anMvc2NyaXB0LXRlc3RzL2Z1bmN0aW9uLWFwcGx5LWFsaWFzZWQuanMJKHJldmlzaW9uIDE3OTUy OCkKKysrIExheW91dFRlc3RzL2pzL3NjcmlwdC10ZXN0cy9mdW5jdGlvbi1hcHBseS1hbGlhc2Vk LmpzCSh3b3JraW5nIGNvcHkpCkBAIC0yMCw2ICsyMCwxNiBAQCBmdW5jdGlvbiByZWN1cnNlQXJn dW1lbnRzKCkgewogICAgIHJlY3Vyc2VBcmd1bWVudHMuYXBwbHkobnVsbCwgYXJndW1lbnRzKTsK IH0KIAorZnVuY3Rpb24gcmVjdXJzZVdpdGhQYXJhbUFyZ3VtZW50cyhhcmd1bWVudHMpIHsKKyAg ICBhcmd1bWVudHM7CisgICAgcmVjdXJzZVdpdGhQYXJhbUFyZ3VtZW50cy5hcHBseShudWxsLCBb JyddKTsKK30KKworZnVuY3Rpb24gcmVjdXJzZVdpdGhOb1BhcmFtQXJndW1lbnRzKCkgeworICAg IGFyZ3VtZW50czsKKyAgICByZWN1cnNlV2l0aE5vUGFyYW1Bcmd1bWVudHMuYXBwbHkobnVsbCwg WycnXSk7Cit9CisKIG15RnVuY3Rpb25XaXRoQXBwbHkuYXBwbHkgPSBmdW5jdGlvbiAoYXJnMSkg eyByZXR1cm4gW3RoaXMsICJteUZ1bmN0aW9uV2l0aEFwcGx5LmFwcGx5IiwgYXJnMV0gfTsKIEZ1 bmN0aW9uLnByb3RvdHlwZS5hbGlhc2VkQXBwbHkgPSBGdW5jdGlvbi5wcm90b3R5cGUuYXBwbHk7 CiB2YXIgYXJnMUFycmF5ID0gWydhcmcxJ107CkBAIC01OSwzICs2OSw2IEBAIHN0YWNrT3ZlcmZs b3dUZXN0KCk7CiAKIC8vIEJsb3cgdGhlIHN0YWNrIHJlY3Vyc2luZyB3aXRoIGFyZ3VtZW50cwog c2hvdWxkVGhyb3coInJlY3Vyc2VBcmd1bWVudHMuYXBwbHkobnVsbCwgbmV3IEFycmF5KDUwMDAw KSkiKTsKKworc2hvdWxkVGhyb3coInJlY3Vyc2VXaXRoTm9QYXJhbUFyZ3VtZW50cy5hcHBseShu dWxsLCBbJyddKSIpOworc2hvdWxkVGhyb3coInJlY3Vyc2VXaXRoUGFyYW1Bcmd1bWVudHMuYXBw bHkobnVsbCwgWycnXSkiKTsK