142625 2015-03-12 08:57:17 -0700 Crash in JSC::Interpreter::execute 2019-05-02 16:23:41 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) PC Linux RESOLVED FIXED InRadar P2 Normal --- 116980 1 rhodovan.u-szeged msaboff fpizlo ggaren mark.lam msaboff oliver ossy pikachu17997 webkit-bug-importer ysuzuki oldest_to_newest 1076643 0 248519 rhodovan.u-szeged 2015-03-12 08:57:17 -0700 Created attachment 248519 Test case If you load this with TotT JSC (on Ubuntu 14.04, x86_64): do eval("function fuzz() {}"); while(true); then you will get a crash with the following backtrace: Program received signal SIGSEGV, Segmentation fault. 0x00007ffff73de2d9 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 321 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007ffff73de2d9 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 #1 0x00000000004280fa in WTF::CrashOnOverflow::overflowed () at ../../Source/WTF/wtf/CheckedArithmetic.h:78 #2 0x00007ffff6ce7899 in WTF::Vector<JSC::WriteBarrier<JSC::FunctionExecutable>, 0ul, WTF::CrashOnOverflow>::at (this=0x7fffef7f06d0, i=0) at ../../Source/WTF/wtf/Vector.h:659 #3 0x00007ffff6cdf303 in WTF::Vector<JSC::WriteBarrier<JSC::FunctionExecutable>, 0ul, WTF::CrashOnOverflow>::operator[] (this=0x7fffef7f06d0, i=0) at ../../Source/WTF/wtf/Vector.h:679 #4 0x00007ffff6dd1ba8 in JSC::CodeBlock::functionDecl (this=0x7fffef7f04d0, index=0) at ../../Source/JavaScriptCore/bytecode/CodeBlock.h:657 #5 0x00007ffff709b0ee in JSC::Interpreter::execute (this=0x7fffefff6000, eval=0x7fffee16fb70, callFrame=0x7fffffffcac0, thisValue=..., scope=0x7fffee0af970) at ../../Source/JavaScriptCore/interpreter/Interpreter.cpp:1119 #6 0x00007ffff7096ca1 in JSC::eval (callFrame=0x7fffffffcac0) at ../../Source/JavaScriptCore/interpreter/Interpreter.cpp:134 #7 0x00007ffff70ce0a9 in JSC::operationCallEval (exec=0x7fffffffcb10, execCallee=0x7fffffffcac0) at ../../Source/JavaScriptCore/jit/JITOperations.cpp:638 #8 0x00007fffadfffe06 in ?? () #9 0x00007fffffffcb10 in ?? () #10 0x00007ffff738d751 in llint_entry () from /home/reni/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18 #11 0x00007ffff7387966 in vmEntryToJavaScript () from /home/reni/data/REPOS/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18 #12 0x00007ffff70be1fb in JSC::JITCode::execute (this=0x7fffefff7900, vm=0x7fffee010000, protoCallFrame=0x7fffffffcd30) at ../../Source/JavaScriptCore/jit/JITCode.cpp:77 #13 0x00007ffff70997dc in JSC::Interpreter::execute (this=0x7fffefff6000, program=0x7fffee16fc70, callFrame=0x7fffee0af9b0, thisObj=0x7fffee0cfaf0) at ../../Source/JavaScriptCore/interpreter/Interpreter.cpp:855 #14 0x00007ffff72299ca in JSC::evaluate (exec=0x7fffee0af9b0, source=..., thisValue=..., returnedException=0x7fffffffd6b0) at ../../Source/JavaScriptCore/runtime/Completion.cpp:81 #15 0x000000000042648f in runWithScripts (globalObject=0x7fffee0af970, scripts=..., dump=false) at ../../Source/JavaScriptCore/jsc.cpp:1264 #16 0x00000000004272c4 in jscmain (argc=2, argv=0x7fffffffd928) at ../../Source/JavaScriptCore/jsc.cpp:1481 #17 0x000000000042627a in main (argc=2, argv=0x7fffffffd928) at ../../Source/JavaScriptCore/jsc.cpp:1222 From Source/JavaScriptCore/interpreter/Interpreter.cpp: 1118 for (int i = 0; i < numFunctions; ++i) { 1119 FunctionExecutable* function = codeBlock->functionDecl(i); ... ... 1122 } The crash happens in line 1119. After a short debugging it seems that at the moment of the crash the index of the loop is 0 and the value of |numFunctions| is 1. However, since |codeBlock| doesn't contain any functionDeclarations at this point, we crash. One more note that could be important: the crash happens around the 4096th eval execution. 1079279 1 ossy 2015-03-23 05:14:56 -0700 (In reply to comment #0) ... > The crash happens in line 1119. After a short debugging it seems that at the > moment of the crash the index of the loop is 0 and the value of > |numFunctions| is 1. However, since |codeBlock| doesn't contain any > functionDeclarations at this point, we crash. One more note that could be > important: the crash happens around the 4096th eval execution. It's easy to reproduce it on Mac too. The test passes with disabled baseline JIT (LLINT only), with disabled DFG JIT (LLINT + baseline JIT), so the bug must be in the DFG JIT engine somewhere. 1087033 2 ossy 2015-04-21 03:51:32 -0700 This crash is still valid on Mac too. Any plan to fix it? 1087067 3 webkit-bug-importer 2015-04-21 09:18:41 -0700 <rdar://problem/20634024> 1087078 4 msaboff 2015-04-21 09:54:04 -0700 This was introduced in http://trac.webkit.org/changeset/180993. When we DFG compile, we call the CodeBlock::jettisonFunctionDeclsAndExprs() which will clear the functions from the list. When we go to eval the CodeBlock, the functions aren't there. 1087096 5 251240 msaboff 2015-04-21 10:54:17 -0700 Created attachment 251240 Patch 1087098 6 msaboff 2015-04-21 10:58:20 -0700 Committed r183067: <http://trac.webkit.org/changeset/183067> 248519 2015-03-12 08:57:17 -0700 2015-03-12 08:57:17 -0700 Test case crash.js application/javascript 48 rhodovan.u-szeged ZG8gCiAgICBldmFsKCJmdW5jdGlvbiBmdXp6KCkge30iKTsKd2hpbGUodHJ1ZSk7 251240 2015-04-21 10:54:17 -0700 2015-04-21 10:57:04 -0700 Patch 142625.patch text/plain 4953 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTgzMDY2KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE5IEBA CisyMDE1LTA0LTIxICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIENyYXNoIGluIEpTQzo6SW50ZXJwcmV0ZXI6OmV4ZWN1dGUKKyAgICAgICAgaHR0cHM6Ly9i dWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE0MjYyNQorCisgICAgICAgIFJldmlld2Vk IGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFdlIG5lZWQgdG8ga2VlcCB0aGUgRnVuY3Rp b25FeGVjdXRhYmxlcyBpbiB0aGUgY29kZSBibG9jayBmb3IgdGhlIGV2YWwgZmxhdm9yIG9mIAor ICAgICAgICBJbnRlcnByZXRlcjo6ZXhlY3V0ZSgpIGluIG9yZGVyIHRvIGNyZWF0ZSB0aGUgc2Nv cGUgdXNlZCB0byBldmFsLgorCisgICAgICAgICogYnl0ZWNvZGUvQ29kZUJsb2NrLmNwcDoKKyAg ICAgICAgKEpTQzo6Q29kZUJsb2NrOjpqZXR0aXNvbkZ1bmN0aW9uRGVjbHNBbmRFeHBycyk6IERl bGV0ZWQuCisgICAgICAgICogYnl0ZWNvZGUvQ29kZUJsb2NrLmg6CisgICAgICAgICogZGZnL0RG R0dyYXBoLmNwcDoKKyAgICAgICAgKEpTQzo6REZHOjpHcmFwaDo6cmVnaXN0ZXJGcm96ZW5WYWx1 ZXMpOgorCiAyMDE1LTA0LTIxICBDaHJpcyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CiAKICAg ICAgICAgTWFrZSBWZWN0b3IoY29uc3QgVmVjdG9yPFQsIG90aGVyQ2FwYWNpdHksIG90aGVyT3Zl cmZsb3dCZWhhdmlvdXI+JikgY29uc3RydWN0b3IgZXhwbGljaXQKSW5kZXg6IFNvdXJjZS9KYXZh U2NyaXB0Q29yZS9ieXRlY29kZS9Db2RlQmxvY2suY3BwCj09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9K YXZhU2NyaXB0Q29yZS9ieXRlY29kZS9Db2RlQmxvY2suY3BwCShyZXZpc2lvbiAxODMwNjYpCisr KyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvZGUvQ29kZUJsb2NrLmNwcAkod29ya2luZyBj b3B5KQpAQCAtMjkzNiwxMiArMjkzNiw2IEBAIGJvb2wgQ29kZUJsb2NrOjpmaW5kQ29uc3RhbnQo SlNWYWx1ZSB2LCAKICAgICByZXR1cm4gZmFsc2U7CiB9CiAKLXZvaWQgQ29kZUJsb2NrOjpqZXR0 aXNvbkZ1bmN0aW9uRGVjbHNBbmRFeHBycygpCi17Ci0gICAgbV9mdW5jdGlvbkRlY2xzLmNsZWFy KCk7Ci0gICAgbV9mdW5jdGlvbkV4cHJzLmNsZWFyKCk7Ci19Ci0KICNpZiBFTkFCTEUoSklUKQog dm9pZCBDb2RlQmxvY2s6OnVubGlua0NhbGxzKCkKIHsKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0 Q29yZS9ieXRlY29kZS9Db2RlQmxvY2suaAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlw dENvcmUvYnl0ZWNvZGUvQ29kZUJsb2NrLmgJKHJldmlzaW9uIDE4MzA2NikKKysrIFNvdXJjZS9K YXZhU2NyaXB0Q29yZS9ieXRlY29kZS9Db2RlQmxvY2suaAkod29ya2luZyBjb3B5KQpAQCAtNTk5 LDggKzU5OSw2IEBAIHB1YmxpYzoKICAgICBpbnQgbnVtYmVyT2ZGdW5jdGlvbkRlY2xzKCkgeyBy ZXR1cm4gbV9mdW5jdGlvbkRlY2xzLnNpemUoKTsgfQogICAgIEZ1bmN0aW9uRXhlY3V0YWJsZSog ZnVuY3Rpb25FeHByKGludCBpbmRleCkgeyByZXR1cm4gbV9mdW5jdGlvbkV4cHJzW2luZGV4XS5n ZXQoKTsgfQogICAgIAotICAgIHZvaWQgamV0dGlzb25GdW5jdGlvbkRlY2xzQW5kRXhwcnMoKTsK LQogICAgIFJlZ0V4cCogcmVnZXhwKGludCBpbmRleCkgY29uc3QgeyByZXR1cm4gbV91bmxpbmtl ZENvZGUtPnJlZ2V4cChpbmRleCk7IH0KIAogICAgIHVuc2lnbmVkIG51bWJlck9mQ29uc3RhbnRC dWZmZXJzKCkgY29uc3QKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHR3JhcGgu Y3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHR3JhcGguY3Bw CShyZXZpc2lvbiAxODMwNjYpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0dyYXBo LmNwcAkod29ya2luZyBjb3B5KQpAQCAtMTEyNiwxMCArMTEyNiw2IEBAIHZvaWQgR3JhcGg6OnJl Z2lzdGVyRnJvemVuVmFsdWVzKCkKICAgICB9CiAgICAgbV9jb2RlQmxvY2stPmNvbnN0YW50cygp LnNocmlua1RvRml0KCk7CiAgICAgbV9jb2RlQmxvY2stPmNvbnN0YW50c1NvdXJjZUNvZGVSZXBy ZXNlbnRhdGlvbigpLnNocmlua1RvRml0KCk7Ci0gICAgCi0gICAgLy8gV2UgaGF2ZSBubyB1c2Ug REZHIElSIGhhdmUgbm8gbmVlZCBmb3IgRnVuY3Rpb25FeGVjdXRhYmxlKidzIGluIHRoZSBDb2Rl QmxvY2ssIHNpbmNlIHdlCi0gICAgLy8gdXNlIGZyb3plbiB2YWx1ZXMgdG8gcmVmZXIgdG8gdGhl bS4KLSAgICBtX2NvZGVCbG9jay0+amV0dGlzb25GdW5jdGlvbkRlY2xzQW5kRXhwcnMoKTsKIH0K IAogdm9pZCBHcmFwaDo6dmlzaXRDaGlsZHJlbihTbG90VmlzaXRvciYgdmlzaXRvcikKSW5kZXg6 IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9DaGFuZ2VM b2cJKHJldmlzaW9uIDE4MzA2NikKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwkod29ya2luZyBj b3B5KQpAQCAtMSwzICsxLDE2IEBACisyMDE1LTA0LTIxICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJv ZmZAYXBwbGUuY29tPgorCisgICAgICAgIENyYXNoIGluIEpTQzo6SW50ZXJwcmV0ZXI6OmV4ZWN1 dGUKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE0MjYy NQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIE5ldyBy ZWdyZXNzaW9uIHRlc3QuCisKKyAgICAgICAgKiBqcy9yZWdyZXNzLTE0MjYyNS1leHBlY3RlZC50 eHQ6IEFkZGVkLgorICAgICAgICAqIGpzL3JlZ3Jlc3MtMTQyNjI1Lmh0bWw6IEFkZGVkLgorICAg ICAgICAqIGpzL3NjcmlwdC10ZXN0cy9yZWdyZXNzLTE0MjYyNS5qczogQWRkZWQuCisKIDIwMTUt MDQtMjAgIFNpbW9uIEZyYXNlciAgPHNpbW9uLmZyYXNlckBhcHBsZS5jb20+CiAKICAgICAgICAg UkVHUkVTU0lPTiAocjE3NzQ5NCk6IC13ZWJraXQtbWFzay1pbWFnZTogd2l0aCBkYXRhIFVSSSBm YWlscyBvbiBub24tbG9jYWwgZmlsZXMKSW5kZXg6IExheW91dFRlc3RzL2pzL3JlZ3Jlc3MtMTQy NjI1LWV4cGVjdGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9qcy9yZWdyZXNzLTE0 MjYyNS1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9qcy9yZWdyZXNz LTE0MjYyNS1leHBlY3RlZC50eHQJKHdvcmtpbmcgY29weSkKQEAgLTAsMCArMSwxMCBAQAorUmVn cmVzc2lvbiB0ZXN0IGZvciBodHRwczovL3dlYmtpdC5vcmcvYi8xNDI2MjUuIFRoaXMgdGVzdCBz aG91bGQgbm90IGNyYXNoLgorCitPbiBzdWNjZXNzLCB5b3Ugd2lsbCBzZWUgYSBzZXJpZXMgb2Yg IlBBU1MiIG1lc3NhZ2VzLCBmb2xsb3dlZCBieSAiVEVTVCBDT01QTEVURSIuCisKKworUEFTUyBF dmFsIG9mIERGRyBjb21waWxlZCBmdW5jdGlvbiBkaWRuJ3QgY3Jhc2gKK1BBU1Mgc3VjY2Vzc2Z1 bGx5UGFyc2VkIGlzIHRydWUKKworVEVTVCBDT01QTEVURQorCkluZGV4OiBMYXlvdXRUZXN0cy9q cy9yZWdyZXNzLTE0MjYyNS5odG1sCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2pzL3JlZ3Jl c3MtMTQyNjI1Lmh0bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9qcy9yZWdyZXNzLTE0 MjYyNS5odG1sCSh3b3JraW5nIGNvcHkpCkBAIC0wLDAgKzEsMTAgQEAKKzwhRE9DVFlQRSBIVE1M IFBVQkxJQyAiLS8vSUVURi8vRFREIEhUTUwvL0VOIj4KKzxodG1sPgorPGhlYWQ+Cis8c2NyaXB0 IHNyYz0iLi4vcmVzb3VyY2VzL2pzLXRlc3QtcHJlLmpzIj48L3NjcmlwdD4KKzwvaGVhZD4KKzxi b2R5PgorPHNjcmlwdCBzcmM9InNjcmlwdC10ZXN0cy9yZWdyZXNzLTE0MjYyNS5qcyI+PC9zY3Jp cHQ+Cis8c2NyaXB0IHNyYz0iLi4vcmVzb3VyY2VzL2pzLXRlc3QtcG9zdC5qcyI+PC9zY3JpcHQ+ Cis8L2JvZHk+Cis8L2h0bWw+CkluZGV4OiBMYXlvdXRUZXN0cy9qcy9zY3JpcHQtdGVzdHMvcmVn cmVzcy0xNDI2MjUuanMKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvanMvc2NyaXB0LXRlc3Rz L3JlZ3Jlc3MtMTQyNjI1LmpzCShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvanMvc2NyaXB0 LXRlc3RzL3JlZ3Jlc3MtMTQyNjI1LmpzCSh3b3JraW5nIGNvcHkpCkBAIC0wLDAgKzEsNiBAQAor ZGVzY3JpcHRpb24oIlJlZ3Jlc3Npb24gdGVzdCBmb3IgaHR0cHM6Ly93ZWJraXQub3JnL2IvMTQy NjI1LiBUaGlzIHRlc3Qgc2hvdWxkIG5vdCBjcmFzaC4iKTsKKworZm9yICh2YXIgaSA9IDA7IGkg PCAxMDAwMDsgaSsrKQorICAgIGV2YWwoImZ1bmN0aW9uIGZ1enooKSB7fSIpOworCit0ZXN0UGFz c2VkKCJFdmFsIG9mIERGRyBjb21waWxlZCBmdW5jdGlvbiBkaWRuJ3QgY3Jhc2giKTsK