143859 2015-04-16 19:32:08 -0700 A odd crash 2015-06-08 08:04:16 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified NEW P2 Normal --- 1 xinchao.peng webkit-unassigned bshafiei fpizlo ggaren kling mark.lam msaboff xinchao.peng ysuzuki oldest_to_newest 1086228 0 xinchao.peng 2015-04-16 19:32:08 -0700 I happend a odd crash : the Backtrace is below : WebKitWebProces: unhandled page fault (11) at 0x00000005, code 0x017 gdb) bt #0 0x9c579d5c in ?? () #1 0x4701ea60 in JSC::Watchdog::Scope::~Scope() () from SymbolFiles/mtd_exe/Webkit/libjavascriptcoregtk-3.0.so.0 #2 0x46e7bd00 in JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) () from SymbolFiles/mtd_exe/Webkit/libjavascriptcoregtk-3.0.so.0 #3 0x46f6fbb4 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) () from SymbolFiles/mtd_exe/Webkit/libjavascriptcoregtk-3.0.so.0 #4 0x44a6cbc0 in WebCore::ScheduledAction::executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue, WebCore::ScriptExecutionContext*) () from SymbolFiles/mtd_exe/Webkit/libwebkit2gtk-3.0.so.0 #5 0x44a6d320 in WebCore::ScheduledAction::execute(WebCore::Document*) () from SymbolFiles/mtd_exe/Webkit/libwebkit2gtk-3.0.so.0 #6 0x44a6d430 in WebCore::ScheduledAction::execute(WebCore::ScriptExecutionContext*) () from SymbolFiles/mtd_exe/Webkit/libwebkit2gtk-3.0.so.0 #7 0x44fbc534 in WebCore::DOMTimer::fired() () from SymbolFiles/mtd_exe/Webkit/libwebkit2gtk-3.0.so.0 #8 0x459e1c5c in WebCore::ThreadTimers::sharedTimerFiredInternal() () from SymbolFiles/mtd_exe/Webkit/libwebkit2gtk-3.0.so.0 #9 0x459e1cd8 in WebCore::ThreadTimers::sharedTimerFired() () from SymbolFiles/mtd_exe/Webkit/libwebkit2gtk-3.0.so.0 #10 0x45fe0cf0 in WebCore::timeout_cb(void*) () from SymbolFiles/mtd_exe/Webkit/libwebkit2gtk-3.0.so.0 #11 0x43f6e8d4 in ?? () #12 0x43f6e8d4 in ?? () Welcome to guess and analysis the reason ! Thank you 1086252 1 mark.lam 2015-04-16 22:55:27 -0700 1. Do you have steps to reproduce this? 2. If so, what revision # are you building? 1086255 2 xinchao.peng 2015-04-16 23:31:29 -0700 JS source code is that : setInterval(function() { ....... var $osd = $('#osd'); $osd.show(); setTimeout(function() { $osd.hide(); }, 5000); ... },1000); my webkit version is webkit-r150045. platform is arm-gtk . 1086258 3 mark.lam 2015-04-16 23:55:37 -0700 (In reply to comment #2) > JS source code is that : > > setInterval(function() { > ....... > var $osd = $('#osd'); > $osd.show(); > setTimeout(function() { > $osd.hide(); > }, 5000); > ... > },1000); > my webkit version is webkit-r150045. platform is arm-gtk . That is a very old version of the code. Try updating to the tip of tree and see if the issue still manifests. 1086525 4 xinchao.peng 2015-04-17 22:30:17 -0700 After running these JS Source code for 20 minute , Webprocess will coredump : <script> setInterval(function() { var d = new Date(); var time = d.getHours().addNulls() + ":" + d.getMinutes().addNulls(); var $osd = $('#osd'); $osd.show(); $osd.find(".channel_time").text(time); setTimeout(function() { $osd.hide(); }, 5000); }, 10000); Number.prototype.addNulls = function () { if (this < 10) { return "0" + this; } return this.toString(); } </script> I find two issue : 1: If disable DFG_JIT , the crash don't happen . 2. If "var time = d.getHours().addNulls() + ":" + d.getMinutes().addNulls();" is changed to "var time = d.getHours() + ":" + d.getMinutes();" The crash don't happen It looks like process happen crash when addNulls is called 1086537 5 xinchao.peng 2015-04-18 03:33:40 -0700 It look like JSC DFG happen error when running "return "0" + this;" Because i found that the crash usually happen when "if (this < 10)". 1086540 6 xinchao.peng 2015-04-18 04:41:03 -0700 The issue void SpeculativeJIT::compile(Node* node) { } 1086541 7 xinchao.peng 2015-04-18 04:43:54 -0700 void SpeculativeJIT::compile(Node* node) { .. . case ToThis: { ASSERT(node->child1().useKind() == UntypedUse); .... } In here , the value of "node->child1().useKind()" is UntypedUse . I feel very strange 。 why ? 1086544 8 mark.lam 2015-04-18 06:57:44 -0700 (In reply to comment #7) > > void SpeculativeJIT::compile(Node* node) > { > .. . > case ToThis: { > ASSERT(node->child1().useKind() == UntypedUse); > .... > > } > In here , the value of "node->child1().useKind()" is UntypedUse . > I feel very strange 。 > why ? Again, r150045 is very old (from 2 years ago). There has been many enhancements and bug fixes since then. Have you tried the latest revision (e.g. r182982) to see if the issue is still present? 1100309 9 xinchao.peng 2015-06-07 23:29:52 -0700 In the newest version (x86_gtk),The crash is still exist . case ToThis: { printf(" node->child1().useKind() =%d\n",node->child1().useKind()); ASSERT(node->child1().useKind() == UntypedUse); ---> crash here TestCase : <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>Tutorial Video Widget</title> <script> function onLoad() { setInterval(function() { var d = new Date(); var time = d.getHours().addNulls() + ":" + d.getMinutes().addNulls(); document.write("time="+time); document.write("<br>"); }, 1000); } Number.prototype.addNulls = function () { if (this < 100) { return "0" + this; } return this.toString(); } </script> </head> <body onload="onLoad();"> </body> </html> 1100312 10 254475 xinchao.peng 2015-06-07 23:39:56 -0700 Created attachment 254475 Patch 1100363 11 254475 fpizlo 2015-06-08 08:04:16 -0700 Comment on attachment 254475 Patch This is definitely not the right approach. You're just turning off ToThis in the DFG and creating a bunch of dead code. Note that the ToThis handling in DFG is designed to work with UntypedUse - so this patch doesn't make sense. 254475 2015-06-07 23:39:56 -0700 2015-06-08 08:04:16 -0700 Patch bug-143859-20150608143532.patch text/plain 2491 xinchao.peng U3VidmVyc2lvbiBSZXZpc2lvbjogMTg0ODQ4CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCBi NjVjNGE2ZDE2MjNjOTFiYTA5OWM0OTNmNzMzOGY5NjM5MmNhMjQ3Li5kNjgzMzYxZmZlZTBhMzAz MTQ2MzNkOGY2Yzg5MjQ5YmI5ZTIwNmY0IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxNSBAQAorMjAxNS0wNi0wNyAgUGVuZyBYaW5jaGFvICA8eGluY2hhby5wZW5nQHNhbXN1 bmcuY29tPgorCisgICAgICAgIFdoZW4gREZHIGNvbXBsaWUgVG9UaGlzIGFuZCB1c2VyS2luZCBp cyBVbnR5cGVkVXNlLCBJdCBpc25vdCBhbGxvd2VkIHRvIGNvbnRpbnVlIHRvIERGRyBjb21wbGll IGFuZCBpdCBzaG91bGQgZXhpdCBmb3JtIERGRy4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTE0Mzg1OQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgICogZGZnL0RGR1NwZWN1bGF0aXZlSklUMzJfNjQuY3BwOgor ICAgICAgICAoSlNDOjpERkc6OlNwZWN1bGF0aXZlSklUOjpjb21waWxlKToKKyAgICAgICAgKiBk ZmcvREZHU3BlY3VsYXRpdmVKSVQ2NC5jcHA6CisgICAgICAgIChKU0M6OkRGRzo6U3BlY3VsYXRp dmVKSVQ6OmNvbXBpbGUpOgorCiAyMDE1LTA1LTI0ICBKb3JkYW4gSGFyYmFuZCAgPGxqaGFyYkBn bWFpbC5jb20+CiAKICAgICAgICAgQXJyYXkjZmluZEluZGV4L2ZpbmQgc2hvdWxkIG5vdCBza2lw IGhvbGVzCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1NwZWN1bGF0 aXZlSklUMzJfNjQuY3BwIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdTcGVjdWxhdGl2 ZUpJVDMyXzY0LmNwcApvbGQgbW9kZSAxMDA2NDQKbmV3IG1vZGUgMTAwNzU1CmluZGV4IDI4YzVj YWE1ODU4OTYyNzQ0MTk5ZmEzYjMwZjUxZTk0MDk5NDllMjUuLmZlMDUyYTZiYzYwMmNkMDQwZTcz OGQwOTVkMDNiM2I4N2YwYmJhMjIKLS0tIGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdT cGVjdWxhdGl2ZUpJVDMyXzY0LmNwcAorKysgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RG R1NwZWN1bGF0aXZlSklUMzJfNjQuY3BwCkBAIC0zNTA0LDcgKzM1MDQsMTEgQEAgdm9pZCBTcGVj dWxhdGl2ZUpJVDo6Y29tcGlsZShOb2RlKiBub2RlKQogICAgIH0KICAgICAgICAgCiAgICAgY2Fz ZSBUb1RoaXM6IHsKLSAgICAgICAgQVNTRVJUKG5vZGUtPmNoaWxkMSgpLnVzZUtpbmQoKSA9PSBV bnR5cGVkVXNlKTsKKyAgICAgICAgaWYgKG5vZGUtPmNoaWxkMSgpLnVzZUtpbmQoKSA9PSBVbnR5 cGVkVXNlKSB7CisgICAgICAgICAgICB0ZXJtaW5hdGVTcGVjdWxhdGl2ZUV4ZWN1dGlvbihJbmFk ZXF1YXRlQ292ZXJhZ2UsIEpTVmFsdWVSZWdzKCksIDApOworICAgICAgICAgICAgYnJlYWs7Cisg ICAgICAgIH0KKwogICAgICAgICBKU1ZhbHVlT3BlcmFuZCB0aGlzVmFsdWUodGhpcywgbm9kZS0+ Y2hpbGQxKCkpOwogICAgICAgICBHUFJUZW1wb3JhcnkgdGVtcCh0aGlzKTsKICAgICAgICAgR1BS VGVtcG9yYXJ5IHRlbXBUYWcodGhpcyk7CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvZGZnL0RGR1NwZWN1bGF0aXZlSklUNjQuY3BwIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2Rm Zy9ERkdTcGVjdWxhdGl2ZUpJVDY0LmNwcApvbGQgbW9kZSAxMDA2NDQKbmV3IG1vZGUgMTAwNzU1 CmluZGV4IDI3Yjc3ZGY3MGJjYjYzMTJlNjY5MGMwMGFmMjQzMDFlNTEzYjcyODQuLjdjMjdmY2E5 M2IyYWRkYjMyNmFkMGMwMWYyNzU3MjQyYzc4Y2E1ZGYKLS0tIGEvU291cmNlL0phdmFTY3JpcHRD b3JlL2RmZy9ERkdTcGVjdWxhdGl2ZUpJVDY0LmNwcAorKysgYi9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvZGZnL0RGR1NwZWN1bGF0aXZlSklUNjQuY3BwCkBAIC0zNTY3LDcgKzM1NjcsMTAgQEAgdm9p ZCBTcGVjdWxhdGl2ZUpJVDo6Y29tcGlsZShOb2RlKiBub2RlKQogICAgIH0KICAgICAgICAgCiAg ICAgY2FzZSBUb1RoaXM6IHsKLSAgICAgICAgQVNTRVJUKG5vZGUtPmNoaWxkMSgpLnVzZUtpbmQo KSA9PSBVbnR5cGVkVXNlKTsKKyAgICAgICAgaWYgKG5vZGUtPmNoaWxkMSgpLnVzZUtpbmQoKSA9 PSBVbnR5cGVkVXNlKSB7CisgICAgICAgICAgICB0ZXJtaW5hdGVTcGVjdWxhdGl2ZUV4ZWN1dGlv bihJbmFkZXF1YXRlQ292ZXJhZ2UsIEpTVmFsdWVSZWdzKCksIDApOworICAgICAgICAgICAgYnJl YWs7CisgICAgICAgIH0KICAgICAgICAgSlNWYWx1ZU9wZXJhbmQgdGhpc1ZhbHVlKHRoaXMsIG5v ZGUtPmNoaWxkMSgpKTsKICAgICAgICAgR1BSVGVtcG9yYXJ5IHRlbXAodGhpcyk7CiAgICAgICAg IEdQUlJlZyB0aGlzVmFsdWVHUFIgPSB0aGlzVmFsdWUuZ3ByKCk7Cg==