145527 2015-06-01 15:02:38 -0700 Crash in com.apple.WebKit.WebContent at com.apple.JavaScriptCore: JSC::revertCall + 24 2015-06-02 16:33:29 -0700 1 1 1 Unclassified WebKit JavaScriptCore 312.x Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 145578 1 msaboff msaboff oldest_to_newest 1098596 0 msaboff 2015-06-01 15:02:38 -0700 Crashed Thread: 0 Dispatch queue: com.apple.main-thread Exception Type: EXC_BAD_ACCESS (SIGBUS) Exception Codes: KERN_PROTECTION_FAILURE at 0x00007fff8681a709 VM Regions Near 0x7fff8681a709: __TEXT 00007fff86817000-00007fff86818000 [ 4K] r-x/rwx SM=COW /System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate --> __TEXT 00007fff86818000-00007fff86835000 [ 116K] r-x/rwx SM=COW /usr/lib/system/libsystem_malloc.dylib __TEXT 00007fff86835000-00007fff8687c000 [ 284K] r-x/rwx SM=COW /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/DictionaryServices Application Specific Information: Bundle controller class: BrowserBundleController Process Model: Multiple Web Processes Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x00007fff8fd20c28 JSC::revertCall(JSC::RepatchBuffer&, JSC::VM*, JSC::CallLinkInfo&, JSC::MacroAssemblerCodeRef (*)(JSC::VM*)) + 24 1 com.apple.JavaScriptCore 0x00007fff8f9e62d8 JSC::CallLinkInfo::unlink(JSC::RepatchBuffer&) + 104 2 com.apple.JavaScriptCore 0x00007fff8fb4d708 JSC::PolymorphicCallNode::unlink(JSC::RepatchBuffer&) + 184 3 com.apple.JavaScriptCore 0x00007fff8f859ce8 JSC::CodeBlock::unlinkIncomingCalls() + 232 4 com.apple.JavaScriptCore 0x00007fff8fb3adaa JSC::ScriptExecutable::installCode(JSC::CodeBlock*) + 538 5 com.apple.JavaScriptCore 0x00007fff8fc265dd JSC::JITToDFGDeferredCompilationCallback::compilationDidComplete(JSC::CodeBlock*, JSC::CompilationResult) + 125 6 com.apple.JavaScriptCore 0x00007fff8fb3407d JSC::DFG::Worklist::completeAllReadyPlansForVM(JSC::VM&, JSC::DFG::CompilationKey) + 301 7 com.apple.JavaScriptCore 0x00007fff8fc19880 operationOptimize + 704 8 ??? 0x00002d1b2efa0044 0 + 49594775502916 9 ??? 0x00002d1b2f15ea25 0 + 49594777332261 10 ??? 0x00002d1b2f110a40 0 + 49594777012800 11 ??? 0x00002d1b2eeb7fba 0 + 49594774552506 12 ??? 0x00002d1b2f12b235 0 + 49594777121333 13 ??? 0x00002d1b2efa0511 0 + 49594775504145 14 com.apple.JavaScriptCore 0x00007fff8fcae268 llint_entry + 22722 15 com.apple.JavaScriptCore 0x00007fff8fcae268 llint_entry + 22722 16 com.apple.JavaScriptCore 0x00007fff8fcae268 llint_entry + 22722 17 com.apple.JavaScriptCore 0x00007fff8fcae1fd llint_entry + 22615 18 ??? 0x00002d1b2ef23746 0 + 49594774992710 19 com.apple.JavaScriptCore 0x00007fff8fcae1fd llint_entry + 22615 20 com.apple.JavaScriptCore 0x00007fff8fcae268 llint_entry + 22722 21 com.apple.JavaScriptCore 0x00007fff8fcae1fd llint_entry + 22615 22 com.apple.JavaScriptCore 0x00007fff8fcae1fd llint_entry + 22615 23 ??? 0x00002d1b2eeb1e5b 0 + 49594774527579 24 ??? 0x00002d1b2ee02afa 0 + 49594773809914 25 ??? 0x00002d1b2ef6ad78 0 + 49594775285112 26 com.apple.JavaScriptCore 0x00007fff8fca8796 vmEntryToJavaScript + 326 27 com.apple.JavaScriptCore 0x00007fff8fc0e809 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 169 28 com.apple.JavaScriptCore 0x00007fff8f832d7d JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 493 29 com.apple.JavaScriptCore 0x00007fff8f9e5e3f JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, JSC::JSValue*) + 63 30 com.apple.WebCore 0x00007fff934d8e89 WebCore::ScheduledAction::executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue, WebCore::ScriptExecutionContext&) + 537 31 com.apple.WebCore 0x00007fff934d8ae9 WebCore::ScheduledAction::execute(WebCore::Document&) + 137 32 com.apple.WebCore 0x00007fff929a0a6d WebCore::DOMTimer::fired() + 301 33 com.apple.WebCore 0x00007fff928520af WebCore::ThreadTimers::sharedTimerFiredInternal() + 175 34 com.apple.WebCore 0x00007fff92851fc4 WebCore::timerFired(__CFRunLoopTimer*, void*) + 20 35 com.apple.CoreFoundation 0x00007fff9069b964 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20 36 com.apple.CoreFoundation 0x00007fff9069b5fe __CFRunLoopDoTimer + 1022 37 com.apple.CoreFoundation 0x00007fff90715c7a __CFRunLoopDoTimers + 298 38 com.apple.CoreFoundation 0x00007fff9065726c __CFRunLoopRun + 1804 39 com.apple.CoreFoundation 0x00007fff906568f8 CFRunLoopRunSpecific + 296 40 com.apple.HIToolbox 0x00007fff8603769d RunCurrentEventLoopInMode + 235 41 com.apple.HIToolbox 0x00007fff86037429 ReceiveNextEventCommon + 432 42 com.apple.HIToolbox 0x00007fff86037261 _BlockUntilNextEventMatchingListInModeWithFilter + 71 43 com.apple.AppKit 0x00007fff8b937b84 _DPSNextEvent + 915 44 com.apple.AppKit 0x00007fff8b937152 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 324 45 com.apple.AppKit 0x00007fff8b92cefb -[NSApplication run] + 561 46 com.apple.AppKit 0x00007fff8b8ac5b4 NSApplicationMain + 1176 47 libxpc.dylib 0x00007fff88daef98 _xpc_objc_main + 793 48 libxpc.dylib 0x00007fff88db06e7 xpc_main + 494 49 com.apple.WebKit.WebContent 0x1049e5b30 main + 16 (/Library/Caches/com.apple.xbs/Sources/WebKit2/WebKit2-7601.1.23.4/Shared/EntryPointUtilities/mac/XPCService/XPCServiceMain.mm:80) 50 libdyld.dylib 0x00007fff855cb5ad start + 1 1098597 1 msaboff 2015-06-01 15:03:04 -0700 <rdar://problem/20701417> 1098600 2 254016 msaboff 2015-06-01 15:13:39 -0700 Created attachment 254016 Patch 1098626 3 254016 fpizlo 2015-06-01 16:11:52 -0700 Comment on attachment 254016 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=254016&action=review > Source/JavaScriptCore/jit/PolymorphicCallStubRoutine.cpp:116 > + for (Bag<PolymorphicCallNode>::iterator iter = m_callNodes.begin(); !!iter; ++iter) { > + PolymorphicCallNode& node = **iter; > + if (node.hasCallLinkInfo(info)) > + node.clearCallLinkInfo(); > + } All of the nodes for a stub routine should have the same CallLinkInfo. I agree that being conservative is great, but maybe you could add a comment that you're just being paranoid. 1098627 4 msaboff 2015-06-01 16:15:09 -0700 (In reply to comment #3) > Comment on attachment 254016 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=254016&action=review > > > Source/JavaScriptCore/jit/PolymorphicCallStubRoutine.cpp:116 > > + for (Bag<PolymorphicCallNode>::iterator iter = m_callNodes.begin(); !!iter; ++iter) { > > + PolymorphicCallNode& node = **iter; > > + if (node.hasCallLinkInfo(info)) > > + node.clearCallLinkInfo(); > > + } > > All of the nodes for a stub routine should have the same CallLinkInfo. I > agree that being conservative is great, but maybe you could add a comment > that you're just being paranoid. I'll add such a comment. 1098636 5 msaboff 2015-06-01 16:35:22 -0700 Committed r185084: <http://trac.webkit.org/changeset/185084> 254016 2015-06-01 15:13:39 -0700 2015-06-01 16:11:52 -0700 Patch 145527.patch text/plain 4457 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTg1MDc2KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI2IEBA CisyMDE1LTA2LTAxICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIENyYXNoIGluIGNvbS5hcHBsZS5XZWJLaXQuV2ViQ29udGVudCBhdCBjb20uYXBwbGUuSmF2 YVNjcmlwdENvcmU6IEpTQzo6cmV2ZXJ0Q2FsbCArIDI0CisgICAgICAgIGh0dHBzOi8vYnVncy53 ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNDU1MjcKKworICAgICAgICBSZXZpZXdlZCBieSBO T0JPRFkgKE9PUFMhKS4KKworICAgICAgICBJZiBhIENhbGxMaW5rSW5mbyBpcyBHQydlZCwgd2Ug bmVlZCB0byBub3RpZnkgYW55IFBvbHltb3JwaGljQ2FsbE5vZGUncyB0aGF0IHJlZmVyZW5jZSBp dC4KKyAgICAgICAgQWRkZWQgcGx1bWJsaW5nIHRvIGNsZWFyIHRoZSBtX2NhbGxMaW5rSW5mbyBv ZiBhIFBvbHltb3JwaGljQ2FsbE5vZGUgd2hlbiB0aGF0IENhbGxMaW5rSW5mbworICAgICAgICBp cyBnb2luZyBhd2F5LgorCisgICAgICAgICogYnl0ZWNvZGUvQ2FsbExpbmtJbmZvLmg6CisgICAg ICAgIChKU0M6OkNhbGxMaW5rSW5mbzo6fkNhbGxMaW5rSW5mbyk6CisgICAgICAgICogaml0L1Bv bHltb3JwaGljQ2FsbFN0dWJSb3V0aW5lLmNwcDoKKyAgICAgICAgKEpTQzo6UG9seW1vcnBoaWND YWxsTm9kZTo6dW5saW5rKToKKyAgICAgICAgKEpTQzo6UG9seW1vcnBoaWNDYWxsTm9kZTo6Y2xl YXJDYWxsTGlua0luZm8pOgorICAgICAgICAoSlNDOjpQb2x5bW9ycGhpY0NhbGxDYXNlOjpkdW1w KToKKyAgICAgICAgKEpTQzo6UG9seW1vcnBoaWNDYWxsU3R1YlJvdXRpbmU6OmVkZ2VzKToKKyAg ICAgICAgKEpTQzo6UG9seW1vcnBoaWNDYWxsU3R1YlJvdXRpbmU6OmNsZWFyQ2FsbE5vZGVzRm9y KToKKyAgICAgICAgKEpTQzo6UG9seW1vcnBoaWNDYWxsU3R1YlJvdXRpbmU6OnZpc2l0V2Vhayk6 CisgICAgICAgICogaml0L1BvbHltb3JwaGljQ2FsbFN0dWJSb3V0aW5lLmg6CisgICAgICAgIChK U0M6OlBvbHltb3JwaGljQ2FsbE5vZGU6Omhhc0NhbGxMaW5rSW5mbyk6CisKIDIwMTUtMDUtMjkg IEdlb2ZmcmV5IEdhcmVuICA8Z2dhcmVuQGFwcGxlLmNvbT4KIAogICAgICAgICBSRUdSRVNTSU9O OiBUaGVzZSBzb3J0aW5nIGlkaW9tcyB1c2VkIGJ5IFBlYWNla2VlcGVyIGFuZCBCcm93c2VybWFy ayBhcmUgfjIwWCBzbG93ZXIKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ieXRlY29kZS9D YWxsTGlua0luZm8uaAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNv ZGUvQ2FsbExpbmtJbmZvLmgJKHJldmlzaW9uIDE4NDkyNSkKKysrIFNvdXJjZS9KYXZhU2NyaXB0 Q29yZS9ieXRlY29kZS9DYWxsTGlua0luZm8uaAkod29ya2luZyBjb3B5KQpAQCAtNjcsNiArNjcs OSBAQCBzdHJ1Y3QgQ2FsbExpbmtJbmZvIDogcHVibGljIEJhc2ljUmF3U2VuCiAgICAgICAgIAog ICAgIH5DYWxsTGlua0luZm8oKQogICAgIHsKKyAgICAgICAgaWYgKHN0dWIpCisgICAgICAgICAg ICBzdHViLT5jbGVhckNhbGxOb2Rlc0Zvcih0aGlzKTsKKwogICAgICAgICBpZiAoaXNPbkxpc3Qo KSkKICAgICAgICAgICAgIHJlbW92ZSgpOwogICAgIH0KSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0 Q29yZS9qaXQvUG9seW1vcnBoaWNDYWxsU3R1YlJvdXRpbmUuY3BwCj09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNv dXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvUG9seW1vcnBoaWNDYWxsU3R1YlJvdXRpbmUuY3BwCShy ZXZpc2lvbiAxODQ5MjUpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L1BvbHltb3JwaGlj Q2FsbFN0dWJSb3V0aW5lLmNwcAkod29ya2luZyBjb3B5KQpAQCAtNDMsMTUgKzQzLDI1IEBAIFBv bHltb3JwaGljQ2FsbE5vZGU6On5Qb2x5bW9ycGhpY0NhbGxOb2QKIAogdm9pZCBQb2x5bW9ycGhp Y0NhbGxOb2RlOjp1bmxpbmsoUmVwYXRjaEJ1ZmZlciYgcmVwYXRjaEJ1ZmZlcikKIHsKLSAgICBp ZiAoT3B0aW9uczo6c2hvd0Rpc2Fzc2VtYmx5KCkpCi0gICAgICAgIGRhdGFMb2coIlVubGlua2lu ZyBwb2x5bW9ycGhpYyBjYWxsIGF0ICIsIG1fY2FsbExpbmtJbmZvLT5jYWxsUmV0dXJuTG9jYXRp b24sICIsICIsIG1fY2FsbExpbmtJbmZvLT5jb2RlT3JpZ2luLCAiXG4iKTsKLSAgICAKLSAgICBt X2NhbGxMaW5rSW5mby0+dW5saW5rKHJlcGF0Y2hCdWZmZXIpOwotICAgIAorICAgIGlmIChtX2Nh bGxMaW5rSW5mbykgeworICAgICAgICBpZiAoT3B0aW9uczo6c2hvd0Rpc2Fzc2VtYmx5KCkpCisg ICAgICAgICAgICBkYXRhTG9nKCJVbmxpbmtpbmcgcG9seW1vcnBoaWMgY2FsbCBhdCAiLCBtX2Nh bGxMaW5rSW5mby0+Y2FsbFJldHVybkxvY2F0aW9uLCAiLCAiLCBtX2NhbGxMaW5rSW5mby0+Y29k ZU9yaWdpbiwgIlxuIik7CisKKyAgICAgICAgbV9jYWxsTGlua0luZm8tPnVubGluayhyZXBhdGNo QnVmZmVyKTsKKyAgICB9CisKICAgICBpZiAoaXNPbkxpc3QoKSkKICAgICAgICAgcmVtb3ZlKCk7 CiB9CiAKK3ZvaWQgUG9seW1vcnBoaWNDYWxsTm9kZTo6Y2xlYXJDYWxsTGlua0luZm8oKQorewor ICAgIGlmIChPcHRpb25zOjpzaG93RGlzYXNzZW1ibHkoKSkKKyAgICAgICAgZGF0YUxvZygiQ2xl YXJpbmcgY2FsbCBsaW5rIGluZm8gZm9yIHBvbHltb3JwaGljIGNhbGwgYXQgIiwgbV9jYWxsTGlu a0luZm8tPmNhbGxSZXR1cm5Mb2NhdGlvbiwgIiwgIiwgbV9jYWxsTGlua0luZm8tPmNvZGVPcmln aW4sICJcbiIpOworCisgICAgbV9jYWxsTGlua0luZm8gPSBudWxscHRyOworfQorCiB2b2lkIFBv bHltb3JwaGljQ2FsbENhc2U6OmR1bXAoUHJpbnRTdHJlYW0mIG91dCkgY29uc3QKIHsKICAgICBv dXQucHJpbnQoIjx2YXJpYW50ID0gIiwgbV92YXJpYW50LCAiLCBjb2RlQmxvY2sgPSAiLCBwb2lu dGVyRHVtcChtX2NvZGVCbG9jayksICI+Iik7CkBAIC05Nyw2ICsxMDcsMTUgQEAgQ2FsbEVkZ2VM aXN0IFBvbHltb3JwaGljQ2FsbFN0dWJSb3V0aW5lOgogICAgIHJldHVybiByZXN1bHQ7CiB9CiAK K3ZvaWQgUG9seW1vcnBoaWNDYWxsU3R1YlJvdXRpbmU6OmNsZWFyQ2FsbE5vZGVzRm9yKENhbGxM aW5rSW5mbyogaW5mbykKK3sKKyAgICBmb3IgKEJhZzxQb2x5bW9ycGhpY0NhbGxOb2RlPjo6aXRl cmF0b3IgaXRlciA9IG1fY2FsbE5vZGVzLmJlZ2luKCk7ICEhaXRlcjsgKytpdGVyKSB7CisgICAg ICAgIFBvbHltb3JwaGljQ2FsbE5vZGUmIG5vZGUgPSAqKml0ZXI7CisgICAgICAgIGlmIChub2Rl Lmhhc0NhbGxMaW5rSW5mbyhpbmZvKSkKKyAgICAgICAgICAgIG5vZGUuY2xlYXJDYWxsTGlua0lu Zm8oKTsKKyAgICB9Cit9CisKIGJvb2wgUG9seW1vcnBoaWNDYWxsU3R1YlJvdXRpbmU6OnZpc2l0 V2VhayhSZXBhdGNoQnVmZmVyJikKIHsKICAgICBmb3IgKGF1dG8mIHZhcmlhbnQgOiBtX3Zhcmlh bnRzKSB7CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L1BvbHltb3JwaGljQ2FsbFN0 dWJSb3V0aW5lLmgKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2ppdC9Qb2x5 bW9ycGhpY0NhbGxTdHViUm91dGluZS5oCShyZXZpc2lvbiAxODQ5MjUpCisrKyBTb3VyY2UvSmF2 YVNjcmlwdENvcmUvaml0L1BvbHltb3JwaGljQ2FsbFN0dWJSb3V0aW5lLmgJKHdvcmtpbmcgY29w eSkKQEAgLTUxLDYgKzUxLDkgQEAgcHVibGljOgogICAgIH5Qb2x5bW9ycGhpY0NhbGxOb2RlKCk7 CiAgICAgCiAgICAgdm9pZCB1bmxpbmsoUmVwYXRjaEJ1ZmZlciYpOworCisgICAgYm9vbCBoYXND YWxsTGlua0luZm8oQ2FsbExpbmtJbmZvKiBpbmZvKSB7IHJldHVybiBtX2NhbGxMaW5rSW5mbyA9 PSBpbmZvOyB9CisgICAgdm9pZCBjbGVhckNhbGxMaW5rSW5mbygpOwogICAgIAogcHJpdmF0ZToK ICAgICBDYWxsTGlua0luZm8qIG1fY2FsbExpbmtJbmZvOwpAQCAtOTAsNiArOTMsOCBAQCBwdWJs aWM6CiAgICAgCiAgICAgQ2FsbFZhcmlhbnRMaXN0IHZhcmlhbnRzKCkgY29uc3Q7CiAgICAgQ2Fs bEVkZ2VMaXN0IGVkZ2VzKCkgY29uc3Q7CisKKyAgICB2b2lkIGNsZWFyQ2FsbE5vZGVzRm9yKENh bGxMaW5rSW5mbyopOwogICAgIAogICAgIGJvb2wgdmlzaXRXZWFrKFJlcGF0Y2hCdWZmZXImKSBv dmVycmlkZTsKIAo=