150434 2015-10-21 21:19:00 -0700 REGRESSION(r191360): Repro Crash: com.apple.WebKit.WebContent at ….apple.JavaScriptCore: JSC::ExecState::bytecodeOffset + 174 2015-10-22 09:13:22 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build All All RESOLVED FIXED InRadar P2 Normal --- 1 msaboff msaboff oldest_to_newest 1135560 0 msaboff 2015-10-21 21:19:00 -0700 Although this was found after r191360, this is really a tail call issue uncovered by enabling tail calls (again) in r191360. The issue here is that we are in a bound function that is tail calling a bound function where a exception is thrown or unhandled. The bound functions are called via a native wrapper which is called via the native call thunk. The exception processing in the native call thunk assumes that there is a direct JS caller. With tail calls enabled that is no longer true. 1135561 1 msaboff 2015-10-21 21:24:10 -0700 rdar://problem/23207182 1135563 2 263790 msaboff 2015-10-21 21:35:56 -0700 Created attachment 263790 Patch 1135578 3 263790 mark.lam 2015-10-21 22:47:22 -0700 Comment on attachment 263790 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=263790&action=review You are now setting up these thunks to call operationVMHandleException() with a CallFrame that has a null codeBlock. operationVMHandleException() calls genericUnwind(), and genericUnwind() starts with: if (Options::breakOnThrow()) { dataLog("In call frame ", RawPointer(callFrame), " for code block ", *callFrame->codeBlock(), "\n"); CRASH(); } Can you also please fix the above code in genericUnwind() to not deref that codeBlock pointer if it's null? I looked thru the rest of genericUnwind() and I think it is resilient against a null codeBlock pointer except the above logging line, but I think you should double check if you haven't already. r=me with the issues fixed. > Source/JavaScriptCore/ChangeLog:3 > + REGRESSION(r191360): Repro Crash: com.apple.WebKit.WebContent at ….apple.JavaScriptCore: JSC::ExecState::bytecodeOffset + 174 Please fix the special character before ".apple.JavaScriptCore:". > LayoutTests/ChangeLog:3 > + REGRESSION(r191360): Repro Crash: com.apple.WebKit.WebContent at ….apple.JavaScriptCore: JSC::ExecState::bytecodeOffset + 174 Please fix the non-ascii character before ".apple.JavaScriptCore:". > LayoutTests/js/script-tests/regress-150434.js:47 > +testPassed("Properly handled an exception from a tail called native function that called by a native function"); did you mean "that *was* called by *another* native function"? 1135703 4 msaboff 2015-10-22 09:13:22 -0700 Committed r191455: <http://trac.webkit.org/changeset/191455> 263790 2015-10-21 21:35:56 -0700 2015-10-21 22:47:22 -0700 Patch 150434.patch text/plain 6051 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTkxNDMyKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBA CisyMDE1LTEwLTIxICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIFJFR1JFU1NJT04ocjE5MTM2MCk6IFJlcHJvIENyYXNoOiBjb20uYXBwbGUuV2ViS2l0Lldl YkNvbnRlbnQgYXQg4oCmLmFwcGxlLkphdmFTY3JpcHRDb3JlOiBKU0M6OkV4ZWNTdGF0ZTo6Ynl0 ZWNvZGVPZmZzZXQgKyAxNzQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i dWcuY2dpP2lkPTE1MDQzNAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgor CisgICAgICAgIFBhc3MgdGhlIGN1cnJlbnQgZnJhbWUgaW5zdGVhZCBvZiB0aGUgY2FsbGVyIGZy YW1lIHRvIG9wZXJhdGlvblZNSGFuZGxlRXhjZXB0aW9uIHdoZW4gcHJvY2Vzc2luZyBhbgorICAg ICAgICBleGNlcHRpb24gaW4gb25lIG9mIHRoZSBuYXRpdmUgdGh1bmtzLgorCisgICAgICAgICog aml0L0pJVE9wY29kZXMzMl82NC5jcHA6CisgICAgICAgIChKU0M6OkpJVDo6cHJpdmF0ZUNvbXBp bGVDVElOYXRpdmVDYWxsKToKKyAgICAgICAgKiBqaXQvVGh1bmtHZW5lcmF0b3JzLmNwcDoKKyAg ICAgICAgKEpTQzo6bmF0aXZlRm9yR2VuZXJhdG9yKToKKwogMjAxNS0xMC0yMSAgQmVuamFtaW4g UG91bGFpbiAgPGJwb3VsYWluQGFwcGxlLmNvbT4KIAogICAgICAgICBbSlNDXSBSZW1vdmUgRlRM IE5hdGl2ZSBJbmxpbmluZywgaXQgaXMgZGVhZCBjb2RlCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlw dENvcmUvaml0L0pJVE9wY29kZXMzMl82NC5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFT Y3JpcHRDb3JlL2ppdC9KSVRPcGNvZGVzMzJfNjQuY3BwCShyZXZpc2lvbiAxOTE0MjMpCisrKyBT b3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L0pJVE9wY29kZXMzMl82NC5jcHAJKHdvcmtpbmcgY29w eSkKQEAgLTExMCwxMCArMTEwLDEwIEBAIEpJVDo6Q29kZVJlZiBKSVQ6OnByaXZhdGVDb21waWxl Q1RJTmF0aXYKIAogI2lmIENQVShYODYpCiAgICAgYWRkUHRyKFRydXN0ZWRJbW0zMigtNCksIHN0 YWNrUG9pbnRlclJlZ2lzdGVyKTsKLSAgICBsb2FkUHRyKEFkZHJlc3MoY2FsbEZyYW1lUmVnaXN0 ZXIpLCBYODZSZWdpc3RlcnM6OmVjeCk7CisgICAgbW92ZShjYWxsRnJhbWVSZWdpc3RlciwgWDg2 UmVnaXN0ZXJzOjplY3gpOwogICAgIHB1c2goWDg2UmVnaXN0ZXJzOjplY3gpOwogI2Vsc2UKLSAg ICBsb2FkUHRyKEFkZHJlc3MoY2FsbEZyYW1lUmVnaXN0ZXIpLCBhcmd1bWVudEdQUjApOworICAg IG1vdmUoY2FsbEZyYW1lUmVnaXN0ZXIsIGFyZ3VtZW50R1BSMCk7CiAjZW5kaWYKICAgICBtb3Zl KFRydXN0ZWRJbW1QdHIoRnVuY3Rpb25QdHIob3BlcmF0aW9uVk1IYW5kbGVFeGNlcHRpb24pLnZh bHVlKCkpLCByZWdUMyk7CiAgICAgY2FsbChyZWdUMyk7CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlw dENvcmUvaml0L1RodW5rR2VuZXJhdG9ycy5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFT Y3JpcHRDb3JlL2ppdC9UaHVua0dlbmVyYXRvcnMuY3BwCShyZXZpc2lvbiAxOTE0MjMpCisrKyBT b3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L1RodW5rR2VuZXJhdG9ycy5jcHAJKHdvcmtpbmcgY29w eSkKQEAgLTM1OCwxNCArMzU4LDE0IEBAIHN0YXRpYyBNYWNyb0Fzc2VtYmxlckNvZGVSZWYgbmF0 aXZlRm9yR2UKIAogI2lmIENQVShYODYpICYmIFVTRShKU1ZBTFVFMzJfNjQpCiAgICAgaml0LmFk ZFB0cihKU0ludGVyZmFjZUpJVDo6VHJ1c3RlZEltbTMyKC0xMiksIEpTSW50ZXJmYWNlSklUOjpz dGFja1BvaW50ZXJSZWdpc3Rlcik7Ci0gICAgaml0LmxvYWRQdHIoSlNJbnRlcmZhY2VKSVQ6OkFk ZHJlc3MoSlNJbnRlcmZhY2VKSVQ6OmNhbGxGcmFtZVJlZ2lzdGVyKSwgSlNJbnRlcmZhY2VKSVQ6 OnJlZ1QwKTsKKyAgICBqaXQubW92ZShKU0ludGVyZmFjZUpJVDo6Y2FsbEZyYW1lUmVnaXN0ZXIs IEpTSW50ZXJmYWNlSklUOjpyZWdUMCk7CiAgICAgaml0LnB1c2goSlNJbnRlcmZhY2VKSVQ6OnJl Z1QwKTsKICNlbHNlCiAjaWYgT1MoV0lORE9XUykKICAgICAvLyBBbGxvY2F0ZSBzcGFjZSBvbiBz dGFjayBmb3IgdGhlIDQgcGFyYW1ldGVyIHJlZ2lzdGVycy4KICAgICBqaXQuc3ViUHRyKEpTSW50 ZXJmYWNlSklUOjpUcnVzdGVkSW1tMzIoNCAqIHNpemVvZihpbnQ2NF90KSksIEpTSW50ZXJmYWNl SklUOjpzdGFja1BvaW50ZXJSZWdpc3Rlcik7CiAjZW5kaWYKLSAgICBqaXQubG9hZFB0cihKU0lu dGVyZmFjZUpJVDo6QWRkcmVzcyhKU0ludGVyZmFjZUpJVDo6Y2FsbEZyYW1lUmVnaXN0ZXIpLCBK U0ludGVyZmFjZUpJVDo6YXJndW1lbnRHUFIwKTsKKyAgICBqaXQubW92ZShKU0ludGVyZmFjZUpJ VDo6Y2FsbEZyYW1lUmVnaXN0ZXIsIEpTSW50ZXJmYWNlSklUOjphcmd1bWVudEdQUjApOwogI2Vu ZGlmCiAgICAgaml0Lm1vdmUoSlNJbnRlcmZhY2VKSVQ6OlRydXN0ZWRJbW1QdHIoRnVuY3Rpb25Q dHIob3BlcmF0aW9uVk1IYW5kbGVFeGNlcHRpb24pLnZhbHVlKCkpLCBKU0ludGVyZmFjZUpJVDo6 cmVnVDMpOwogICAgIGppdC5jYWxsKEpTSW50ZXJmYWNlSklUOjpyZWdUMyk7CkluZGV4OiBMYXlv dXRUZXN0cy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCShy ZXZpc2lvbiAxOTE0MjMpCisrKyBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHdvcmtpbmcgY29weSkK QEAgLTEsMyArMSwxOSBAQAorMjAxNS0xMC0yMSAgTWljaGFlbCBTYWJvZmYgIDxtc2Fib2ZmQGFw cGxlLmNvbT4KKworICAgICAgICBSRUdSRVNTSU9OKHIxOTEzNjApOiBSZXBybyBDcmFzaDogY29t LmFwcGxlLldlYktpdC5XZWJDb250ZW50IGF0IOKApi5hcHBsZS5KYXZhU2NyaXB0Q29yZTogSlND OjpFeGVjU3RhdGU6OmJ5dGVjb2RlT2Zmc2V0ICsgMTc0CisgICAgICAgIGh0dHBzOi8vYnVncy53 ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTA0MzQKKworICAgICAgICBSZXZpZXdlZCBieSBO T0JPRFkgKE9PUFMhKS4KKworICAgICAgICBOZXcgcmVncmVzc2lvbiB0ZXN0LgorCisgICAgICAg ICoganMvcmVncmVzcy0xNTA0MzQtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBqcy9y ZWdyZXNzLTE1MDQzNC5odG1sOiBBZGRlZC4KKyAgICAgICAgKiBqcy9zY3JpcHQtdGVzdHMvcmVn cmVzcy0xNTA0MzQuanM6IEFkZGVkLgorICAgICAgICAoYmFyKToKKyAgICAgICAgKGZvbyk6Cisg ICAgICAgICh0ZXN0KToKKwogMjAxNS0xMC0yMSAgQ2hyaXMgRHVtZXogIDxjZHVtZXpAYXBwbGUu Y29tPgogCiAgICAgICAgIFVuLWV4cG9zZSBvYnNvbGV0ZSBIVE1MQmFzZUZvbnRFbGVtZW50Cklu ZGV4OiBMYXlvdXRUZXN0cy9qcy9yZWdyZXNzLTE1MDQzNC1leHBlY3RlZC50eHQKPT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PQotLS0gTGF5b3V0VGVzdHMvanMvcmVncmVzcy0xNTA0MzQtZXhwZWN0ZWQudHh0CShyZXZpc2lv biAwKQorKysgTGF5b3V0VGVzdHMvanMvcmVncmVzcy0xNTA0MzQtZXhwZWN0ZWQudHh0CSh3b3Jr aW5nIGNvcHkpCkBAIC0wLDAgKzEsMTAgQEAKK1JlZ3Jlc3Npb24gdGVzdCBmb3IgaHR0cHM6Ly93 ZWJraXQub3JnL2IvMTUwNDM0LgorCitPbiBzdWNjZXNzLCB5b3Ugd2lsbCBzZWUgYSBzZXJpZXMg b2YgIlBBU1MiIG1lc3NhZ2VzLCBmb2xsb3dlZCBieSAiVEVTVCBDT01QTEVURSIuCisKKworUEFT UyBQcm9wZXJseSBoYW5kbGVkIGFuIGV4Y2VwdGlvbiBmcm9tIGEgdGFpbCBjYWxsZWQgbmF0aXZl IGZ1bmN0aW9uIHRoYXQgY2FsbGVkIGJ5IGEgbmF0aXZlIGZ1bmN0aW9uCitQQVNTIHN1Y2Nlc3Nm dWxseVBhcnNlZCBpcyB0cnVlCisKK1RFU1QgQ09NUExFVEUKKwpJbmRleDogTGF5b3V0VGVzdHMv anMvcmVncmVzcy0xNTA0MzQuaHRtbAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9qcy9yZWdy ZXNzLTE1MDQzNC5odG1sCShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvanMvcmVncmVzcy0x NTA0MzQuaHRtbAkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDEwIEBACis8IURPQ1RZUEUgSFRN TCBQVUJMSUMgIi0vL0lFVEYvL0RURCBIVE1MLy9FTiI+Cis8aHRtbD4KKzxoZWFkPgorPHNjcmlw dCBzcmM9Ii4uL3Jlc291cmNlcy9qcy10ZXN0LXByZS5qcyI+PC9zY3JpcHQ+Cis8L2hlYWQ+Cis8 Ym9keT4KKzxzY3JpcHQgc3JjPSJzY3JpcHQtdGVzdHMvcmVncmVzcy0xNTA0MzQuanMiPjwvc2Ny aXB0PgorPHNjcmlwdCBzcmM9Ii4uL3Jlc291cmNlcy9qcy10ZXN0LXBvc3QuanMiPjwvc2NyaXB0 PgorPC9ib2R5PgorPC9odG1sPgpJbmRleDogTGF5b3V0VGVzdHMvanMvc2NyaXB0LXRlc3RzL3Jl Z3Jlc3MtMTUwNDM0LmpzCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2pzL3NjcmlwdC10ZXN0 cy9yZWdyZXNzLTE1MDQzNC5qcwkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2pzL3Njcmlw dC10ZXN0cy9yZWdyZXNzLTE1MDQzNC5qcwkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDQ3IEBA CitkZXNjcmlwdGlvbigiUmVncmVzc2lvbiB0ZXN0IGZvciBodHRwczovL3dlYmtpdC5vcmcvYi8x NTA0MzQuIik7CisKKy8vIFRoaXMgdGVzdCB2ZXJpZmllcyB0aGF0IHdlIGNhbiBwcm9jZXNzIGFu IGV4Y2VwdGlvbiB0aHJvd24gZnJvbSBhIG5hdGl2ZWx5IGNhbGxlZCBmdW5jdGlvbgorLy8gdGhh dCB3YXMgdGFpbCBjYWxsZWQgZnJvbSBhIEpTIGZ1bmN0aW9uIHRoYXQgd2FzIG5hdGl2ZSBjYWxs ZWQgaXRzZWxmLgorLy8gV2UgdXNlIGJpbmQgdG8gY3JlYXRlIGEgbmF0aXZlIHdyYXBwZXIgYXJv dW5kIEpTIGZ1bmN0aW9ucy4KKwordmFyIG15RXhjZXB0aW9uID0gIlRoaXMgc2hvdWxkbid0IGNy YXNoISI7CisKK2Z1bmN0aW9uIGJhcihhLCBpZHgpCit7CisgICAgInVzZSBzdHJpY3QiOworCisg ICAgaWYgKGlkeCA+IDApCisgICAgICAgIHRocm93IG15RXhjZXB0aW9uOworCisgICAgcmV0dXJu IGE7Cit9CisKK2JvdW5kQmFyID0gYmFyLmJpbmQobnVsbCwgNDIpOworCitmdW5jdGlvbiBmb28o YSwgaWR4KQoreworICAgICJ1c2Ugc3RyaWN0IjsKKworICAgIHJldHVybiBib3VuZEJhcihpZHgp OworfQorCitib3VuZEZvbyA9IGZvby5iaW5kKG51bGwsIDQxKTsKKworZnVuY3Rpb24gdGVzdCgp Cit7CisgICAgZm9yICh2YXIgaSA9IDA7IGkgPCAyMDAwMDA7IGkrKykgeworICAgICAgICB0cnkg eworICAgICAgICAgICAgaWYgKGJvdW5kRm9vKGkpICE9IDQyKQorICAgICAgICAgICAgICAgIHRl c3RGYWlsZWQoIkdvdCB3cm9uZyByZXN1bHQgZnJvbSBmb28oKSEiKTsKKyAgICAgICAgfSBjYXRj aCAoZSkgeworICAgICAgICAgICAgaWYgKGUgIT0gbXlFeGNlcHRpb24pCisgICAgICAgICAgICAg ICAgcHJpbnQoZSk7CisgICAgICAgIH0KKyAgICB9Cit9CisKK25vSW5saW5lKHRlc3QpOworCit0 ZXN0KCk7CisKK3Rlc3RQYXNzZWQoIlByb3Blcmx5IGhhbmRsZWQgYW4gZXhjZXB0aW9uIGZyb20g YSB0YWlsIGNhbGxlZCBuYXRpdmUgZnVuY3Rpb24gdGhhdCBjYWxsZWQgYnkgYSBuYXRpdmUgZnVu Y3Rpb24iKTsK