164304 2016-11-01 17:20:44 -0700 Crash beneath SlotVisitor::drain @ cooksillustrated.com 2016-11-02 14:12:33 -0700 1 1 1 Unclassified WebKit JavaScriptCore Other Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 164320 1 msaboff msaboff commit-queue keith_miller mark.lam saam oldest_to_newest 1247168 0 msaboff 2016-11-01 17:20:44 -0700 We are missing a write barrier on a base object in the LLInt put_by_id code when we have a structure transition on that object. 1247169 1 msaboff 2016-11-01 17:21:05 -0700 <rdar://problem/21650959> 1247314 2 293659 msaboff 2016-11-02 07:44:38 -0700 Created attachment 293659 Patch Added <https://bugs.webkit.org/show_bug.cgi?id=164320> to add a regression test. 1247324 3 293659 mark.lam 2016-11-02 08:03:40 -0700 Comment on attachment 293659 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=293659&action=review > Source/JavaScriptCore/llint/LowLevelInterpreter64.asm:1409 > + # Reload base into t0 > + loadVariable(1, t0) Pardon my ignorance, but t0 was originally loaded with: loadisFromInstruction(1, t3) loadConstantOrVariableCell(t3, t0, .opPutByIdSlow) How do we know that it is not a ConstantCell? 1247369 4 msaboff 2016-11-02 10:27:31 -0700 (In reply to comment #3) > Comment on attachment 293659 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=293659&action=review > > > Source/JavaScriptCore/llint/LowLevelInterpreter64.asm:1409 > > + # Reload base into t0 > > + loadVariable(1, t0) > > Pardon my ignorance, but t0 was originally loaded with: > loadisFromInstruction(1, t3) > loadConstantOrVariableCell(t3, t0, .opPutByIdSlow) > > How do we know that it is not a ConstantCell? This is on a path where we already checked that we have a variable cell. 1247376 5 msaboff 2016-11-02 10:46:58 -0700 (In reply to comment #3) > Comment on attachment 293659 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=293659&action=review > > > Source/JavaScriptCore/llint/LowLevelInterpreter64.asm:1409 > > + # Reload base into t0 > > + loadVariable(1, t0) > > Pardon my ignorance, but t0 was originally loaded with: > loadisFromInstruction(1, t3) > loadConstantOrVariableCell(t3, t0, .opPutByIdSlow) > > How do we know that it is not a ConstantCell? Actually, you're right, the cell could be a constant. I'll upload a new patch shortly. 1247400 6 293678 msaboff 2016-11-02 11:18:08 -0700 Created attachment 293678 Updated Patch 1247407 7 293678 mark.lam 2016-11-02 11:33:00 -0700 Comment on attachment 293678 Updated Patch r=me 1247472 8 msaboff 2016-11-02 14:12:33 -0700 Committed r208299: <http://trac.webkit.org/changeset/208299> 293659 2016-11-02 07:44:38 -0700 2016-11-02 11:18:08 -0700 Patch 164304.patch text/plain 3033 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjA4MjgxKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBA CisyMDE2LTExLTAyICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIENyYXNoIGJlbmVhdGggU2xvdFZpc2l0b3I6OmRyYWluIEAgY29va3NpbGx1c3RyYXRlZC5j b20KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE2NDMw NAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEFkZGVk IGJhY2sgd3JpdGUgYmFycmllciBmb3IgdGhlIGJhc2UgY2VsbCBvZiBwdXQtYnlfaWQgaW4gdGhl IExMSW50IHdoZW4gdGhlIHN0cnVjdHVyZSBpcworICAgICAgICBjaGFuZ2VkLiAgQWxzbyByZW1v dmVkIHRoZSB1bnVzZWQgbWFjcm8gInN0b3JlU3RydWN0dXJlV2l0aFR5cGVJbmZvIi4KKworICAg ICAgICAqIGxsaW50L0xvd0xldmVsSW50ZXJwcmV0ZXIzMl82NC5hc206CisgICAgICAgICogbGxp bnQvTG93TGV2ZWxJbnRlcnByZXRlcjY0LmFzbToKKwogMjAxNi0xMS0wMiAgUm9tYWluIEJlbGxl c3NvcnQgIDxyb21haW4uYmVsbGVzc29ydEBjcmYuY2Fub24uZnI+CiAKICAgICAgICAgW1JlYWRh YmxlIFN0cmVhbXMgQVBJXSBFbmFibGUgY3JlYXRpb24gb2YgUmVhZGFibGVCeXRlU3RyZWFtQ29u dHJvbGxlcgpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2xsaW50L0xvd0xldmVsSW50ZXJw cmV0ZXIzMl82NC5hc20KPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2xsaW50 L0xvd0xldmVsSW50ZXJwcmV0ZXIzMl82NC5hc20JKHJldmlzaW9uIDIwNzc4MykKKysrIFNvdXJj ZS9KYXZhU2NyaXB0Q29yZS9sbGludC9Mb3dMZXZlbEludGVycHJldGVyMzJfNjQuYXNtCSh3b3Jr aW5nIGNvcHkpCkBAIC00OTAsMTMgKzQ5MCw2IEBAIG1hY3JvIGxvYWRDb25zdGFudE9yVmFyaWFi bGVQYXlsb2FkVW5jaGUKICAgICAgICAgcGF5bG9hZCkKIGVuZAogCi1tYWNybyBzdG9yZVN0cnVj dHVyZVdpdGhUeXBlSW5mbyhjZWxsLCBzdHJ1Y3R1cmUsIHNjcmF0Y2gpCi0gICAgc3RvcmVwIHN0 cnVjdHVyZSwgSlNDZWxsOjptX3N0cnVjdHVyZUlEW2NlbGxdCi0KLSAgICBsb2FkaSBTdHJ1Y3R1 cmU6Om1fYmxvYiArIFN0cnVjdHVyZUlEQmxvYjo6dS53b3Jkcy53b3JkMltzdHJ1Y3R1cmVdLCBz Y3JhdGNoCi0gICAgc3RvcmVpIHNjcmF0Y2gsIEpTQ2VsbDo6bV9pbmRleGluZ1R5cGVbY2VsbF0K LWVuZAotCiBtYWNybyB3cml0ZUJhcnJpZXJPbk9wZXJhbmQoY2VsbE9wZXJhbmQpCiAgICAgbG9h ZGlzRnJvbUluc3RydWN0aW9uKGNlbGxPcGVyYW5kLCB0MSkKICAgICBsb2FkQ29uc3RhbnRPclZh cmlhYmxlUGF5bG9hZCh0MSwgQ2VsbFRhZywgdDIsIC53cml0ZUJhcnJpZXJEb25lKQpAQCAtMTUy OCw2ICsxNTIxLDEyIEBAIF9sbGludF9vcF9wdXRfYnlfaWQ6CiAKIC5vcFB1dEJ5SWRUcmFuc2l0 aW9uRGlyZWN0OgogICAgIHN0b3JlaSB0MSwgSlNDZWxsOjptX3N0cnVjdHVyZUlEW3QwXQorICAg IGxvYWRpIDEyW1BDXSwgdDEKKyAgICBsb2FkQ29uc3RhbnRPclZhcmlhYmxlKHQxLCB0MiwgdDMp CisgICAgbG9hZGkgMjBbUENdLCB0MQorICAgIHN0b3JlUHJvcGVydHlBdFZhcmlhYmxlT2Zmc2V0 KHQxLCB0MCwgdDIsIHQzKQorICAgIHdyaXRlQmFycmllck9uT3BlcmFuZCgxKQorICAgIGRpc3Bh dGNoKDkpCiAKIC5vcFB1dEJ5SWROb3RUcmFuc2l0aW9uOgogICAgICMgVGhlIG9ubHkgdGhpbmcg bGl2ZSByaWdodCBub3cgaXMgdDAsIHdoaWNoIGhvbGRzIHRoZSBiYXNlLgpJbmRleDogU291cmNl L0phdmFTY3JpcHRDb3JlL2xsaW50L0xvd0xldmVsSW50ZXJwcmV0ZXI2NC5hc20KPT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2xsaW50L0xvd0xldmVsSW50ZXJwcmV0ZXI2NC5h c20JKHJldmlzaW9uIDIwNzc4MykKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9sbGludC9Mb3dM ZXZlbEludGVycHJldGVyNjQuYXNtCSh3b3JraW5nIGNvcHkpCkBAIC00ODYsMTEgKzQ4Niw2IEBA IG1hY3JvIGxvYWRTdHJ1Y3R1cmVBbmRDbG9iYmVyRmlyc3RBcmcoY2UKICAgICBsb2FkcCBbY2Vs bCwgc3RydWN0dXJlLCA4XSwgc3RydWN0dXJlCiBlbmQKIAotbWFjcm8gc3RvcmVTdHJ1Y3R1cmVX aXRoVHlwZUluZm8oY2VsbCwgc3RydWN0dXJlLCBzY3JhdGNoKQotICAgIGxvYWRxIFN0cnVjdHVy ZTo6bV9ibG9iICsgU3RydWN0dXJlSURCbG9iOjp1LmRvdWJsZVdvcmRbc3RydWN0dXJlXSwgc2Ny YXRjaAotICAgIHN0b3JlcSBzY3JhdGNoLCBKU0NlbGw6Om1fc3RydWN0dXJlSURbY2VsbF0KLWVu ZAotCiAjIEVudHJ5cG9pbnRzIGludG8gdGhlIGludGVycHJldGVyLgogCiAjIEV4cGVjdHMgdGhh dCBDb2RlQmxvY2sgaXMgaW4gdDEsIHdoaWNoIGlzIHdoYXQgcHJvbG9ndWUoKSBsZWF2ZXMgYmVo aW5kLgpAQCAtMTQwOSw2ICsxNDA0LDkgQEAgX2xsaW50X29wX3B1dF9ieV9pZDoKIAogLm9wUHV0 QnlJZFRyYW5zaXRpb25EaXJlY3Q6CiAgICAgc3RvcmVpIHQxLCBKU0NlbGw6Om1fc3RydWN0dXJl SURbdDBdCisgICAgd3JpdGVCYXJyaWVyT25PcGVyYW5kKDEpCisgICAgIyBSZWxvYWQgYmFzZSBp bnRvIHQwCisgICAgbG9hZFZhcmlhYmxlKDEsIHQwKQogCiAub3BQdXRCeUlkTm90VHJhbnNpdGlv bjoKICAgICAjIFRoZSBvbmx5IHRoaW5nIGxpdmUgcmlnaHQgbm93IGlzIHQwLCB3aGljaCBob2xk cyB0aGUgYmFzZS4K 293678 2016-11-02 11:18:08 -0700 2016-11-02 11:33:00 -0700 Updated Patch 164304-2.patch text/plain 3079 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjA4Mjg3KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBA CisyMDE2LTExLTAyICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIENyYXNoIGJlbmVhdGggU2xvdFZpc2l0b3I6OmRyYWluIEAgY29va3NpbGx1c3RyYXRlZC5j b20KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE2NDMw NAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEFkZGVk IGJhY2sgd3JpdGUgYmFycmllciBmb3IgdGhlIGJhc2UgY2VsbCBvZiBwdXQtYnlfaWQgaW4gdGhl IExMSW50IHdoZW4gdGhlIHN0cnVjdHVyZSBpcworICAgICAgICBjaGFuZ2VkLiAgQWxzbyByZW1v dmVkIHRoZSB1bnVzZWQgbWFjcm8gInN0b3JlU3RydWN0dXJlV2l0aFR5cGVJbmZvIi4KKworICAg ICAgICAqIGxsaW50L0xvd0xldmVsSW50ZXJwcmV0ZXIzMl82NC5hc206CisgICAgICAgICogbGxp bnQvTG93TGV2ZWxJbnRlcnByZXRlcjY0LmFzbToKKwogMjAxNi0xMS0wMiAgUm9tYWluIEJlbGxl c3NvcnQgIDxyb21haW4uYmVsbGVzc29ydEBjcmYuY2Fub24uZnI+CiAKICAgICAgICAgW1JlYWRh YmxlIFN0cmVhbXMgQVBJXSBFbmFibGUgY3JlYXRpb24gb2YgUmVhZGFibGVCeXRlU3RyZWFtQ29u dHJvbGxlcgpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2xsaW50L0xvd0xldmVsSW50ZXJw cmV0ZXIzMl82NC5hc20KPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2xsaW50 L0xvd0xldmVsSW50ZXJwcmV0ZXIzMl82NC5hc20JKHJldmlzaW9uIDIwODI4NykKKysrIFNvdXJj ZS9KYXZhU2NyaXB0Q29yZS9sbGludC9Mb3dMZXZlbEludGVycHJldGVyMzJfNjQuYXNtCSh3b3Jr aW5nIGNvcHkpCkBAIC00OTAsMTMgKzQ5MCw2IEBAIG1hY3JvIGxvYWRDb25zdGFudE9yVmFyaWFi bGVQYXlsb2FkVW5jaGUKICAgICAgICAgcGF5bG9hZCkKIGVuZAogCi1tYWNybyBzdG9yZVN0cnVj dHVyZVdpdGhUeXBlSW5mbyhjZWxsLCBzdHJ1Y3R1cmUsIHNjcmF0Y2gpCi0gICAgc3RvcmVwIHN0 cnVjdHVyZSwgSlNDZWxsOjptX3N0cnVjdHVyZUlEW2NlbGxdCi0KLSAgICBsb2FkaSBTdHJ1Y3R1 cmU6Om1fYmxvYiArIFN0cnVjdHVyZUlEQmxvYjo6dS53b3Jkcy53b3JkMltzdHJ1Y3R1cmVdLCBz Y3JhdGNoCi0gICAgc3RvcmVpIHNjcmF0Y2gsIEpTQ2VsbDo6bV9pbmRleGluZ1R5cGVbY2VsbF0K LWVuZAotCiBtYWNybyB3cml0ZUJhcnJpZXJPbk9wZXJhbmQoY2VsbE9wZXJhbmQpCiAgICAgbG9h ZGlzRnJvbUluc3RydWN0aW9uKGNlbGxPcGVyYW5kLCB0MSkKICAgICBsb2FkQ29uc3RhbnRPclZh cmlhYmxlUGF5bG9hZCh0MSwgQ2VsbFRhZywgdDIsIC53cml0ZUJhcnJpZXJEb25lKQpAQCAtMTUy OCw2ICsxNTIxLDEyIEBAIF9sbGludF9vcF9wdXRfYnlfaWQ6CiAKIC5vcFB1dEJ5SWRUcmFuc2l0 aW9uRGlyZWN0OgogICAgIHN0b3JlaSB0MSwgSlNDZWxsOjptX3N0cnVjdHVyZUlEW3QwXQorICAg IGxvYWRpIDEyW1BDXSwgdDEKKyAgICBsb2FkQ29uc3RhbnRPclZhcmlhYmxlKHQxLCB0MiwgdDMp CisgICAgbG9hZGkgMjBbUENdLCB0MQorICAgIHN0b3JlUHJvcGVydHlBdFZhcmlhYmxlT2Zmc2V0 KHQxLCB0MCwgdDIsIHQzKQorICAgIHdyaXRlQmFycmllck9uT3BlcmFuZCgxKQorICAgIGRpc3Bh dGNoKDkpCiAKIC5vcFB1dEJ5SWROb3RUcmFuc2l0aW9uOgogICAgICMgVGhlIG9ubHkgdGhpbmcg bGl2ZSByaWdodCBub3cgaXMgdDAsIHdoaWNoIGhvbGRzIHRoZSBiYXNlLgpJbmRleDogU291cmNl L0phdmFTY3JpcHRDb3JlL2xsaW50L0xvd0xldmVsSW50ZXJwcmV0ZXI2NC5hc20KPT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2xsaW50L0xvd0xldmVsSW50ZXJwcmV0ZXI2NC5h c20JKHJldmlzaW9uIDIwODI4NykKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9sbGludC9Mb3dM ZXZlbEludGVycHJldGVyNjQuYXNtCSh3b3JraW5nIGNvcHkpCkBAIC00ODYsMTEgKzQ4Niw2IEBA IG1hY3JvIGxvYWRTdHJ1Y3R1cmVBbmRDbG9iYmVyRmlyc3RBcmcoY2UKICAgICBsb2FkcCBbY2Vs bCwgc3RydWN0dXJlLCA4XSwgc3RydWN0dXJlCiBlbmQKIAotbWFjcm8gc3RvcmVTdHJ1Y3R1cmVX aXRoVHlwZUluZm8oY2VsbCwgc3RydWN0dXJlLCBzY3JhdGNoKQotICAgIGxvYWRxIFN0cnVjdHVy ZTo6bV9ibG9iICsgU3RydWN0dXJlSURCbG9iOjp1LmRvdWJsZVdvcmRbc3RydWN0dXJlXSwgc2Ny YXRjaAotICAgIHN0b3JlcSBzY3JhdGNoLCBKU0NlbGw6Om1fc3RydWN0dXJlSURbY2VsbF0KLWVu ZAotCiAjIEVudHJ5cG9pbnRzIGludG8gdGhlIGludGVycHJldGVyLgogCiAjIEV4cGVjdHMgdGhh dCBDb2RlQmxvY2sgaXMgaW4gdDEsIHdoaWNoIGlzIHdoYXQgcHJvbG9ndWUoKSBsZWF2ZXMgYmVo aW5kLgpAQCAtMTQwOSw2ICsxNDA0LDEwIEBAIF9sbGludF9vcF9wdXRfYnlfaWQ6CiAKIC5vcFB1 dEJ5SWRUcmFuc2l0aW9uRGlyZWN0OgogICAgIHN0b3JlaSB0MSwgSlNDZWxsOjptX3N0cnVjdHVy ZUlEW3QwXQorICAgIHdyaXRlQmFycmllck9uT3BlcmFuZCgxKQorICAgICMgUmVsb2FkIGJhc2Ug aW50byB0MAorICAgIGxvYWRpc0Zyb21JbnN0cnVjdGlvbigxLCB0MSkKKyAgICBsb2FkQ29uc3Rh bnRPclZhcmlhYmxlKHQxLCB0MCkKIAogLm9wUHV0QnlJZE5vdFRyYW5zaXRpb246CiAgICAgIyBU aGUgb25seSB0aGluZyBsaXZlIHJpZ2h0IG5vdyBpcyB0MCwgd2hpY2ggaG9sZHMgdGhlIGJhc2Uu Cg==