171266 2017-04-25 02:52:47 -0700 [Win][x86-64] Some callee saved registers aren't preserved 2017-06-06 21:19:57 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=148666 P2 Normal --- 1 fujii fujii achristensen bfulgham buildbot commit-queue keith_miller mark.lam msaboff pvollan saam oldest_to_newest 1300944 0 fujii 2017-04-25 02:52:47 -0700 [Win] Crashes in JSC::JITCode::execute while using WebInspector WinCairo port, Release build, trunk@215722 While I'm using WebInspector of MiniBrowser, I often see the JSC crash. I don't see the same crash in Debug build. Callstack: > JavaScriptCore.dll!JSC::JITCode::execute(JSC::VM * vm, JSC::ProtoCallFrame * protoCallFrame) Line 82 C++ > JavaScriptCore.dll!JSC::Interpreter::executeCall(JSC::ExecState * callFrame, JSC::JSObject * function, JSC::CallType callType, const JSC::CallData & callData, JSC::JSValue thisValue, const JSC::ArgList & args) Line 954 C++ > JavaScriptCore.dll!JSC::call(JSC::ExecState * exec, JSC::JSValue functionObject, JSC::CallType callType, const JSC::CallData & callData, JSC::JSValue thisValue, const JSC::ArgList & args) Line 39 C++ > JavaScriptCore.dll!JSC::callGetter(JSC::ExecState * exec, JSC::JSValue base, JSC::JSValue getterSetter) Line 87 C++ > JavaScriptCore.dll!JSC::PropertySlot::functionGetter(JSC::ExecState * exec) Line 33 C++ > JavaScriptCore.dll!JSC::operationGetByIdOptimize::__l2::<lambda>(bool found, JSC::PropertySlot & slot) Line 264 C++ > JavaScriptCore.dll!operationGetByIdOptimize(JSC::ExecState * exec, JSC::StructureStubInfo * stubInfo, __int64 base, WTF::UniquedStringImpl * uid) Line 261 C++ > [External Code] Disassembly: > --- c:\webkit\ga\source\javascriptcore\jit\jitcode.cpp ------------------------- > > JSValue JITCode::execute(VM* vm, ProtoCallFrame* protoCallFrame) > { > 00007FFF08523E50 push rbx > 00007FFF08523E52 push rsi > 00007FFF08523E53 push rdi > 00007FFF08523E54 sub rsp,30h > 00007FFF08523E58 mov rbx,r9 > 00007FFF08523E5B mov rdi,r8 > 00007FFF08523E5E mov r9,rcx > 00007FFF08523E61 mov rsi,rdx > auto scope = DECLARE_THROW_SCOPE(*vm); > void* entryAddress; > JSFunction* function = jsDynamicCast<JSFunction*>(*vm, protoCallFrame->callee()); > 00007FFF08523E64 mov rax,qword ptr [rbx+8] > 00007FFF08523E68 mov ecx,dword ptr [rax] > 00007FFF08523E6A mov rax,qword ptr [r8+0C8h] > 00007FFF08523E71 btr ecx,1Fh > 00007FFF08523E75 mov rax,qword ptr [rax+rcx*8] > 00007FFF08523E79 mov rax,qword ptr [rax+40h] > 00007FFF08523E7D test rax,rax > 00007FFF08523E80 je JSC::JITCode::execute+4Eh (07FFF08523E9Eh) > 00007FFF08523E82 lea rcx,[JSC::JSFunction::s_info (07FFF08910340h)] > 00007FFF08523E89 nop dword ptr [rax] > 00007FFF08523E90 cmp rax,rcx > 00007FFF08523E93 je JSC::JITCode::execute+86h (07FFF08523ED6h) > 00007FFF08523E95 mov rax,qword ptr [rax+8] > 00007FFF08523E99 test rax,rax > 00007FFF08523E9C jne JSC::JITCode::execute+40h (07FFF08523E90h) > ASSERT(!protoCallFrame->needArityCheck()); > entryAddress = executableAddress(); > 00007FFF08523E9E mov rax,qword ptr [r9] > 00007FFF08523EA1 xor edx,edx > 00007FFF08523EA3 mov rcx,r9 > 00007FFF08523EA6 call qword ptr [rax+10h] > JSValue result = JSValue::decode(vmEntryToJavaScript(entryAddress, vm, protoCallFrame)); > 00007FFF08523EA9 mov r8,rbx > 00007FFF08523EAC mov rdx,rdi > 00007FFF08523EAF mov rcx,rax > 00007FFF08523EB2 call vmEntryToJavaScript (07FFF08853CC0h) > return scope.exception() ? jsNull() : result; > 00007FFF08523EB7 cmp qword ptr [rdi+81A8h],0 > 00007FFF08523EBF mov ecx,2 > 00007FFF08523EC4 cmovne rax,rcx > 00007FFF08523EC8 mov qword ptr [rsi],rax > 00007FFF08523ECB mov rax,rsi > } > 00007FFF08523ECE add rsp,30h > 00007FFF08523ED2 pop rdi > 00007FFF08523ED3 pop rsi > 00007FFF08523ED4 pop rbx > 00007FFF08523ED5 ret > > if (!function || !protoCallFrame->needArityCheck()) { > 00007FFF08523ED6 cmp byte ptr [rbx+24h],0 > 00007FFF08523EDA je JSC::JITCode::execute+4Eh (07FFF08523E9Eh) > } else > entryAddress = addressForCall(MustCheckArity).executableAddress(); > 00007FFF08523EDC mov rax,qword ptr [r9] > 00007FFF08523EDF lea rdx,[rsp+20h] > 00007FFF08523EE4 mov r8d,1 > 00007FFF08523EEA mov rcx,r9 > 00007FFF08523EED call qword ptr [rax+8] > 00007FFF08523EF0 mov rax,qword ptr [rax] > 00007FFF08523EF3 jmp JSC::JITCode::execute+59h (07FFF08523EA9h) > --- No source file ------------------------------------------------------------- Registers: > RAX = 0000000000000002 RBX = 0000003A6D6FAF68 RCX = 0000000000000002 RDX = 0000021C04823720 > RSI = 0000000700000001 RDI = 0000021C83EF42E0 R8  = 0000003A6D6FBA80 R9  = 40252A53C8000000 > R10 = 0000003A6D6FAE40 R11 = 0000000000000000 R12 = 0000003A6D6FB080 R13 = 0000000000000001 > R14 = 0000021C04823720 R15 = 0000000000000002 RIP = 00007FFF08523EC8 RSP = 0000003A6D6FAEA0 > RBP = 0000003A6D6FAF99 EFL = 00010200 1313081 1 fujii 2017-05-26 01:57:46 -0700 current RIP was 00007FFF08523EC8. > 00007FFF08523EC8 mov qword ptr [rsi],rax rsi pointed to a invalid address. rsi should point to a address to where the return value (JSValue) will be stored. rsi is a callee saved registers. It seems that one of the functions called from JITCode::execute destructed rsi. 1313087 2 311345 fujii 2017-05-26 02:34:21 -0700 Created attachment 311345 WIP patch * I don't understand CalleeSaveSpaceAsVirtualRegisters * r12-r15 are also callee saved registers 1313542 3 fujii 2017-05-28 22:40:19 -0700 This is not a right fix. copyCalleeSavesToVMEntryFrameCalleeSavesBuffer in LowLevelInterpreter.asm saves all callee saved registers. 1315937 4 312062 fujii 2017-06-06 00:52:46 -0700 Created attachment 312062 WIP patch 1316371 5 fujii 2017-06-06 20:19:28 -0700 It takes about 1-15 minutes to reproduce this crash by using Web Inspector of WinCairo port. I don't know any other method or web sites to reproduce this crash. I have no idea how to create a regression test for this. And, the change of Bug 148666 didn't have a layout test. 1316374 6 312158 fujii 2017-06-06 20:25:55 -0700 Created attachment 312158 Patch 1316384 7 312158 commit-queue 2017-06-06 21:19:56 -0700 Comment on attachment 312158 Patch Clearing flags on attachment: 312158 Committed r217874: <http://trac.webkit.org/changeset/217874> 1316385 8 commit-queue 2017-06-06 21:19:57 -0700 All reviewed patches have been landed. Closing bug. 311345 2017-05-26 02:34:21 -0700 2017-06-06 00:52:46 -0700 WIP patch a.diff text/plain 1862 fujii ZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9sbGludC9Mb3dMZXZlbEludGVycHJl dGVyLmFzbSBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9sbGludC9Mb3dMZXZlbEludGVycHJldGVy LmFzbQppbmRleCAyZmNiNmU2MzRkOS4uNmRiZGJjZTc4ODAgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9K YXZhU2NyaXB0Q29yZS9sbGludC9Mb3dMZXZlbEludGVycHJldGVyLmFzbQorKysgYi9Tb3VyY2Uv SmF2YVNjcmlwdENvcmUvbGxpbnQvTG93TGV2ZWxJbnRlcnByZXRlci5hc20KQEAgLTUwMiw3ICs1 MDIsNyBAQCBtYWNybyBjaGVja1N0YWNrUG9pbnRlckFsaWdubWVudCh0ZW1wUmVnLCBsb2NhdGlv bikKICAgICBlbmQKIGVuZAogCi1pZiBDX0xPT1Agb3IgQVJNNjQgb3IgWDg2XzY0IG9yIFg4Nl82 NF9XSU4KK2lmIENfTE9PUCBvciBBUk02NCBvciBYODZfNjQKICAgICBjb25zdCBDYWxsZWVTYXZl UmVnaXN0ZXJDb3VudCA9IDAKIGVsc2lmIEFSTSBvciBBUk12N19UUkFESVRJT05BTCBvciBBUk12 NwogICAgIGNvbnN0IENhbGxlZVNhdmVSZWdpc3RlckNvdW50ID0gNwpAQCAtNTEwLDYgKzUxMCw4 IEBAIGVsc2lmIE1JUFMKICAgICBjb25zdCBDYWxsZWVTYXZlUmVnaXN0ZXJDb3VudCA9IDEKIGVs c2lmIFg4NiBvciBYODZfV0lOCiAgICAgY29uc3QgQ2FsbGVlU2F2ZVJlZ2lzdGVyQ291bnQgPSAz CitlbHNpZiBYODZfNjRfV0lOCisgICAgY29uc3QgQ2FsbGVlU2F2ZVJlZ2lzdGVyQ291bnQgPSAz CiBlbmQKIAogY29uc3QgQ2FsbGVlUmVnaXN0ZXJTYXZlU2l6ZSA9IENhbGxlZVNhdmVSZWdpc3Rl ckNvdW50ICogUHRyU2l6ZQpAQCAtNTE5LDcgKzUyMSw3IEBAIGNvbnN0IENhbGxlZVJlZ2lzdGVy U2F2ZVNpemUgPSBDYWxsZWVTYXZlUmVnaXN0ZXJDb3VudCAqIFB0clNpemUKIGNvbnN0IFZNRW50 cnlUb3RhbEZyYW1lU2l6ZSA9IChDYWxsZWVSZWdpc3RlclNhdmVTaXplICsgc2l6ZW9mIFZNRW50 cnlSZWNvcmQgKyBTdGFja0FsaWdubWVudCAtIDEpICYgflN0YWNrQWxpZ25tZW50TWFzawogCiBt YWNybyBwdXNoQ2FsbGVlU2F2ZXMoKQotICAgIGlmIENfTE9PUCBvciBBUk02NCBvciBYODZfNjQg b3IgWDg2XzY0X1dJTgorICAgIGlmIENfTE9PUCBvciBBUk02NCBvciBYODZfNjQKICAgICBlbHNp ZiBBUk0gb3IgQVJNdjdfVFJBRElUSU9OQUwKICAgICAgICAgZW1pdCAicHVzaCB7cjQtcjEwfSIK ICAgICBlbHNpZiBBUk12NwpAQCAtNTM3LDExICs1MzksMTUgQEAgbWFjcm8gcHVzaENhbGxlZVNh dmVzKCkKICAgICAgICAgZW1pdCAicHVzaCBlc2kiCiAgICAgICAgIGVtaXQgInB1c2ggZWRpIgog ICAgICAgICBlbWl0ICJwdXNoIGVieCIKKyAgICBlbHNpZiBYODZfNjRfV0lOCisgICAgICAgIGVt aXQgInB1c2ggcnNpIgorICAgICAgICBlbWl0ICJwdXNoIHJkaSIKKyAgICAgICAgZW1pdCAicHVz aCByYngiCiAgICAgZW5kCiBlbmQKIAogbWFjcm8gcG9wQ2FsbGVlU2F2ZXMoKQotICAgIGlmIENf TE9PUCBvciBBUk02NCBvciBYODZfNjQgb3IgWDg2XzY0X1dJTgorICAgIGlmIENfTE9PUCBvciBB Uk02NCBvciBYODZfNjQKICAgICBlbHNpZiBBUk0gb3IgQVJNdjdfVFJBRElUSU9OQUwKICAgICAg ICAgZW1pdCAicG9wIHtyNC1yMTB9IgogICAgIGVsc2lmIEFSTXY3CkBAIC01NTcsNiArNTYzLDEw IEBAIG1hY3JvIHBvcENhbGxlZVNhdmVzKCkKICAgICAgICAgZW1pdCAicG9wIGVieCIKICAgICAg ICAgZW1pdCAicG9wIGVkaSIKICAgICAgICAgZW1pdCAicG9wIGVzaSIKKyAgICBlbHNpZiBYODZf NjRfV0lOCisgICAgICAgIGVtaXQgInBvcCByYngiCisgICAgICAgIGVtaXQgInBvcCByZGkiCisg ICAgICAgIGVtaXQgInBvcCByc2kiCiAgICAgZW5kCiBlbmQKIAo= 312062 2017-06-06 00:52:46 -0700 2017-06-06 20:25:50 -0700 WIP patch bug171266.patch text/plain 597 fujii ZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvUmVnaXN0ZXJTZXQuY3BwIGIv U291cmNlL0phdmFTY3JpcHRDb3JlL2ppdC9SZWdpc3RlclNldC5jcHAKaW5kZXggZTZlNzc0MWNm NjAuLjYyZTgzMWJlNWJjIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L1Jl Z2lzdGVyU2V0LmNwcAorKysgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L1JlZ2lzdGVyU2V0 LmNwcApAQCAtMTEzLDYgKzExMywxMCBAQCBSZWdpc3RlclNldCBSZWdpc3RlclNldDo6Y2FsbGVl U2F2ZVJlZ2lzdGVycygpCiAjZWxpZiBDUFUoWDg2XzY0KQogICAgIHJlc3VsdC5zZXQoWDg2UmVn aXN0ZXJzOjplYngpOwogICAgIHJlc3VsdC5zZXQoWDg2UmVnaXN0ZXJzOjplYnApOworI2lmIE9T KFdJTkRPV1MpCisgICAgcmVzdWx0LnNldChYODZSZWdpc3RlcnM6OmVkaSk7CisgICAgcmVzdWx0 LnNldChYODZSZWdpc3RlcnM6OmVzaSk7CisjZW5kaWYKICAgICByZXN1bHQuc2V0KFg4NlJlZ2lz dGVyczo6cjEyKTsKICAgICByZXN1bHQuc2V0KFg4NlJlZ2lzdGVyczo6cjEzKTsKICAgICByZXN1 bHQuc2V0KFg4NlJlZ2lzdGVyczo6cjE0KTsK 312158 2017-06-06 20:25:55 -0700 2017-06-06 21:19:56 -0700 Patch bug-171266-20170607122554.patch text/plain 1406 fujii U3VidmVyc2lvbiBSZXZpc2lvbjogMjE3ODIxCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCA0 M2JjMjAyYjU1M2YyZTc0OGU5YWZlMTc1NTUzNjBjMGFhODYzNTM1Li4wYmRhZmM3ODMxZDY1OTZj Y2Q2NGE3YmRlOTNmOWM1YzNhNDU2ZTkwIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxMyBAQAorMjAxNy0wNi0wNiAgRnVqaWkgSGlyb25vcmkgIDxIaXJvbm9yaS5GdWppaUBz b255LmNvbT4KKworICAgICAgICBbV2luXVt4ODYtNjRdIFNvbWUgY2FsbGVlIHNhdmVkIHJlZ2lz dGVycyBhcmVuJ3QgcHJlc2VydmVkCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3No b3dfYnVnLmNnaT9pZD0xNzEyNjYKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMh KS4KKworICAgICAgICAqIGppdC9SZWdpc3RlclNldC5jcHA6CisgICAgICAgIChKU0M6OlJlZ2lz dGVyU2V0OjpjYWxsZWVTYXZlUmVnaXN0ZXJzKTogQWRkZWQgZWRpIGFuZCBlc2kgZm9yIFg4Nl82 NCBXaW5kb3dzLgorCiAyMDE3LTA2LTA1ICBTYWFtIEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUuY29t PgogCiAgICAgICAgIFRyeSB0byBmaXggZmVhdHVyZXMuanNvbiBieSBhZGRpbmcgYW4gRVNOZXh0 IHNlY3Rpb24uCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L1JlZ2lzdGVy U2V0LmNwcCBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvUmVnaXN0ZXJTZXQuY3BwCmluZGV4 IGU2ZTc3NDFjZjYwZWVkZjVhYzk1YzVjNGZiYzYyMThmNDc4OWU1OGMuLjYyZTgzMWJlNWJjMmFm NTIwNmVmNzQ5NjIzN2M3YTAwZTFiYjIxNzEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0 Q29yZS9qaXQvUmVnaXN0ZXJTZXQuY3BwCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQv UmVnaXN0ZXJTZXQuY3BwCkBAIC0xMTMsNiArMTEzLDEwIEBAIFJlZ2lzdGVyU2V0IFJlZ2lzdGVy U2V0OjpjYWxsZWVTYXZlUmVnaXN0ZXJzKCkKICNlbGlmIENQVShYODZfNjQpCiAgICAgcmVzdWx0 LnNldChYODZSZWdpc3RlcnM6OmVieCk7CiAgICAgcmVzdWx0LnNldChYODZSZWdpc3RlcnM6OmVi cCk7CisjaWYgT1MoV0lORE9XUykKKyAgICByZXN1bHQuc2V0KFg4NlJlZ2lzdGVyczo6ZWRpKTsK KyAgICByZXN1bHQuc2V0KFg4NlJlZ2lzdGVyczo6ZXNpKTsKKyNlbmRpZgogICAgIHJlc3VsdC5z ZXQoWDg2UmVnaXN0ZXJzOjpyMTIpOwogICAgIHJlc3VsdC5zZXQoWDg2UmVnaXN0ZXJzOjpyMTMp OwogICAgIHJlc3VsdC5zZXQoWDg2UmVnaXN0ZXJzOjpyMTQpOwo=