173488 2017-06-16 12:38:39 -0700 Intermittent crash running Internal/Tests/InternalJSTests/Regress/radar-24300617.js 2017-06-19 13:15:11 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 msaboff msaboff buildbot fpizlo keith_miller mark.lam saam simon.fraser oldest_to_newest 1320082 0 msaboff 2017-06-16 12:38:39 -0700 While running JavaSCriptCore tests on a release build of r218202 I got a crash under JSC::JSObject::visitChildren(). Here is the relevent part of the crashing stack’s backtrace: Thread 8 Crashed:: WTF::AutomaticThread 0 com.apple.JavaScriptCore 0x000000010ade8759 JSC::JSObject::visitChildren(JSC::JSCell*, JSC::SlotVisitor&) + 1641 (MarkedBlock.h:497) 1 com.apple.JavaScriptCore 0x000000010a8c5675 JSC::ClonedArguments::visitChildren(JSC::JSCell*, JSC::SlotVisitor&) + 21 (WriteBarrier.h:91) 2 com.apple.JavaScriptCore 0x000000010b06030e JSC::SlotVisitor::drain(WTF::MonotonicTime)::$_3::operator()(JSC::MarkStackArray&) const + 334 (SlotVisitor.cpp:388) 3 com.apple.JavaScriptCore 0x000000010b05e554 JSC::SlotVisitor::drain(WTF::MonotonicTime) + 164 (SlotVisitorInlines.h:173) 4 com.apple.JavaScriptCore 0x000000010b05ea2d JSC::SlotVisitor::drainFromShared(JSC::SlotVisitor::SharedDrainMode, WTF::MonotonicTime) + 61 (SlotVisitor.cpp:652) 5 com.apple.JavaScriptCore 0x000000010ac7bbf2 WTF::SharedTaskFunctor<void (), JSC::Heap::runBeginPhase(JSC::GCConductor)::$_11>::run() + 594 (SlotVisitor.h:258) 6 com.apple.JavaScriptCore 0x000000010b1c790c WTF::ParallelHelperClient::runTask(WTF::RefPtr<WTF::SharedTask<void ()> >) + 44 (RefPtr.h:80) 7 com.apple.JavaScriptCore 0x000000010b1c8400 WTF::ParallelHelperPool::Thread::work() + 48 (utility:754) … I tried reproducing by running the test 20 times and got 2 crashes. 1320086 1 msaboff 2017-06-16 12:39:04 -0700 <rdar://problem/32750435> 1320096 2 313114 msaboff 2017-06-16 12:51:52 -0700 Created attachment 313114 Patch 1320163 3 msaboff 2017-06-16 14:12:17 -0700 Committed r218414: <http://trac.webkit.org/changeset/218414> 1320802 4 313114 simon.fraser 2017-06-19 13:15:11 -0700 Comment on attachment 313114 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=313114&action=review Can we not make a test for this? > Source/JavaScriptCore/ChangeLog:10 > + bogus values in those slots. Instead, let's use the standard BUtterfly:tryCreate() method BUtterfly 313114 2017-06-16 12:51:52 -0700 2017-06-16 12:54:37 -0700 Patch 173488.patch text/plain 2249 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjE4NDAxKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBA CisyMDE3LTA2LTE2ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIEludGVybWl0dGVudCBjcmFzaCBydW5uaW5nIEludGVybmFsL1Rlc3RzL0ludGVybmFsSlNU ZXN0cy9SZWdyZXNzL3JhZGFyLTI0MzAwNjE3LmpzCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNzM0ODgKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP RFkgKE9PUFMhKS4KKworICAgICAgICBDbG9uZWRBcmd1bWVudHMgbGF6aWx5IHNldHMgaXRzIGNh bGxlZSBhbmQgaW50ZXJhdG9yIHByb3BlcnRpZXMgYW5kIGl0IHVzZWQgaXRzIG93biBpbmxpbmUK KyAgICAgICAgY29kZSB0byBpbml0aWFsaXplIGl0cyBidXR0ZXJmbHkuICBUaGlzIG1lYW5zIHRo YXQgdGhlc2UgbGF6aWx5IHNldCBwcm9wZXJ0aWVzIGNhbiBoYXZlCisgICAgICAgIGJvZ3VzIHZh bHVlcyBpbiB0aG9zZSBzbG90cy4gIEluc3RlYWQsIGxldCdzIHVzZSB0aGUgc3RhbmRhcmQgQlV0 dGVyZmx5OnRyeUNyZWF0ZSgpIG1ldGhvZAorICAgICAgICB0byBjcmVhdGUgdGhlIGJ1dHRlcmZs eSBhcyBpdCBjbGVhcnMgb3V0IG9mIGxpbmUgcHJvcGVydGllcy4KKworICAgICAgICAqIHJ1bnRp bWUvQ2xvbmVkQXJndW1lbnRzLmNwcDoKKyAgICAgICAgKEpTQzo6Q2xvbmVkQXJndW1lbnRzOjpj cmVhdGVFbXB0eSk6CisKIDIwMTctMDYtMTYgIE1hdHQgTGV3aXMgIDxqbGV3aXMzQGFwcGxlLmNv bT4KIAogICAgICAgICBVbnJldmlld2VkLCByb2xsaW5nIG91dCByMjE4Mzc2LgpJbmRleDogU291 cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvQ2xvbmVkQXJndW1lbnRzLmNwcAo9PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9DbG9uZWRBcmd1bWVudHMuY3BwCShy ZXZpc2lvbiAyMTgzNDMpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9DbG9uZWRB cmd1bWVudHMuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC01NCwxMyArNTQsMTMgQEAgQ2xvbmVkQXJn dW1lbnRzKiBDbG9uZWRBcmd1bWVudHM6OmNyZWF0ZQogICAgICAgICBidXR0ZXJmbHktPmFycmF5 U3RvcmFnZSgpLT5tX251bVZhbHVlc0luVmVjdG9yID0gdmVjdG9yTGVuZ3RoOwogCiAgICAgfSBl bHNlIHsKLSAgICAgICAgdm9pZCogdGVtcCA9IHZtLmF1eGlsaWFyeVNwYWNlLnRyeUFsbG9jYXRl KEJ1dHRlcmZseTo6dG90YWxTaXplKDAsIHN0cnVjdHVyZS0+b3V0T2ZMaW5lQ2FwYWNpdHkoKSwg dHJ1ZSwgdmVjdG9yTGVuZ3RoICogc2l6ZW9mKEVuY29kZWRKU1ZhbHVlKSkpOwotICAgICAgICBp ZiAoIXRlbXApCisgICAgICAgIEluZGV4aW5nSGVhZGVyIGluZGV4aW5nSGVhZGVyOworICAgICAg ICBpbmRleGluZ0hlYWRlci5zZXRWZWN0b3JMZW5ndGgodmVjdG9yTGVuZ3RoKTsKKyAgICAgICAg aW5kZXhpbmdIZWFkZXIuc2V0UHVibGljTGVuZ3RoKGxlbmd0aCk7CisgICAgICAgIGJ1dHRlcmZs eSA9IEJ1dHRlcmZseTo6dHJ5Q3JlYXRlKHZtLCAwLCAwLCBzdHJ1Y3R1cmUtPm91dE9mTGluZUNh cGFjaXR5KCksIHRydWUsIGluZGV4aW5nSGVhZGVyLCB2ZWN0b3JMZW5ndGggKiBzaXplb2YoRW5j b2RlZEpTVmFsdWUpKTsKKyAgICAgICAgaWYgKCFidXR0ZXJmbHkpCiAgICAgICAgICAgICByZXR1 cm4gMDsKLSAgICAgICAgYnV0dGVyZmx5ID0gQnV0dGVyZmx5Ojpmcm9tQmFzZSh0ZW1wLCAwLCBz dHJ1Y3R1cmUtPm91dE9mTGluZUNhcGFjaXR5KCkpOwotICAgICAgICBidXR0ZXJmbHktPnNldFZl Y3Rvckxlbmd0aCh2ZWN0b3JMZW5ndGgpOwotICAgICAgICBidXR0ZXJmbHktPnNldFB1YmxpY0xl bmd0aChsZW5ndGgpOwotICAgICAgICAKKwogICAgICAgICBmb3IgKHVuc2lnbmVkIGkgPSBsZW5n dGg7IGkgPCB2ZWN0b3JMZW5ndGg7ICsraSkKICAgICAgICAgICAgIGJ1dHRlcmZseS0+Y29udGln dW91cygpW2ldLmNsZWFyKCk7CiAgICAgfQo=