184891 2018-04-23 10:55:45 -0700 [WinCairo] Fix js/regexp-unicode.html crash. 2018-04-25 12:36:21 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 ross.kirsling ross.kirsling achristensen commit-queue ews-watchlist keith_miller mark.lam msaboff pvollan saam webkit-bug-importer ysuzuki oldest_to_newest 1416925 0 ross.kirsling 2018-04-23 10:55:45 -0700 Layout test js/regexp-unicode.html is currently crashing for WinCairo, but only in Release mode. As a more pointed repro case, one can simply execute the line `/\u{1044f}/u.test("\ud801\udc4f")` in JSC. This seems to be another MSVC __forceinline issue. 1416928 1 338594 ross.kirsling 2018-04-23 11:03:25 -0700 Created attachment 338594 Patch 1417184 2 338594 achristensen 2018-04-24 10:27:57 -0700 Comment on attachment 338594 Patch This feels like it's just covering up another bug. I've seen bugs like this before that are actually from using uninitialized memory. 1417185 3 338594 mark.lam 2018-04-24 10:31:52 -0700 Comment on attachment 338594 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=338594&action=review > Source/JavaScriptCore/ChangeLog:10 > + MSVC evidently can't handle __forceinline here. Can you please explain why __forceinline would result in a crash in the first place? It doesn't make sense that a change in inlining behavior would resolve a crash short of working around a compiler bug. You'll need to provide proof if that is the case. 1417188 4 ross.kirsling 2018-04-24 10:33:02 -0700 (In reply to Alex Christensen from comment #2) > Comment on attachment 338594 [details] > Patch > > This feels like it's just covering up another bug. I've seen bugs like this > before that are actually from using uninitialized memory. That is indeed the type of crash here, but it claims to be occurring at: https://github.com/WebKit/webkit/blob/master/Source/JavaScriptCore/runtime/RegExpInlines.h#L279 ...which seems like it's probably not accurate due to optimization. Unfortunately, there's no repro with RelWithDebInfo, so I'm a bit confused how to proceed... 1417190 5 ross.kirsling 2018-04-24 10:33:56 -0700 (In reply to Mark Lam from comment #3) > Comment on attachment 338594 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=338594&action=review > > > Source/JavaScriptCore/ChangeLog:10 > > + MSVC evidently can't handle __forceinline here. > > Can you please explain why __forceinline would result in a crash in the > first place? It doesn't make sense that a change in inlining behavior would > resolve a crash short of working around a compiler bug. You'll need to > provide proof if that is the case. I agree. In particular, it's perplexing that AppleWin doesn't seem to have such an issue (though I imagine this is almost certainly a 32-bit/64-bit difference). 1417360 6 ross.kirsling 2018-04-24 17:42:12 -0700 It appears that during the call to YarrJIT::execute here, %rdi gets overwritten (to 0xDC00): https://github.com/WebKit/webkit/blob/master/Source/JavaScriptCore/runtime/RegExpInlines.h#L269 > call rax > movups xmm1,xmmword ptr [rax] Now, when we reach the return here, which destination register gets chosen evidently depends on __forceinline: https://github.com/WebKit/webkit/blob/master/Source/JavaScriptCore/runtime/RegExpInlines.h#L279 Specifically, with `inline` we have... > movups xmmword ptr [rbx],xmm1 ...but with `__forceinline` we have... > movups xmmword ptr [rdi],xmm1 As established, %rdi has already been changed to 0xDC00, so the latter crashes with a write violation. 1417641 7 338762 ross.kirsling 2018-04-25 11:25:43 -0700 Created attachment 338762 Patch 1417644 8 338762 ysuzuki 2018-04-25 11:27:35 -0700 Comment on attachment 338762 Patch r=me 1417683 9 338762 commit-queue 2018-04-25 12:35:05 -0700 Comment on attachment 338762 Patch Clearing flags on attachment: 338762 Committed r231009: <https://trac.webkit.org/changeset/231009> 1417684 10 commit-queue 2018-04-25 12:35:07 -0700 All reviewed patches have been landed. Closing bug. 1417685 11 webkit-bug-importer 2018-04-25 12:36:21 -0700 <rdar://problem/39730640> 338594 2018-04-23 11:03:25 -0700 2018-04-25 11:25:41 -0700 Patch bug-184891-20180423110326.patch text/plain 2668 ross.kirsling U3VidmVyc2lvbiBSZXZpc2lvbjogMjMwODU3CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCA0 OGFiY2I5ZTk2MTBiOGE3NWI5MDMwYzk3MTVmMDE2ZjNiMzAzOWQ4Li5jOWNhZjI5MWYwZDZjMmZj ZGE4MjcyNjAzOWY2YmY5NjEyNGEzOWM2IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxNCBAQAorMjAxOC0wNC0yMyAgUm9zcyBLaXJzbGluZyAgPHJvc3Mua2lyc2xpbmdAc29u eS5jb20+CisKKyAgICAgICAgW1dpbkNhaXJvXSBGaXgganMvcmVnZXhwLXVuaWNvZGUuaHRtbCBj cmFzaC4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE4 NDg5MQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICog cnVudGltZS9SZWdFeHBJbmxpbmVzLmg6CisgICAgICAgIChKU0M6OlJlZ0V4cDo6bWF0Y2hJbmxp bmUpOgorICAgICAgICBNU1ZDIGV2aWRlbnRseSBjYW4ndCBoYW5kbGUgX19mb3JjZWlubGluZSBo ZXJlLiAKKwogMjAxOC0wNC0yMCAgRGFuaWVsIEJhdGVzICA8ZGFiYXRlc0BhcHBsZS5jb20+CiAK ICAgICAgICAgUmVtb3ZlIGNvZGUgZm9yIGNvbXBpbGVycyB0aGF0IGRpZCBub3Qgc3VwcG9ydCBO U0RNSSBmb3IgYWdncmVnYXRlcwpkaWZmIC0tZ2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3JlL3J1 bnRpbWUvUmVnRXhwSW5saW5lcy5oIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvUmVn RXhwSW5saW5lcy5oCmluZGV4IDkzYTBlYzIzZWYyZThlMGEzNmY2MDBlODc1YjU4NzE3ZDU1NTY0 NzguLmY5NzEwYjE0N2M0MmYzMDA4MGU2ZjM3MTRlNzU0MzZiZDc1ZTVjMzYgMTAwNjQ0Ci0tLSBh L1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL1JlZ0V4cElubGluZXMuaAorKysgYi9Tb3Vy Y2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9SZWdFeHBJbmxpbmVzLmgKQEAgLTI0MCw3ICsyNDAs NyBAQCBBTFdBWVNfSU5MSU5FIHZvaWQgUmVnRXhwOjpjb21waWxlSWZOZWNlc3NhcnlNYXRjaE9u bHkoVk0mIHZtLCBZYXJyOjpZYXJyQ2hhclNpegogICAgIGNvbXBpbGVNYXRjaE9ubHkoJnZtLCBj aGFyU2l6ZSk7CiB9CiAKLUFMV0FZU19JTkxJTkUgTWF0Y2hSZXN1bHQgUmVnRXhwOjptYXRjaElu bGluZShWTSYgdm0sIGNvbnN0IFN0cmluZyYgcywgdW5zaWduZWQgc3RhcnRPZmZzZXQpCitBTFdB WVNfSU5MSU5FX0VYQ0VQVF9NU1ZDIE1hdGNoUmVzdWx0IFJlZ0V4cDo6bWF0Y2hJbmxpbmUoVk0m IHZtLCBjb25zdCBTdHJpbmcmIHMsIHVuc2lnbmVkIHN0YXJ0T2Zmc2V0KQogewogI2lmIEVOQUJM RShSRUdFWFBfVFJBQ0lORykKICAgICBtX3J0TWF0Y2hPbmx5Q2FsbENvdW50Kys7CmRpZmYgLS1n aXQgYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKaW5kZXgg NTc4NDhiZjU5ZTVlMjY3MGQwNWI2YWVkNzM3NTkxMzY0NzQyNWQxOC4uYWQ5ODE1MWRhMjY4MjA1 MGU2NzZiNjgwNDgyOGQxMmQ1MDVhZTVlYiAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvQ2hhbmdl TG9nCisrKyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDEyIEBACisyMDE4LTA0 LTIzICBSb3NzIEtpcnNsaW5nICA8cm9zcy5raXJzbGluZ0Bzb255LmNvbT4KKworICAgICAgICBb V2luQ2Fpcm9dIEZpeCBqcy9yZWdleHAtdW5pY29kZS5odG1sIGNyYXNoLgorICAgICAgICBodHRw czovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTg0ODkxCisKKyAgICAgICAgUmV2 aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBwbGF0Zm9ybS93aW5jYWlyby9U ZXN0RXhwZWN0YXRpb25zOgorCiAyMDE4LTA0LTIwICBZb3Vlbm4gRmFibGV0ICA8eW91ZW5uQGFw cGxlLmNvbT4KIAogICAgICAgICBSZWZhY3RvciBOZXR3b3JrUmVzb3VyY2VMb2FkZXIgdG8gY2hl Y2sgZm9yIG1fbmV0d29ya0xvYWRDaGVja2VyIHByZXNlbmNlIGJlZm9yZSB1c2luZyBpdApkaWZm IC0tZ2l0IGEvTGF5b3V0VGVzdHMvcGxhdGZvcm0vd2luY2Fpcm8vVGVzdEV4cGVjdGF0aW9ucyBi L0xheW91dFRlc3RzL3BsYXRmb3JtL3dpbmNhaXJvL1Rlc3RFeHBlY3RhdGlvbnMKaW5kZXggOGNj OTNmM2E3YjY3YzAyOGZiYTkwNGQyYTdiODExZDQzNGJlZWExOS4uZGQ2Mzc0Nzk5ZTQ5ZWE5OTdm ZDQ1NWY5ZGU2NmIzOGVmMjI2MWY2NyAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvcGxhdGZvcm0v d2luY2Fpcm8vVGVzdEV4cGVjdGF0aW9ucworKysgYi9MYXlvdXRUZXN0cy9wbGF0Zm9ybS93aW5j YWlyby9UZXN0RXhwZWN0YXRpb25zCkBAIC0xNTI1LDcgKzE1MjUsNiBAQCBpbXBvcnRlZC9ibGlu ayBbIFNraXAgXQogaW1wb3J0ZWQvbW96aWxsYSBbIFNraXAgXQogaW1wb3J0ZWQvdzNjIFsgU2tp cCBdCiBpbnNwZWN0b3IgWyBTa2lwIF0KLWpzL3JlZ2V4cC11bmljb2RlLmh0bWwgWyBTa2lwIF0K IGpzL2RvbSBbIFNraXAgXQogbGVnYWN5LWFuaW1hdGlvbi1lbmdpbmUvbWVkaWEgWyBTa2lwIF0K IGxlZ2FjeS1hbmltYXRpb24tZW5naW5lL3RyYW5zaXRpb25zIFsgU2tpcCBdCg== 338762 2018-04-25 11:25:43 -0700 2018-04-25 12:35:05 -0700 Patch bug-184891-20180425112541.patch text/plain 3308 ross.kirsling U3VidmVyc2lvbiBSZXZpc2lvbjogMjMxMDAwCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCBj OTVhNGRhZGQ3MzAzMzM4MDlhZjJmYjM4YTljYjMzNTFlMjI2ZTU3Li45Y2Y1MjhhOTAxOWU2M2Yw M2JhOWZjYmM5YmJmOWI4ZmY3NTc2MTcyIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxOCBAQAorMjAxOC0wNC0yNSAgUm9zcyBLaXJzbGluZyAgPHJvc3Mua2lyc2xpbmdAc29u eS5jb20+CisKKyAgICAgICAgW1dpbkNhaXJvXSBGaXgganMvcmVnZXhwLXVuaWNvZGUuaHRtbCBj cmFzaC4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE4 NDg5MQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIE9u IFdpbjY0LCByZWdpc3RlciBSREkgaXMgImNvbnNpZGVyZWQgbm9udm9sYXRpbGUgYW5kIG11c3Qg YmUgc2F2ZWQgYW5kIHJlc3RvcmVkIGJ5IGEgZnVuY3Rpb24gdGhhdCB1c2VzIFtpdF0iLgorICAg ICAgICBSREkgaXMgYmVpbmcgdXNlZCBhcyBhIHNjcmF0Y2ggcmVnaXN0ZXIgZm9yIEpJVF9VTklD T0RFX0VYUFJFU1NJT05TLCBub3QganVzdCBZQVJSX0pJVF9BTExfUEFSRU5TX0VYUFJFU1NJT05T LgorCisgICAgICAgICogeWFyci9ZYXJySklULmNwcDoKKyAgICAgICAgKEpTQzo6WWFycjo6WWFy ckdlbmVyYXRvcjo6Z2VuZXJhdGVFbnRlcik6CisgICAgICAgIChKU0M6OllhcnI6OllhcnJHZW5l cmF0b3I6OmdlbmVyYXRlUmV0dXJuKToKKyAgICAgICAgVW5jb25kaXRpb25hbGx5IHNhdmUgYW5k IHJlc3RvcmUgUkRJIG9uIDY0LWJpdCBXaW5kb3dzLgorCiAyMDE4LTA0LTI1ICBNaWNoYWVsIENh dGFuemFybyAgPG1jYXRhbnphcm9AaWdhbGlhLmNvbT4KIAogICAgICAgICBbR1RLXSBNaXNjZWxs YW5lb3VzIGJ1aWxkIGNsZWFudXBzCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUv eWFyci9ZYXJySklULmNwcCBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS95YXJyL1lhcnJKSVQuY3Bw CmluZGV4IGFiNzBmNmQ5Y2IzZGRiM2MxYzljNDZlYjRkMGZjNzFkZmE5ZmUwNWEuLjI2ZmNkNjlk MGIwY2IyMjUwMzBjMGZmYjEyOGI1YjY2Y2Q3YzQ0NGQgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZh U2NyaXB0Q29yZS95YXJyL1lhcnJKSVQuY3BwCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS95 YXJyL1lhcnJKSVQuY3BwCkBAIC0zMjk5LDEwICszMjk5LDEyIEBAIGNsYXNzIFlhcnJHZW5lcmF0 b3IgOiBwcml2YXRlIE1hY3JvQXNzZW1ibGVyIHsKICAgICAgICAgaWYgKG1fcGF0dGVybi5tX3Nh dmVJbml0aWFsU3RhcnRWYWx1ZSkKICAgICAgICAgICAgIHB1c2goWDg2UmVnaXN0ZXJzOjplYngp OwogCisjaWYgT1MoV0lORE9XUykKKyAgICAgICAgcHVzaChYODZSZWdpc3RlcnM6OmVkaSk7Cisj ZW5kaWYKICNpZiBFTkFCTEUoWUFSUl9KSVRfQUxMX1BBUkVOU19FWFBSRVNTSU9OUykKICAgICAg ICAgaWYgKG1fY29udGFpbnNOZXN0ZWRTdWJwYXR0ZXJucykgewogI2lmIE9TKFdJTkRPV1MpCi0g ICAgICAgICAgICBwdXNoKFg4NlJlZ2lzdGVyczo6ZWRpKTsKICAgICAgICAgICAgIHB1c2goWDg2 UmVnaXN0ZXJzOjplc2kpOwogI2VuZGlmCiAgICAgICAgICAgICBwdXNoKFg4NlJlZ2lzdGVyczo6 cjEyKTsKQEAgLTMzOTIsMTAgKzMzOTQsMTIgQEAgY2xhc3MgWWFyckdlbmVyYXRvciA6IHByaXZh dGUgTWFjcm9Bc3NlbWJsZXIgewogICAgICAgICAgICAgcG9wKFg4NlJlZ2lzdGVyczo6cjEyKTsK ICNpZiBPUyhXSU5ET1dTKQogICAgICAgICAgICAgcG9wKFg4NlJlZ2lzdGVyczo6ZXNpKTsKLSAg ICAgICAgICAgIHBvcChYODZSZWdpc3RlcnM6OmVkaSk7CiAjZW5kaWYKICAgICAgICAgfQogI2Vu ZGlmCisjaWYgT1MoV0lORE9XUykKKyAgICAgICAgcG9wKFg4NlJlZ2lzdGVyczo6ZWRpKTsKKyNl bmRpZgogCiAgICAgICAgIGlmIChtX3BhdHRlcm4ubV9zYXZlSW5pdGlhbFN0YXJ0VmFsdWUpCiAg ICAgICAgICAgICBwb3AoWDg2UmVnaXN0ZXJzOjplYngpOwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVz dHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IGQxY2VlODBlYjA3ODY5 YmU4ZDcxYTdhY2UwNDg4ODk2MzRmZjRiZmUuLmIwNmI0ZGI5ZWIxZjVlZThiOTcyOGJhN2EyNGZk ODQ4ZWJmMDhiZTQgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlv dXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxMiBAQAorMjAxOC0wNC0yNSAgUm9zcyBLaXJz bGluZyAgPHJvc3Mua2lyc2xpbmdAc29ueS5jb20+CisKKyAgICAgICAgW1dpbkNhaXJvXSBGaXgg anMvcmVnZXhwLXVuaWNvZGUuaHRtbCBjcmFzaC4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTE4NDg5MQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgICogcGxhdGZvcm0vd2luY2Fpcm8vVGVzdEV4cGVjdGF0aW9u czoKKwogMjAxOC0wNC0yNSAgWW91ZW5uIEZhYmxldCAgPHlvdWVubkBhcHBsZS5jb20+CiAKICAg ICAgICAgTWFrZSBEb2N1bWVudFRocmVhZGFibGVMb2FkZXIgZXJyb3IgbG9nZ2luZyBtb3JlIGNv bnNpc3RlbnQKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL3BsYXRmb3JtL3dpbmNhaXJvL1Rlc3RF eHBlY3RhdGlvbnMgYi9MYXlvdXRUZXN0cy9wbGF0Zm9ybS93aW5jYWlyby9UZXN0RXhwZWN0YXRp b25zCmluZGV4IDhjYzkzZjNhN2I2N2MwMjhmYmE5MDRkMmE3YjgxMWQ0MzRiZWVhMTkuLmRkNjM3 NDc5OWU0OWVhOTk3ZmQ0NTVmOWRlNjZiMzhlZjIyNjFmNjcgMTAwNjQ0Ci0tLSBhL0xheW91dFRl c3RzL3BsYXRmb3JtL3dpbmNhaXJvL1Rlc3RFeHBlY3RhdGlvbnMKKysrIGIvTGF5b3V0VGVzdHMv cGxhdGZvcm0vd2luY2Fpcm8vVGVzdEV4cGVjdGF0aW9ucwpAQCAtMTUyNSw3ICsxNTI1LDYgQEAg aW1wb3J0ZWQvYmxpbmsgWyBTa2lwIF0KIGltcG9ydGVkL21vemlsbGEgWyBTa2lwIF0KIGltcG9y dGVkL3czYyBbIFNraXAgXQogaW5zcGVjdG9yIFsgU2tpcCBdCi1qcy9yZWdleHAtdW5pY29kZS5o dG1sIFsgU2tpcCBdCiBqcy9kb20gWyBTa2lwIF0KIGxlZ2FjeS1hbmltYXRpb24tZW5naW5lL21l ZGlhIFsgU2tpcCBdCiBsZWdhY3ktYW5pbWF0aW9uLWVuZ2luZS90cmFuc2l0aW9ucyBbIFNraXAg XQo=