19098 2008-05-16 01:37:00 -0700 SquirrelFish: Ref'd temporaries can be clobbered 2008-05-16 05:07:50 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Mac OS X 10.5 RESOLVED FIXED P2 Normal --- 1 oliver webkit-unassigned ggaren mjs oldest_to_newest 80611 0 oliver 2008-05-16 01:37:00 -0700 Assertion due over released registerid 80612 1 21198 oliver 2008-05-16 01:41:49 -0700 Created attachment 21198 Testcase 80619 2 oliver 2008-05-16 03:03:16 -0700 Okay, it looks like we're clobbering temporary registers. In the attached test case ForNode refs the result of the statement at line 5020, but it then clobbers (by resets) the ref'd RegisterID when PreIncResolveNode requests a new temporary: #0 0x0031b996 in KJS::RegisterID::RegisterID (this=0xbfff5c00, index=1) at RegisterID.h:52 #1 0x00336eb5 in WTF::Vector<KJS::RegisterID, 512ul>::append<unsigned long> (this=0xbfff5be8, val=@0xbfff3f48) at Vector.h:731 #2 0x002d3830 in KJS::CodeGenerator::newTemporary (this=0xbfff4320) at CodeGenerator.cpp:351 #3 0x002e3a58 in KJS::PreIncResolveNode::emitCode (this=0x608e10, generator=@0xbfff4320, dst=0x0) at nodes.cpp:2350 #4 0x0033585d in KJS::CodeGenerator::emitNode (this=0xbfff4320, dst=0x0, n=0x608e10) at CodeGenerator.h:142 #5 0x00335884 in KJS::CodeGenerator::emitNode (this=0xbfff4320, n=0x608e10) at CodeGenerator.h:147 #6 0x002dca02 in KJS::ForNode::emitCode (this=0x609030, generator=@0xbfff4320, dst=0x0) at nodes.cpp:5023 #7 0x0033585d in KJS::CodeGenerator::emitNode (this=0xbfff4320, dst=0x0, n=0x609030) at CodeGenerator.h:142 #8 0x002d7754 in statementListEmitCode (statements=@0x6090e0, generator=@0xbfff4320, dst=0x0) at nodes.cpp:4682 #9 0x002d779a in KJS::BlockNode::emitCode (this=0x6090d0, generator=@0xbfff4320, dst=0x0) at nodes.cpp:4740 #10 0x0033585d in KJS::CodeGenerator::emitNode (this=0xbfff4320, dst=0x0, n=0x6090d0) at CodeGenerator.h:142 #11 0x002d81f5 in KJS::WithNode::emitCode (this=0x6090f0, generator=@0xbfff4320, dst=0x0) at nodes.cpp:5369 #12 0x0033585d in KJS::CodeGenerator::emitNode (this=0xbfff4320, dst=0x0, n=0x6090f0) at CodeGenerator.h:142 #13 0x002d7754 in statementListEmitCode (statements=@0x609170, generator=@0xbfff4320, dst=0x0) at nodes.cpp:4682 #14 0x002d8bbc in KJS::FunctionBodyNode::emitCode (this=0x609160, generator=@0xbfff4320) at nodes.cpp:5812 #15 0x002daeee in KJS::CodeGenerator::generate (this=0xbfff4320) at CodeGenerator.cpp:133 #16 0x00307456 in KJS::FunctionBodyNode::generateCode (this=0x609160, sc=0x6059b0) at nodes.cpp:5804 #17 0x00376ae7 in KJS::FunctionBodyNode::code (this=0x609160, scopeChain=0x6059b0) at nodes.h:3027 #18 0x00374651 in KJS::Machine::privateExecute (this=0x3c5960, flag=KJS::Machine::Normal, exec=0xbffff3ac, registerFile=0x605990, r=0x609328, scopeChain=0x6059b0, codeBlock=0x605540, exception=0xbffff438) at /Volumes/Data/git/WebKit/OpenSource/JavaScriptCore/VM/Machine.cpp:1768 #19 0x00376374 in KJS::Machine::execute (this=0x3c5960, programNode=0x608c90, exec=0x6059f0, scopeChain=0x6059b0, thisObj=0x20000, registerFileStack=0x605838, exception=0xbffff438) at /Volumes/Data/git/WebKit/OpenSource/JavaScriptCore/VM/Machine.cpp:610 #20 0x00314386 in KJS::Interpreter::evaluate (exec=0x6059f0, scopeChain=@0x605858, sourceURL=@0xbffff508, startingLineNumber=0, source=@0xbffff4a8, thisValue=0x0) at interpreter.cpp:85 #21 0x00314451 in KJS::Interpreter::evaluate (exec=0x6059f0, scopeChain=@0x605858, sourceURL=@0xbffff508, startingLineNumber=0, code=@0xbffff518, thisV=0x0) at interpreter.cpp:60 #22 0x00002b0b in runWithScripts (fileNames=@0xbffff570, arguments=@0xbffff564, prettyPrint=false, dump=true) at /Volumes/Data/git/WebKit/OpenSource/JavaScriptCore/API/../kjs/testkjs.cpp:299 #23 0x00002ce3 in kjsmain (argc=4, argv=0xbffff5e4) at /Volumes/Data/git/WebKit/OpenSource/JavaScriptCore/API/../kjs/testkjs.cpp:372 #24 0x00002d4d in main (argc=4, argv=0xbffff5e4) at /Volumes/Data/git/WebKit/OpenSource/JavaScriptCore/API/../kjs/testkjs.cpp:260 80621 3 21201 zwarich 2008-05-16 03:53:13 -0700 Created attachment 21201 Proposed patch I'm gonna make a layout test as well, but I need to wait for things to rebuild to run the layout tests. 80622 4 21201 oliver 2008-05-16 04:19:03 -0700 Comment on attachment 21201 Proposed patch r=me, make a testcase though (the attached one hould be fine) 80623 5 21202 zwarich 2008-05-16 04:54:31 -0700 Created attachment 21202 Proposed patch (with layout test) 80624 6 oliver 2008-05-16 05:07:50 -0700 M JavaScriptCore/ChangeLog M JavaScriptCore/kjs/nodes.cpp M LayoutTests/ChangeLog A LayoutTests/fast/js/resources/statement-list-register-crash.js A LayoutTests/fast/js/statement-list-register-crash-expected.txt A LayoutTests/fast/js/statement-list-register-crash.html Committed r33517 21198 2008-05-16 01:41:49 -0700 2008-05-16 01:41:49 -0700 Testcase ebayevil.js text/plain 140 oliver ZnVuY3Rpb24gZigpIHsKICAgIHdpdGgodGhpcykgewogICAgICAgIGZvcig7O2krKykgewogICAg ICAgICAgICBhPTA7CiAgICAgICAgICAgIGlmKGEpCiAgICAgICAgICAgICAgICByZXR1cm4gZmFs c2U7CiAgICAgICAgfQogICAgfQp9CmYoKTs= 21201 2008-05-16 03:53:13 -0700 2008-05-16 04:54:31 -0700 Proposed patch clobber.diff text/plain 1552 zwarich SW5kZXg6IENoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBDaGFuZ2VMb2cJKHJldmlzaW9uIDMzNTE2 KQorKysgQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTcgQEAKKzIwMDgtMDUt MTYgIENhbWVyb24gWndhcmljaCAgPGN3endhcmljaEB1d2F0ZXJsb28uY2E+CisKKyAgICAgICAg UmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQnVnIDE5MDk4OiBTcXVpcnJl bEZpc2g6IFJlZidkIHRlbXBvcmFyaWVzIGNhbiBiZSBjbG9iYmVyZWQKKyAgICAgICAgPGh0dHBz Oi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xOTA5OD4KKworICAgICAgICBXaGVu IGRvaW5nIGNvZGUgZ2VuZXJhdGlvbiBmb3IgYSBzdGF0ZW1lbnQgbGlzdCwgaW5jcmVhc2UgdGhl IHJlZmVyZW5jZQorICAgICAgICBjb3VudCBvbiBhIHJlZ2lzdGVyIHRoYXQgbWlnaHQgZXZlbnR1 YWxseSBiZSByZXR1cm5lZCwgc28gdGhhdCBpdCBkb2Vzbid0CisgICAgICAgIGdldCBjbG9iYmVy ZWQgYnkgYSByZXF1ZXN0IGZvciBhIG5ldyB0ZW1wb3JhcnkuCisKKyAgICAgICAgKiBranMvbm9k ZXMuY3BwOgorICAgICAgICAoS0pTOjpzdGF0ZW1lbnRMaXN0RW1pdENvZGUpOgorCiAyMDA4LTA1 LTE2ICBNYWNpZWogU3RhY2hvd2lhayAgPG1qc0BhcHBsZS5jb20+CiAKICAgICAgICAgUmV2aWV3 ZWQgYnkgT2xpdmVyLgpJbmRleDoga2pzL25vZGVzLmNwcAo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBranMvbm9k ZXMuY3BwCShyZXZpc2lvbiAzMzUxNikKKysrIGtqcy9ub2Rlcy5jcHAJKHdvcmtpbmcgY29weSkK QEAgLTQ2NzMsNyArNDY3Myw3IEBAIEpTVmFsdWUqIENvbnN0U3RhdGVtZW50Tm9kZTo6ZXhlY3V0 ZShPbGQKIAogc3RhdGljIGlubGluZSBSZWdpc3RlcklEKiBzdGF0ZW1lbnRMaXN0RW1pdENvZGUo U3RhdGVtZW50VmVjdG9yJiBzdGF0ZW1lbnRzLCBDb2RlR2VuZXJhdG9yJiBnZW5lcmF0b3IsIFJl Z2lzdGVySUQqIGRzdCA9IDApCiB7Ci0gICAgUmVnaXN0ZXJJRCogcjAgPSBkc3Q7CisgICAgUmVm UHRyPFJlZ2lzdGVySUQ+IHIwID0gZHN0OwogCiAgICAgU3RhdGVtZW50VmVjdG9yOjppdGVyYXRv ciBlbmQgPSBzdGF0ZW1lbnRzLmVuZCgpOwogICAgIGZvciAoU3RhdGVtZW50VmVjdG9yOjppdGVy YXRvciBpdCA9IHN0YXRlbWVudHMuYmVnaW4oKTsgaXQgIT0gZW5kOyArK2l0KSB7CkBAIC00Njgz LDcgKzQ2ODMsNyBAQCBzdGF0aWMgaW5saW5lIFJlZ2lzdGVySUQqIHN0YXRlbWVudExpc3RFCiAg ICAgICAgICAgICByMCA9IHIxOwogICAgIH0KICAgICAKLSAgICByZXR1cm4gcjA7CisgICAgcmV0 dXJuIHIwLmdldCgpOwogfQogCiBzdGF0aWMgaW5saW5lIHZvaWQgc3RhdGVtZW50TGlzdFB1c2hG SUZPKFN0YXRlbWVudFZlY3RvciYgc3RhdGVtZW50cywgRGVjbGFyYXRpb25TdGFja3M6Ok5vZGVT dGFjayYgc3RhY2spCg== 21202 2008-05-16 04:54:31 -0700 2008-05-16 05:00:37 -0700 Proposed patch (with layout test) clobber.diff text/plain 4197 zwarich SW5kZXg6IEphdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKYXZhU2NyaXB0 Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDMzNTE2KQorKysgSmF2YVNjcmlwdENvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTcgQEAKKzIwMDgtMDUtMTYgIENhbWVyb24g WndhcmljaCAgPGN3endhcmljaEB1d2F0ZXJsb28uY2E+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkg Tk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQnVnIDE5MDk4OiBTcXVpcnJlbEZpc2g6IFJlZidk IHRlbXBvcmFyaWVzIGNhbiBiZSBjbG9iYmVyZWQKKyAgICAgICAgPGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xOTA5OD4KKworICAgICAgICBXaGVuIGRvaW5nIGNvZGUg Z2VuZXJhdGlvbiBmb3IgYSBzdGF0ZW1lbnQgbGlzdCwgaW5jcmVhc2UgdGhlIHJlZmVyZW5jZQor ICAgICAgICBjb3VudCBvbiBhIHJlZ2lzdGVyIHRoYXQgbWlnaHQgZXZlbnR1YWxseSBiZSByZXR1 cm5lZCwgc28gdGhhdCBpdCBkb2Vzbid0CisgICAgICAgIGdldCBjbG9iYmVyZWQgYnkgYSByZXF1 ZXN0IGZvciBhIG5ldyB0ZW1wb3JhcnkuCisKKyAgICAgICAgKiBranMvbm9kZXMuY3BwOgorICAg ICAgICAoS0pTOjpzdGF0ZW1lbnRMaXN0RW1pdENvZGUpOgorCiAyMDA4LTA1LTE2ICBNYWNpZWog U3RhY2hvd2lhayAgPG1qc0BhcHBsZS5jb20+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgT2xpdmVy LgpJbmRleDogSmF2YVNjcmlwdENvcmUva2pzL25vZGVzLmNwcAo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKYXZh U2NyaXB0Q29yZS9ranMvbm9kZXMuY3BwCShyZXZpc2lvbiAzMzUxNikKKysrIEphdmFTY3JpcHRD b3JlL2tqcy9ub2Rlcy5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTQ2NzMsNyArNDY3Myw3IEBAIEpT VmFsdWUqIENvbnN0U3RhdGVtZW50Tm9kZTo6ZXhlY3V0ZShPbGQKIAogc3RhdGljIGlubGluZSBS ZWdpc3RlcklEKiBzdGF0ZW1lbnRMaXN0RW1pdENvZGUoU3RhdGVtZW50VmVjdG9yJiBzdGF0ZW1l bnRzLCBDb2RlR2VuZXJhdG9yJiBnZW5lcmF0b3IsIFJlZ2lzdGVySUQqIGRzdCA9IDApCiB7Ci0g ICAgUmVnaXN0ZXJJRCogcjAgPSBkc3Q7CisgICAgUmVmUHRyPFJlZ2lzdGVySUQ+IHIwID0gZHN0 OwogCiAgICAgU3RhdGVtZW50VmVjdG9yOjppdGVyYXRvciBlbmQgPSBzdGF0ZW1lbnRzLmVuZCgp OwogICAgIGZvciAoU3RhdGVtZW50VmVjdG9yOjppdGVyYXRvciBpdCA9IHN0YXRlbWVudHMuYmVn aW4oKTsgaXQgIT0gZW5kOyArK2l0KSB7CkBAIC00NjgzLDcgKzQ2ODMsNyBAQCBzdGF0aWMgaW5s aW5lIFJlZ2lzdGVySUQqIHN0YXRlbWVudExpc3RFCiAgICAgICAgICAgICByMCA9IHIxOwogICAg IH0KICAgICAKLSAgICByZXR1cm4gcjA7CisgICAgcmV0dXJuIHIwLmdldCgpOwogfQogCiBzdGF0 aWMgaW5saW5lIHZvaWQgc3RhdGVtZW50TGlzdFB1c2hGSUZPKFN0YXRlbWVudFZlY3RvciYgc3Rh dGVtZW50cywgRGVjbGFyYXRpb25TdGFja3M6Ok5vZGVTdGFjayYgc3RhY2spCkluZGV4OiBMYXlv dXRUZXN0cy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCShy ZXZpc2lvbiAzMzUxNikKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDE2IEBACisyMDA4LTA1LTE2ICBDYW1lcm9uIFp3YXJpY2ggIDxjd3p3YXJpY2hA dXdhdGVybG9vLmNhPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisg ICAgICAgIEFkZCB0ZXN0cyBmb3I6CisKKyAgICAgICAgQnVnIDE5MDk4OiBTcXVpcnJlbEZpc2g6 IFJlZidkIHRlbXBvcmFyaWVzIGNhbiBiZSBjbG9iYmVyZWQKKyAgICAgICAgPGh0dHBzOi8vYnVn cy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xOTA5OD4KKworICAgICAgICAqIGZhc3QvanMv cmVzb3VyY2VzL3N0YXRlbWVudC1saXN0LXJlZ2lzdGVyLWNyYXNoLmpzOiBBZGRlZC4KKyAgICAg ICAgKiBmYXN0L2pzL3N0YXRlbWVudC1saXN0LXJlZ2lzdGVyLWNyYXNoLWV4cGVjdGVkLnR4dDog QWRkZWQuCisgICAgICAgICogZmFzdC9qcy9zdGF0ZW1lbnQtbGlzdC1yZWdpc3Rlci1jcmFzaC5o dG1sOiBBZGRlZC4KKwogMjAwOC0wNS0xNiAgTWFjaWVqIFN0YWNob3dpYWsgIDxtanNAYXBwbGUu Y29tPgogCiAgICAgICAgIFJldmlld2VkIGJ5IE9saXZlci4KSW5kZXg6IExheW91dFRlc3RzL2Zh c3QvanMvc3RhdGVtZW50LWxpc3QtcmVnaXN0ZXItY3Jhc2gtZXhwZWN0ZWQudHh0Cj09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT0KLS0tIExheW91dFRlc3RzL2Zhc3QvanMvc3RhdGVtZW50LWxpc3QtcmVnaXN0ZXItY3Jhc2gt ZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvZmFzdC9qcy9zdGF0ZW1l bnQtbGlzdC1yZWdpc3Rlci1jcmFzaC1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAg KzEsMTAgQEAKK1Rlc3RzIHRoYXQgY29kZSBnZW5lcmF0aW9uIG9mIHN0YXRlbWVudCBsaXN0cyBw cm9wZXJseSByZWZlcmVuY2UgY291bnRzIHJlZ2lzdGVycy4KKworT24gc3VjY2VzcywgeW91IHdp bGwgc2VlIGEgc2VyaWVzIG9mICJQQVNTIiBtZXNzYWdlcywgZm9sbG93ZWQgYnkgIlRFU1QgQ09N UExFVEUiLgorCisKK1BBU1MgZigpIGlzIHRydWUKK1BBU1Mgc3VjY2Vzc2Z1bGx5UGFyc2VkIGlz IHRydWUKKworVEVTVCBDT01QTEVURQorCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0L2pzL3N0YXRl bWVudC1saXN0LXJlZ2lzdGVyLWNyYXNoLmh0bWwKPT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMv ZmFzdC9qcy9zdGF0ZW1lbnQtbGlzdC1yZWdpc3Rlci1jcmFzaC5odG1sCShyZXZpc2lvbiAwKQor KysgTGF5b3V0VGVzdHMvZmFzdC9qcy9zdGF0ZW1lbnQtbGlzdC1yZWdpc3Rlci1jcmFzaC5odG1s CShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDEzIEBACis8IURPQ1RZUEUgSFRNTCBQVUJMSUMgIi0v L0lFVEYvL0RURCBIVE1MLy9FTiI+Cis8aHRtbD4KKzxoZWFkPgorPGxpbmsgcmVsPSJzdHlsZXNo ZWV0IiBocmVmPSJyZXNvdXJjZXMvanMtdGVzdC1zdHlsZS5jc3MiPgorPHNjcmlwdCBzcmM9InJl c291cmNlcy9qcy10ZXN0LXByZS5qcyI+PC9zY3JpcHQ+Cis8L2hlYWQ+Cis8Ym9keT4KKzxwIGlk PSJkZXNjcmlwdGlvbiI+PC9wPgorPGRpdiBpZD0iY29uc29sZSI+PC9kaXY+Cis8c2NyaXB0IHNy Yz0icmVzb3VyY2VzL3N0YXRlbWVudC1saXN0LXJlZ2lzdGVyLWNyYXNoLmpzIj48L3NjcmlwdD4K KzxzY3JpcHQgc3JjPSJyZXNvdXJjZXMvanMtdGVzdC1wb3N0LmpzIj48L3NjcmlwdD4KKzwvYm9k eT4KKzwvaHRtbD4KSW5kZXg6IExheW91dFRlc3RzL2Zhc3QvanMvcmVzb3VyY2VzL3N0YXRlbWVu dC1saXN0LXJlZ2lzdGVyLWNyYXNoLmpzCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2Zhc3Qv anMvcmVzb3VyY2VzL3N0YXRlbWVudC1saXN0LXJlZ2lzdGVyLWNyYXNoLmpzCShyZXZpc2lvbiAw KQorKysgTGF5b3V0VGVzdHMvZmFzdC9qcy9yZXNvdXJjZXMvc3RhdGVtZW50LWxpc3QtcmVnaXN0 ZXItY3Jhc2guanMJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMTcgQEAKK2Rlc2NyaXB0aW9uKAor J1Rlc3RzIHRoYXQgY29kZSBnZW5lcmF0aW9uIG9mIHN0YXRlbWVudCBsaXN0cyBwcm9wZXJseSBy ZWZlcmVuY2UgY291bnRzIHJlZ2lzdGVycy4nCispOworCitmdW5jdGlvbiBmKCkKK3sKKyAgICBm b3IoOyA7IGkrKykgeworICAgICAgICBhID0gMDsKKyAgICAgICAgCisgICAgICAgIGlmICgxKQor ICAgICAgICAgICAgcmV0dXJuIHRydWU7CisgICAgfQorfQorCitzaG91bGRCZVRydWUoImYoKSIp OworCit2YXIgc3VjY2Vzc2Z1bGx5UGFyc2VkID0gdHJ1ZTsK