195735 2019-03-13 22:03:16 -0700 ASSERTION FAILED: regexp->isValid() or ASSERTION FAILED: !isCompilationThread() 2019-03-14 17:48:12 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 msaboff msaboff ews-watchlist keith_miller mark.lam saam webkit-bug-importer oldest_to_newest 1516396 0 msaboff 2019-03-13 22:03:16 -0700 Summary: with --jitPolicyScale=0 the following asserts on a Debug build: function foo(a) { try { eval('bar(/' + a[0].source + '/)'); } catch(e) { } } function bar(r) { foo([r]); foo([r]); r.exec('x'); } bar(/((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((x))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))/); Steps To Reproduce: jsc --jitPolicyScale=0 repro.js it's not 100% reproducible, but it shouldn't take more than three attempts. Results: ASSERTION FAILED: regexp->isValid() /Users/user/dev/CleanWebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp(9750) : void JSC::DFG::SpeculativeJIT::compileNewRegexp(JSC::DFG::Node *) 1 0x107f44359 WTFCrash 2 0x107f4731b WTFCrashWithInfo(int, char const*, char const*, int) 3 0x1080df5d9 JSC::DFG::SpeculativeJIT::compileNewRegexp(JSC::DFG::Node*) 4 0x1082c13d2 JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node*) 5 0x10809633b JSC::DFG::SpeculativeJIT::compileCurrentBlock() 6 0x108097db5 JSC::DFG::SpeculativeJIT::compile() or ASSERTION FAILED: !isCompilationThread() /Users/user/dev/CleanWebKit/Source/JavaScriptCore/runtime/LazyClassStructure.h(80) : JSC::Structure *JSC::LazyClassStructure::get(const JSC::JSGlobalObject *) const 1 0x10b0a9359 WTFCrash 2 0x10b0ac31b WTFCrashWithInfo(int, char const*, char const*, int) 3 0x10b6734c0 JSC::LazyClassStructure::get(JSC::JSGlobalObject const*) const 4 0x10b666e19 JSC::JSGlobalObject::errorStructure() 5 0x10c56a053 JSC::createError(JSC::ExecState*, WTF::String const&, WTF::String (*)(WTF::String const&, WTF::String const&, JSC::RuntimeType, JSC::ErrorInstance::SourceTextWhereErrorOccurred)) 6 0x10c56c27d JSC::createOutOfMemoryError(JSC::ExecState*, WTF::String const&) 7 0x10c986364 JSC::Yarr::errorToThrow(JSC::ExecState*, JSC::Yarr::ErrorCode) 8 0x10bec3261 JSC::RegExp::errorToThrow(JSC::ExecState*) 9 0x10c76dec5 int JSC::RegExp::matchInline<WTF::Vector<int, 0ul, WTF::CrashOnOverflow, 16ul> >(JSC::VM&, WTF::String const&, unsigned int, WTF::Vector<int, 0ul, WTF::CrashOnOverflow, 16ul>&) 10 0x10c76dda3 JSC::RegExp::match(JSC::VM&, WTF::String const&, unsigned int, WTF::Vector<int, 0ul, WTF::CrashOnOverflow, 16ul>&) 11 0x10c76e41a JSC::RegExp::matchConcurrently(JSC::VM&, WTF::String const&, unsigned int, int&, WTF::Vector<int, 0ul, WTF::CrashOnOverflow, 16ul>&) 12 0x10bfc6d41 JSC::DFG::StrengthReductionPhase::handleNode()::'lambda'()::operator()() const 1516397 1 msaboff 2019-03-13 22:03:35 -0700 <rdar://problem/48801596> 1516399 2 msaboff 2019-03-13 22:17:28 -0700 The two crashes are slightly different. The first one happens due to a race condition when we are compiling on a separate thread. The main thread in this recursive test can run out of memory compiling the regular expression. When that happens, the RegExp becomes invalid due to the error. We throw an exception, but we then reset the RegExp as it might compile successfully the next time we try to execute it on a shallower stack. The main thread will see the regular expression as valid when it executes the JIT'ed code and makes calls out to slow path code. Therefore this ASSERT can be eliminated. The second case happens to to incorrect logic when we go to run the regexp in the Strength Reduction phase. The current check for "do we have code to run the RegExp?" only checks that the RegExp's state is != NotCompiled. We also can't run the RegExp if there the state is ParseError. Changing hasCode() to take this into account fixes the second issue. 1516404 3 364634 msaboff 2019-03-13 22:47:43 -0700 Created attachment 364634 Patch 1516406 4 364634 mark.lam 2019-03-13 22:55:42 -0700 Comment on attachment 364634 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=364634&action=review r=me if EWS bots are happy. > Source/JavaScriptCore/ChangeLog:18 > + The second but is due to incorrect logic when we go to run the regexp in the Strength Reduction phase. /but/bug/. 1516588 5 msaboff 2019-03-14 12:31:54 -0700 Committed r242955: <https://trac.webkit.org/changeset/242955> 1516792 6 364634 saam 2019-03-14 17:48:12 -0700 Comment on attachment 364634 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=364634&action=review > Source/JavaScriptCore/runtime/RegExp.h:111 > + return m_state == JITCode || m_state == ByteCode; Do we need any kind of StoreStoreFence on the main thread to synchronize this? 364634 2019-03-13 22:47:43 -0700 2019-03-13 22:55:42 -0700 Patch 195735.patch text/plain 5423 msaboff SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyNDI5MzUpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDE2IEBACisyMDE5LTAzLTEzICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBw bGUuY29tPgorCisgICAgICAgIEFTU0VSVElPTiBGQUlMRUQ6IHJlZ2V4cC0+aXNWYWxpZCgpIG9y IEFTU0VSVElPTiBGQUlMRUQ6ICFpc0NvbXBpbGF0aW9uVGhyZWFkKCkKKyAgICAgICAgaHR0cHM6 Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE5NTczNQorCisgICAgICAgIFJldmll d2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIE5ldyByZWdyZXNzaW9uIHRlc3QuCisK KyAgICAgICAgKiBzdHJlc3MvZG9udC1zdHJlbmd0aC1yZWR1Y2UtcmVnZXhwLXdpdGgtY29tcGls ZS1lcnJvci5qczogQWRkZWQuCisgICAgICAgIChmb28pOgorICAgICAgICAoYmFyKToKKwogMjAx OS0wMy0xMyAgTWFyayBMYW0gIDxtYXJrLmxhbUBhcHBsZS5jb20+CiAKICAgICAgICAgR2FyZGVu aW5nOiByZWR1Y2luZyB0aGUgdmFyaWFudHMgb24gMiB0ZXN0cyB0byBhdm9pZCB0aW1pbmcgb3V0 IG9uIEpTQyBEZWJ1ZyBxdWV1ZS4KSW5kZXg6IEpTVGVzdHMvc3RyZXNzL2RvbnQtc3RyZW5ndGgt cmVkdWNlLXJlZ2V4cC13aXRoLWNvbXBpbGUtZXJyb3IuanMKPT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gSlNUZXN0 cy9zdHJlc3MvZG9udC1zdHJlbmd0aC1yZWR1Y2UtcmVnZXhwLXdpdGgtY29tcGlsZS1lcnJvci5q cwkobm9uZXhpc3RlbnQpCisrKyBKU1Rlc3RzL3N0cmVzcy9kb250LXN0cmVuZ3RoLXJlZHVjZS1y ZWdleHAtd2l0aC1jb21waWxlLWVycm9yLmpzCSh3b3JraW5nIGNvcHkpCkBAIC0wLDAgKzEsMjMg QEAKKy8vQCBydW5EZWZhdWx0KCItLWppdFBvbGljeVNjYWxlPTAiKQorCitsZXQgdHJ5Q291bnQg PSAxMDAwMDsKKworZnVuY3Rpb24gZm9vKGEpIHsKKyAgaWYgKHRyeUNvdW50ID09IDApCisgICAg IHJldHVybjsKKworICB0cnlDb3VudC0tOworCisgIHRyeSB7CisgICAgZXZhbCgnYmFyKC8nICsg YVswXS5zb3VyY2UgKyAnLyknKTsKKyAgfSBjYXRjaChlKSB7CisgIH0KK30KKworZnVuY3Rpb24g YmFyKHIpIHsKKyAgZm9vKFtyXSk7CisgIGZvbyhbcl0pOworICByLmV4ZWMoJ3gnKTsKK30KKwor YmFyKC8oKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgo KCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgo KCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgo KCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgo KCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoeCkpKSkpKSkpKSkpKSkpKSkpKSkpKSkp KSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkp KSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkp KSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkp KSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkp KSkpKSkvKTsKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjQyODgyKQor KysgU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwz ICsxLDMxIEBACisyMDE5LTAzLTEzICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29t PgorCisgICAgICAgIEFTU0VSVElPTiBGQUlMRUQ6IHJlZ2V4cC0+aXNWYWxpZCgpIG9yIEFTU0VS VElPTiBGQUlMRUQ6ICFpc0NvbXBpbGF0aW9uVGhyZWFkKCkKKyAgICAgICAgaHR0cHM6Ly9idWdz LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE5NTczNQorCisgICAgICAgIFJldmlld2VkIGJ5 IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRoZXJlIGFyZSB0d28gYnVnIGZpeGVzIGhlcmUu CisKKyAgICAgICAgVGhlIGZpcnN0IGJ1ZyBoYXBwZW5zIGR1ZSB0byBhIHJhY2UgY29uZGl0aW9u IHdoZW4gd2UgYXJlIGNvbXBpbGluZyBvbiBhIHNlcGFyYXRlIHRocmVhZCB3aGlsZSB0aGUKKyAg ICAgICAgbWFpbiB0aHJlYWQgaXMgY29tcGlsaW5nIHRoZSBSZWdFeHAgYXQgYSBwbGFjZSB3aGVy ZSBpdCBjYW4gcnVuIG91dCBvZiBzdGFjay4gIFdoZW4gdGhhdCBoYXBwZW5zLAorICAgICAgICB0 aGUgUmVnRXhwIGJlY29tZXMgaW52YWxpZCBkdWUgdG8gdGhlIG91dCBvZiBzdGFjayBlcnJvci4g IElmIHdlIGNoZWNrIHRoZSBBU1NFUlQgY29uZGl0aW9uIGluIHRoZSBERkcKKyAgICAgICAgY29t cGlsYXRpb24gdGhyZWFkLCB3ZSBjcmFzaC4gIEFmdGVyIHRoZSBtYWluIHRocmVhZCB0aHJvd3Mg YW4gZXhjZXB0aW9uLCBpdCByZXNldHMgdGhlIFJlZ0V4cCBhcworICAgICAgICBpdCBtaWdodCBj b21waWxlIHN1Y2Nlc3NmdWxseSB0aGUgbmV4dCB0aW1lIHdlIHRyeSB0byBleGVjdXRlIGl0IG9u IGEgc2hhbGxvd2VyIHN0YWNrLgorICAgICAgICBUaGUgbWFpbiB0aHJlYWQgd2lsbCBzZWUgdGhl IHJlZ3VsYXIgZXhwcmVzc2lvbiBhcyB2YWxpZCB3aGVuIGl0IGV4ZWN1dGVzIHRoZSBKSVQnZWQg Y29kZSB3ZSBhcmUgY29tcGlsaW5nCisgICAgICAgIG9yIGFueSBzbG93IHBhdGggd2UgY2FsbCBv dXQgdG8uICBUaGVyZWZvcmUgQVNTRVJUcyBsaWtlIHRoaXMgaW4gY29tcGlsYXRpb24gY29kZSBj YW4gYmUgZWxpbWluYXRlZC4KKworICAgICAgICBUaGUgc2Vjb25kIGJ1dCBpcyBkdWUgdG8gaW5j b3JyZWN0IGxvZ2ljIHdoZW4gd2UgZ28gdG8gcnVuIHRoZSByZWdleHAgaW4gdGhlIFN0cmVuZ3Ro IFJlZHVjdGlvbiBwaGFzZS4KKyAgICAgICAgVGhlIGN1cnJlbnQgY2hlY2sgZm9yICJkbyB3ZSBo YXZlIGNvZGUgdG8gcnVuIHRoZSBSZWdFeHA/IiBvbmx5IGNoZWNrcyB0aGF0IHRoZSBSZWdFeHAn cyBzdGF0ZQorICAgICAgICBpcyAhPSBOb3RDb21waWxlZC4gIFdlIGFsc28gY2FuJ3QgcnVuIHRo ZSBSZWdFeHAgaWYgdGhlcmUgdGhlIHN0YXRlIGlzIFBhcnNlRXJyb3IuCisgICAgICAgIENoYW5n aW5nIGhhc0NvZGUoKSB0byB0YWtlIHRoaXMgaW50byBhY2NvdW50IGZpeGVzIHRoZSBzZWNvbmQg aXNzdWUuCisKKyAgICAgICAgKEpTQzo6RlRMOjpERkc6Okxvd2VyREZHVG9CMzo6Y29tcGlsZU5l d1JlZ2V4cCk6CisgICAgICAgICogcnVudGltZS9SZWdFeHAuaDoKKyAgICAgICAgKiBkZmcvREZH U3BlY3VsYXRpdmVKSVQuY3BwOgorICAgICAgICAoSlNDOjpERkc6OlNwZWN1bGF0aXZlSklUOjpj b21waWxlTmV3UmVnZXhwKToKKyAgICAgICAgKiBydW50aW1lL1JlZ0V4cC5oOgorCiAyMDE5LTAz LTEyICBZdXN1a2UgU3V6dWtpICA8eXN1enVraUBhcHBsZS5jb20+CiAKICAgICAgICAgW0pTQ10g T1NSIGVudHJ5IHNob3VsZCByZXNwZWN0IGFic3RyYWN0IHZhbHVlcyBpbiBhZGRpdGlvbiB0byBm bHVzaCBmb3JtYXRzCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1NwZWN1bGF0 aXZlSklULmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1Nw ZWN1bGF0aXZlSklULmNwcAkocmV2aXNpb24gMjQyODgyKQorKysgU291cmNlL0phdmFTY3JpcHRD b3JlL2RmZy9ERkdTcGVjdWxhdGl2ZUpJVC5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTk3NDcsNyAr OTc0Nyw2IEBAIHZvaWQgU3BlY3VsYXRpdmVKSVQ6OmNvbXBpbGVOZXdUeXBlZEFycmEKIHZvaWQg U3BlY3VsYXRpdmVKSVQ6OmNvbXBpbGVOZXdSZWdleHAoTm9kZSogbm9kZSkKIHsKICAgICBSZWdF eHAqIHJlZ2V4cCA9IG5vZGUtPmNhc3RPcGVyYW5kPFJlZ0V4cCo+KCk7Ci0gICAgQVNTRVJUKHJl Z2V4cC0+aXNWYWxpZCgpKTsKIAogICAgIEdQUlRlbXBvcmFyeSByZXN1bHQodGhpcyk7CiAgICAg R1BSVGVtcG9yYXJ5IHNjcmF0Y2gxKHRoaXMpOwpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3Jl L2Z0bC9GVExMb3dlckRGR1RvQjMuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0 Q29yZS9mdGwvRlRMTG93ZXJERkdUb0IzLmNwcAkocmV2aXNpb24gMjQyODgyKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL2Z0bC9GVExMb3dlckRGR1RvQjMuY3BwCSh3b3JraW5nIGNvcHkpCkBA IC0xMTI3NCw3ICsxMTI3NCw2IEBAIHByaXZhdGU6CiAgICAgICAgIEZyb3plblZhbHVlKiByZWdl eHAgPSBtX25vZGUtPmNlbGxPcGVyYW5kKCk7CiAgICAgICAgIExWYWx1ZSBsYXN0SW5kZXggPSBs b3dKU1ZhbHVlKG1fbm9kZS0+Y2hpbGQxKCkpOwogICAgICAgICBBU1NFUlQocmVnZXhwLT5jZWxs KCktPmluaGVyaXRzPFJlZ0V4cD4odm0oKSkpOwotICAgICAgICBBU1NFUlQobV9ub2RlLT5jYXN0 T3BlcmFuZDxSZWdFeHAqPigpLT5pc1ZhbGlkKCkpOwogCiAgICAgICAgIExCYXNpY0Jsb2NrIHNs b3dDYXNlID0gbV9vdXQubmV3QmxvY2soKTsKICAgICAgICAgTEJhc2ljQmxvY2sgY29udGludWF0 aW9uID0gbV9vdXQubmV3QmxvY2soKTsKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50 aW1lL1JlZ0V4cC5oCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1l L1JlZ0V4cC5oCShyZXZpc2lvbiAyNDI4ODIpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVu dGltZS9SZWdFeHAuaAkod29ya2luZyBjb3B5KQpAQCAtMTA4LDcgKzEwOCw3IEBAIHB1YmxpYzoK IAogICAgIGJvb2wgaGFzQ29kZSgpCiAgICAgewotICAgICAgICByZXR1cm4gbV9zdGF0ZSAhPSBO b3RDb21waWxlZDsKKyAgICAgICAgcmV0dXJuIG1fc3RhdGUgPT0gSklUQ29kZSB8fCBtX3N0YXRl ID09IEJ5dGVDb2RlOwogICAgIH0KIAogICAgIGJvb2wgaGFzQ29kZUZvcihZYXJyOjpZYXJyQ2hh clNpemUpOwo=