246942 2022-10-24 05:43:03 -0700 Trace trap in JIT-compiled code 2022-11-01 13:48:52 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 saelo webkit-unassigned bfulgham d_degazio mark.lam webkit-bug-importer oldest_to_newest 1907771 0 saelo 2022-10-24 05:43:03 -0700 The following sample triggers a SIGTRAP in JSC built from latest HEAD in debug configuration: function main() { let v0 = -256; do { function v2(v3,v4,v5) { const v6 = eval; const v8 = 16 / v5; function v9(v10,v11) { try { const v12 = v9(); } catch(v13) { const v14 = []; const v15 = []; const v16 = v15.__proto__; const v17 = v14.values; const v19 = {"set":v17}; const v21 = Object.defineProperty(v16,1,v19); function v22(v23,v24) { const v25 = []; let {"__proto__":v26,"constructor":v27,"length":v28,} = v25; const v29 = v26 || v22; const v30 = v27(); const v31 = v30.push(v25); const v32 = v30.push(v29); } const v33 = v22(); } finally { } } const v34 = v9(); let v35 = [v8]; const v36 = --v35; const v37 = v0++; } const v38 = "bigint"; const v39 = v2(); } while (v0 !== 8); gc(); } main(); // CRASH INFO // ========== // TERMSIG: 5 // STDERR: // STDOUT: // ARGS: ./jsc/jsc --validateOptions=true --thresholdForJITSoon=10 --thresholdForJITAfterWarmUp=10 --thresholdForOptimizeAfterWarmUp=100 --thresholdForOptimizeAfterLongWarmUp=100 --thresholdForOptimizeSoon=100 --thresholdForFTLOptimizeAfterWarmUp=1000 --thresholdForFTLOptimizeSoon=1000 The crash happens in JIT-compiled code, so this may be a sign of a condition that was not expected to happen by the compiler. As this may have security implications, I'm filing this as a security issue. 1907772 1 webkit-bug-importer 2022-10-24 05:43:16 -0700 <rdar://problem/101496803> 1909395 2 d_degazio 2022-10-31 13:15:49 -0700 Pull request: https://github.com/WebKit/WebKit/pull/5973 1909621 3 ews-feeder 2022-11-01 13:48:50 -0700 Committed 256197@main (5faa0d3ac693): <https://commits.webkit.org/256197@main> Reviewed commits have been landed. Closing PR #5973 and removing active labels.