66351 2011-08-16 16:51:07 -0700 Crash in Structure::visitChildren running iAd.js regression test suite under memory pressure 2011-08-17 10:42:26 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 msaboff msaboff ap barraclough webkit.review.bot oldest_to_newest 451989 0 msaboff 2011-08-16 16:51:07 -0700 From <rdar://problem/9931094> Received a crash running iAds tests. The traceback is: 0 JavaScriptCore 0x34d76dee JSC::Structure::visitChildren(JSC::MarkStack&) + 450 1 JavaScriptCore 0x34d7544c JSC::MarkStack::visitChildren(JSC::JSCell*) + 584 2 JavaScriptCore 0x34d75104 JSC::MarkStack::drain() + 296 3 JavaScriptCore 0x34d74aae JSC::Heap::markRoots() + 130 4 JavaScriptCore 0x34d749d2 JSC::Heap::reset(JSC::Heap::SweepToggle) + 14 5 JavaScriptCore 0x34d37602 JSC::Heap::reportExtraMemoryCostSlowCase(unsigned long) + 34 6 WebCore 0x3784df32 WebCore::HTMLCanvasElement::createImageBuffer() const + 402 7 WebCore 0x3784dd88 WebCore::HTMLCanvasElement::drawingContext() const + 12 8 WebCore 0x3784dc40 WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D(WebCore::HTMLCanvasElement*, bool, bool) + 128 9 WebCore 0x3784db04 WebCore::HTMLCanvasElement::getContext(WTF::String const&, WebCore::CanvasContextAttributes*) + 76 10 WebCore 0x3784da24 WebCore::JSHTMLCanvasElement::getContext(JSC::ExecState*) + 1264 11 WebCore 0x3784d522 WebCore::jsHTMLCanvasElementPrototypeFunctionGetContext(JSC::ExecState*) + 90 12 ??? 0x20f24278 0 + 552747640 13 JavaScriptCore 0x34d73596 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 46 14 JavaScriptCore 0x34ddb0b6 JSC::PropertySlot::functionGetter(JSC::ExecState*) const + 130 15 JavaScriptCore 0x34d38c7c JSC::JSValue::get(JSC::ExecState*, JSC::Identifier const&, JSC::PropertySlot&) const + 700 16 JavaScriptCore 0x34d3cf5e JITStubThunked_op_get_by_id + 70 17 JavaScriptCore 0x34d3cf0a cti_op_get_by_id + 2 18 JavaScriptCore 0x34d73596 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 46 19 JavaScriptCore 0x34d0a702 JSC::JSObject::put(JSC::ExecState*, JSC::Identifier const&, JSC::JSValue, JSC::PutPropertySlot&) + 682 20 JavaScriptCore 0x34d3dfd4 JITStubThunked_op_put_by_id + 108 21 JavaScriptCore 0x34d3df5a cti_op_put_by_id + 2 22 JavaScriptCore 0x34d73596 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 46 23 WebCore 0x377ae2e8 WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) + 580 24 WebCore 0x377ae070 WebCore::EventTarget::fireEventListeners(WebCore::Event*, WebCore::EventTargetData*, WTF::Vector&) + 272 25 WebCore 0x376b5c14 WebCore::EventTarget::fireEventListeners(WebCore::Event*) + 136 26 WebCore 0x376bc18a WebCore::Node::handleLocalEvents(WebCore::Event*) + 54 27 WebCore 0x376bb9da WebCore::EventDispatcher::dispatchEvent(WTF::PassRefPtr) + 542 28 WebCore 0x376bb78c WebCore::EventDispatchMediator::dispatchEvent(WebCore::EventDispatcher*) const + 24 29 WebCore 0x376bb760 WebCore::EventDispatcher::dispatchEvent(WebCore::Node*, WebCore::EventDispatchMediator const&) + 92 30 WebCore 0x376bb6b8 WebCore::Node::dispatchEvent(WTF::PassRefPtr) + 28 31 WebCore 0x377fdcb6 WebCore::AnimationControllerPrivate::fireEventsAndUpdateStyle() + 162 32 WebCore 0x376a4240 WebCore::ThreadTimers::sharedTimerFiredInternal() + 92 33 WebCore 0x376a41b2 __ZN7WebCoreL10timerFiredEP16__CFRunLoopTimerPv + 58 34 CoreFoundation 0x335fca60 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 8 35 CoreFoundation 0x335fc6c6 __CFRunLoopDoTimer + 358 36 CoreFoundation 0x335fb29c __CFRunLoopRun + 1200 37 CoreFoundation 0x3357e4ee CFRunLoopRunSpecific + 294 38 CoreFoundation 0x3357e3b6 CFRunLoopRunInMode + 98 39 WebCore 0x376f6f60 __ZL12RunWebThreadPv + 396 40 libsystem_c.dylib 0x35d4b95e _pthread_start + 314 41 libsystem_c.dylib 0x35d4e600 thread_start + 0 Getting the crash at the end of ContainerNode::insertBefore before it calls dispatchSubtreeModifiedEvent to notify all children of the change. The node doesn't appear to be corrupt at the beginning of insertBefore processing. This code does have a comment that nodes can be GC out from under it. Trying to refine where the code in getting trashed…. I believe that the problem is in a JIT generated put by id that is generated in JIT::privateCompilePutByIdTransition(). I am instrumenting and branching to backup code to further debug. It looks like, on ARM only, our JITStubCall mechanism tramples r0 before invoking optimized put_by_id for new properties 452017 1 104128 msaboff 2011-08-16 17:22:28 -0700 Created attachment 104128 Proposed patch 452021 2 webkit.review.bot 2011-08-16 17:28:31 -0700 Attachment 104128 did not pass style-queue: Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'Source/JavaScriptCore/ChangeLog', u'Source..." exit_code: 1 Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp:473: Should have only a single space after a punctuation in a comment. [whitespace/comments] [5] Total errors found: 1 in 2 files If any of these errors are false positives, please file a bug against check-webkit-style. 452033 3 104128 barraclough 2011-08-16 17:46:45 -0700 Comment on attachment 104128 Proposed patch Hey michael, looks great, should fix the style bot's issue. 452061 4 msaboff 2011-08-16 18:34:49 -0700 Committed r93189: <http://trac.webkit.org/changeset/93189> 452346 5 ap 2011-08-17 10:42:26 -0700 Can a regression test be made for this? Or are we running iAd.js as part of our regression tests already? 104128 2011-08-16 17:22:28 -0700 2011-08-16 17:46:45 -0700 Proposed patch 66351.patch text/plain 4846 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gOTMxNzgpCisrKyBTb3VyY2Uv SmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMjUgQEAK KzIwMTEtMDgtMTYgIE1pY2hhZWwgU2Fib2ZmICA8bXNhYm9mZkBhcHBsZS5jb20+CisKKyAgICAg ICAgQ3Jhc2ggaW4gU3RydWN0dXJlOjp2aXNpdENoaWxkcmVuIHJ1bm5pbmcgaUFkLmpzIHJlZ3Jl c3Npb24gdGVzdCBzdWl0ZSB1bmRlciBtZW1vcnkgcHJlc3N1cmUKKyAgICAgICAgaHR0cHM6Ly9i dWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTY2MzUxCisKKyAgICAgICAgSklUOjpwcml2 YXRlQ29tcGlsZVB1dEJ5SWRUcmFuc2l0aW9uIGV4cGVjdHMgdGhhdCByZWdUMCBhbmQgcmVnVDEK KyAgICAgICAgaGF2ZSB0aGUgYmFzZVBheWxvYWQgYW5kIGJhc2VUYWcgcmVzcGVjdGl2ZWx5LiAg SW4gc29tZSBjYXNlcywKKyAgICAgICAgd2UgbWF5IGdldCB0byB0aGlzIGdlbmVyYXRlZCBjb2Rl IHdpdGggb25lIG9yIGJvdGggb2YgdGhlc2UKKyAgICAgICAgcmVnaXN0ZXJzIHRyYXNoLiAgT25l IGtub3cgY2FzZSBpcyB0aGF0IHJlZ1QwIG9uIEFSTSBtYXkgYmUKKyAgICAgICAgdHJhc2hlZCBh cyByZWdUMCAocjApIGlzIGFsc28gYXJnMCBhbmQgY2FuIGJlIG92ZXJydW4gd2l0aCBzcCBkdWUK KyAgICAgICAgdG8gY2FsbHMgdG8gSklUOjpyZXN0b3JlUmV0dXJuQWRkcmVzcygpLiAgVGhpcyBw YXRjaCB1c2VzIHRoZQorICAgICAgICB2YWx1ZXMgb24gdGhlIHN0YWNrLiAgQSBsb25nZXIgdGVy bSBzb2x1dGlvbiBpcyB0byB3b3JrIG91dCBhbGwKKyAgICAgICAgY2FzZXMgc28gdGhhdCB0aGUg cmVnaXN0ZXIgZW50cnkgYXNzdW1wdGlvbnMgY2FuIGFzc3VyZWQuCisKKyAgICAgICAgV2hpbGUg Zml4aW5nIHRoaXMsIGFsc28gZGV0ZXJtaW5lZCB0aGF0IHRoZSBhZGRpdGlvbmFsIHN0YWNrIG9m ZnNldAorICAgICAgICBvZiBzaXplb2Yodm9pZCopIGlzIG5vdCBuZWVkZWQgZm9yIEFSTS4KKwor ICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAqIGppdC9KSVRQ cm9wZXJ0eUFjY2VzczMyXzY0LmNwcDoKKyAgICAgICAgKEpTQzo6SklUOjpwcml2YXRlQ29tcGls ZVB1dEJ5SWRUcmFuc2l0aW9uKToKKwogMjAxMS0wOC0xNSAgR2F2aW4gQmFycmFjbG91Z2ggIDxi YXJyYWNsb3VnaEBhcHBsZS5jb20+CiAKICAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTY2MjYzCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L0pJ VFByb3BlcnR5QWNjZXNzMzJfNjQuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0 Q29yZS9qaXQvSklUUHJvcGVydHlBY2Nlc3MzMl82NC5jcHAJKHJldmlzaW9uIDkzMTczKQorKysg U291cmNlL0phdmFTY3JpcHRDb3JlL2ppdC9KSVRQcm9wZXJ0eUFjY2VzczMyXzY0LmNwcAkod29y a2luZyBjb3B5KQpAQCAtNDcwLDggKzQ3MCwxNyBAQCB2b2lkIEpJVDo6Y29tcGlsZUdldERpcmVj dE9mZnNldChKU09iamVjCiAKIHZvaWQgSklUOjpwcml2YXRlQ29tcGlsZVB1dEJ5SWRUcmFuc2l0 aW9uKFN0cnVjdHVyZVN0dWJJbmZvKiBzdHViSW5mbywgU3RydWN0dXJlKiBvbGRTdHJ1Y3R1cmUs IFN0cnVjdHVyZSogbmV3U3RydWN0dXJlLCBzaXplX3QgY2FjaGVkT2Zmc2V0LCBTdHJ1Y3R1cmVD aGFpbiogY2hhaW4sIFJldHVybkFkZHJlc3NQdHIgcmV0dXJuQWRkcmVzcywgYm9vbCBkaXJlY3Qp CiB7Ci0gICAgLy8gSXQgaXMgYXNzdW1lZCB0aGF0IHJlZ1QwIGNvbnRhaW5zIHRoZSBiYXNlUGF5 bG9hZCBhbmQgcmVnVDEgY29udGFpbnMgdGhlIGJhc2VUYWcuICBUaGUgdmFsdWUgY2FuIGJlIGZv dW5kIG9uIHRoZSBzdGFjay4KLSAgICAKKyAgICAvLyBUaGUgY29kZSBiZWxvdyBhc3N1bWVzIHRo YXQgcmVnVDAgY29udGFpbnMgdGhlIGJhc2VQYXlsb2FkIGFuZCByZWdUMSBjb250YWlucyB0aGUg YmFzZVRhZy4gIFJlc3RvcmUgdGhlbSBmcm9tIHRoZSBzdGFjay4KKyNpZiBDUFUoTUlQUykgfHwg Q1BVKFNINCkgfHwgQ1BVKEFSTSkKKyAgICAvLyBGb3IgTUlQUywgd2UgZG9uJ3QgYWRkIHNpemVv Zih2b2lkKikgdG8gdGhlIHN0YWNrIG9mZnNldC4KKyAgICBsb2FkMzIoQWRkcmVzcyhzdGFja1Bv aW50ZXJSZWdpc3RlciwgT0JKRUNUX09GRlNFVE9GKEpJVFN0YWNrRnJhbWUsIGFyZ3NbMF0pICsg T0JKRUNUX09GRlNFVE9GKEpTVmFsdWUsIHUuYXNCaXRzLnBheWxvYWQpKSwgcmVnVDApOworICAg IC8vIEZvciBNSVBTLCB3ZSBkb24ndCBhZGQgc2l6ZW9mKHZvaWQqKSB0byB0aGUgc3RhY2sgb2Zm c2V0LgorICAgIGxvYWQzMihBZGRyZXNzKHN0YWNrUG9pbnRlclJlZ2lzdGVyLCBPQkpFQ1RfT0ZG U0VUT0YoSklUU3RhY2tGcmFtZSwgYXJnc1swXSkgKyBPQkpFQ1RfT0ZGU0VUT0YoSlNWYWx1ZSwg dS5hc0JpdHMudGFnKSksIHJlZ1QxKTsKKyNlbHNlCisgICAgbG9hZDMyKEFkZHJlc3Moc3RhY2tQ b2ludGVyUmVnaXN0ZXIsIE9CSkVDVF9PRkZTRVRPRihKSVRTdGFja0ZyYW1lLCBhcmdzWzBdKSAr IHNpemVvZih2b2lkKikgKyBPQkpFQ1RfT0ZGU0VUT0YoSlNWYWx1ZSwgdS5hc0JpdHMucGF5bG9h ZCkpLCByZWdUMCk7CisgICAgbG9hZDMyKEFkZHJlc3Moc3RhY2tQb2ludGVyUmVnaXN0ZXIsIE9C SkVDVF9PRkZTRVRPRihKSVRTdGFja0ZyYW1lLCBhcmdzWzBdKSArIHNpemVvZih2b2lkKikgKyBP QkpFQ1RfT0ZGU0VUT0YoSlNWYWx1ZSwgdS5hc0JpdHMudGFnKSksIHJlZ1QxKTsKKyNlbmRpZgor CiAgICAgSnVtcExpc3QgZmFpbHVyZUNhc2VzOwogICAgIGZhaWx1cmVDYXNlcy5hcHBlbmQoYnJh bmNoMzIoTm90RXF1YWwsIHJlZ1QxLCBUcnVzdGVkSW1tMzIoSlNWYWx1ZTo6Q2VsbFRhZykpKTsK ICAgICBmYWlsdXJlQ2FzZXMuYXBwZW5kKGJyYW5jaFB0cihOb3RFcXVhbCwgQWRkcmVzcyhyZWdU MCwgSlNDZWxsOjpzdHJ1Y3R1cmVPZmZzZXQoKSksIFRydXN0ZWRJbW1QdHIob2xkU3RydWN0dXJl KSkpOwpAQCAtNDk4LDE0ICs1MDcsMjQgQEAgdm9pZCBKSVQ6OnByaXZhdGVDb21waWxlUHV0QnlJ ZFRyYW5zaXRpbwogICAgICAgICBzdHViQ2FsbC5hZGRBcmd1bWVudChUcnVzdGVkSW1tMzIob2xk U3RydWN0dXJlLT5wcm9wZXJ0eVN0b3JhZ2VDYXBhY2l0eSgpKSk7CiAgICAgICAgIHN0dWJDYWxs LmFkZEFyZ3VtZW50KFRydXN0ZWRJbW0zMihuZXdTdHJ1Y3R1cmUtPnByb3BlcnR5U3RvcmFnZUNh cGFjaXR5KCkpKTsKICAgICAgICAgc3R1YkNhbGwuY2FsbChyZWdUMCk7Ci0gICAgICAgIAorCiAg ICAgICAgIHJlc3RvcmVSZXR1cm5BZGRyZXNzQmVmb3JlUmV0dXJuKHJlZ1QzKTsKKworI2lmIENQ VShNSVBTKSB8fCBDUFUoU0g0KSB8fCBDUFUoQVJNKQorICAgICAgICAvLyBGb3IgTUlQUywgd2Ug ZG9uJ3QgYWRkIHNpemVvZih2b2lkKikgdG8gdGhlIHN0YWNrIG9mZnNldC4KKyAgICAgICAgbG9h ZDMyKEFkZHJlc3Moc3RhY2tQb2ludGVyUmVnaXN0ZXIsIE9CSkVDVF9PRkZTRVRPRihKSVRTdGFj a0ZyYW1lLCBhcmdzWzBdKSArIE9CSkVDVF9PRkZTRVRPRihKU1ZhbHVlLCB1LmFzQml0cy5wYXls b2FkKSksIHJlZ1QwKTsKKyAgICAgICAgLy8gRm9yIE1JUFMsIHdlIGRvbid0IGFkZCBzaXplb2Yo dm9pZCopIHRvIHRoZSBzdGFjayBvZmZzZXQuCisgICAgICAgIGxvYWQzMihBZGRyZXNzKHN0YWNr UG9pbnRlclJlZ2lzdGVyLCBPQkpFQ1RfT0ZGU0VUT0YoSklUU3RhY2tGcmFtZSwgYXJnc1swXSkg KyBPQkpFQ1RfT0ZGU0VUT0YoSlNWYWx1ZSwgdS5hc0JpdHMudGFnKSksIHJlZ1QxKTsKKyNlbHNl CisgICAgICAgIGxvYWQzMihBZGRyZXNzKHN0YWNrUG9pbnRlclJlZ2lzdGVyLCBPQkpFQ1RfT0ZG U0VUT0YoSklUU3RhY2tGcmFtZSwgYXJnc1swXSkgKyBzaXplb2Yodm9pZCopICsgT0JKRUNUX09G RlNFVE9GKEpTVmFsdWUsIHUuYXNCaXRzLnBheWxvYWQpKSwgcmVnVDApOworICAgICAgICBsb2Fk MzIoQWRkcmVzcyhzdGFja1BvaW50ZXJSZWdpc3RlciwgT0JKRUNUX09GRlNFVE9GKEpJVFN0YWNr RnJhbWUsIGFyZ3NbMF0pICsgc2l6ZW9mKHZvaWQqKSArIE9CSkVDVF9PRkZTRVRPRihKU1ZhbHVl LCB1LmFzQml0cy50YWcpKSwgcmVnVDEpOworI2VuZGlmCiAgICAgfQogCiAgICAgZW1pdFdyaXRl QmFycmllcihyZWdUMCwgcmVnVDEpOwogCiAgICAgc3RvcmVQdHIoVHJ1c3RlZEltbVB0cihuZXdT dHJ1Y3R1cmUpLCBBZGRyZXNzKHJlZ1QwLCBKU0NlbGw6OnN0cnVjdHVyZU9mZnNldCgpKSk7Ci0j aWYgQ1BVKE1JUFMpIHx8IENQVShTSDQpCisjaWYgQ1BVKE1JUFMpIHx8IENQVShTSDQpIHx8IENQ VShBUk0pCiAgICAgLy8gRm9yIE1JUFMsIHdlIGRvbid0IGFkZCBzaXplb2Yodm9pZCopIHRvIHRo ZSBzdGFjayBvZmZzZXQuCiAgICAgbG9hZDMyKEFkZHJlc3Moc3RhY2tQb2ludGVyUmVnaXN0ZXIs IE9CSkVDVF9PRkZTRVRPRihKSVRTdGFja0ZyYW1lLCBhcmdzWzJdKSArIE9CSkVDVF9PRkZTRVRP RihKU1ZhbHVlLCB1LmFzQml0cy5wYXlsb2FkKSksIHJlZ1QzKTsKICAgICBsb2FkMzIoQWRkcmVz cyhzdGFja1BvaW50ZXJSZWdpc3RlciwgT0JKRUNUX09GRlNFVE9GKEpJVFN0YWNrRnJhbWUsIGFy Z3NbMl0pICsgT0JKRUNUX09GRlNFVE9GKEpTVmFsdWUsIHUuYXNCaXRzLnRhZykpLCByZWdUMik7 Cg==