96893 2012-09-16 22:52:43 -0700 32-bit LLInt get_by_val does vector length checks incorrectly 2012-09-17 16:36:57 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 mark.lam fpizlo fpizlo oldest_to_newest 721686 0 mark.lam 2012-09-16 22:52:43 -0700 The butterflies (r128400) are causing crashes in the 32-bit build. I've confirmed this by running the JS part of the layout as follows: $ ./Tools/Scripts/run-webkit-tests --debug --32-bit fast/js fast/regex ietestcenter/Javascript sputnik The crashes started to manifest on r128400. They do not on r128369. Here's what an example call trace looks like: Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x00724ad7 llint_op_get_by_val + 150 1 com.apple.JavaScriptCore 0x004fa434 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*) + 100 (JITCode.h:134) 2 com.apple.JavaScriptCore 0x004f61d6 JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) + 5814 (Interpreter.cpp:991) 3 com.apple.JavaScriptCore 0x003a4e7f JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 559 (Completion.cpp:75) 4 com.apple.WebCore 0x02271c98 WebCore::JSMainThreadExecState::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 120 (JSMainThreadExecState.h:77) 5 com.apple.WebCore 0x02b0ce4e WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld*) + 350 (ScriptController.cpp:148) 6 com.apple.WebCore 0x02b0cf91 WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&) + 65 (ScriptController.cpp:165) 7 com.apple.WebCore 0x02b2659a WebCore::ScriptElement::executeScript(WebCore::ScriptSourceCode const&) + 794 (ScriptElement.cpp:301) 8 com.apple.WebCore 0x02b250fa WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport) + 1770 (ScriptElement.cpp:241) 9 com.apple.WebCore 0x01d5c7ce WebCore::HTMLScriptRunner::runScript(WebCore::Element*, WTF::TextPosition const&) + 510 (HTMLScriptRunner.cpp:292) ... From running the C++ llint, I found that the crash occurs here: _llint_op_get_by_val: traceExecution() loadi 8[PC], t2 loadi 12[PC], t3 loadConstantOrVariablePayload(t2, CellTag, t0, .opGetByValSlow) loadConstantOrVariablePayload(t3, Int32Tag, t1, .opGetByValSlow) loadp JSCell::m_structure[t0], t3 loadp 16[PC], t2 if VALUE_PROFILER storep t3, ArrayProfile::m_lastSeenStructure[t2] end btpz Structure::m_indexingType[t3], HasArrayStorage, .opGetByValSlow loadp JSObject::m_butterfly[t0], t3 biaeq t1, -sizeof IndexingHeader + IndexingHeader::m_vectorLength[t0], .opGetByValSlow loadi 4[PC], t0 loadi ArrayStorage::m_vector + TagOffset[t3, t1, 8], t2 // <=== Crashed here. loadi ArrayStorage::m_vector + PayloadOffset[t3, t1, 8], t1 bieq t2, EmptyValueTag, .opGetByValSlow The crash is at the above line in LowLevelInterpreter32_64.asm. The crash does not manifest consistently on any one test (except when I run it in the C++ llint on the Windows port). But if I run those 4 tests together (fast/js fast/regex ietestcenter/Javascript sputnik), the crash will manifest in several tests, usually a few in ietestcenter/... and many more in sputnik/.… To repro the crashes, you will need to set useJIT() and useDFGJIT() to false in Options.cpp and run interpreted only. 722008 1 ggaren 2012-09-17 09:39:51 -0700 <rdar://problem/12311678> 722276 2 fpizlo 2012-09-17 14:37:38 -0700 This appears fixed as of http://trac.webkit.org/changeset/128790 722300 3 mark.lam 2012-09-17 15:03:24 -0700 Filip managed to repro the issue. 722366 4 164473 fpizlo 2012-09-17 16:34:22 -0700 Created attachment 164473 the patch 722367 5 164473 mhahnenberg 2012-09-17 16:35:04 -0700 Comment on attachment 164473 the patch r=me 722368 6 fpizlo 2012-09-17 16:36:57 -0700 Landed in http://trac.webkit.org/changeset/128822 164473 2012-09-17 16:34:22 -0700 2012-09-17 16:35:04 -0700 the patch fixllint32_patch_1.diff text/plain 1464 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTI4ODIwKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBA CisyMDEyLTA5LTE3ICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg MzItYml0IExMSW50IGdldF9ieV92YWwgZG9lcyB2ZWN0b3IgbGVuZ3RoIGNoZWNrcyBpbmNvcnJl Y3RseQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9OTY4 OTMKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzEyMzExNjc4PgorCisgICAgICAgIFJldmlld2Vk IGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogbGxpbnQvTG93TGV2ZWxJbnRlcnByZXRl cjMyXzY0LmFzbToKKwogMjAxMi0wOS0xNyAgRmlsaXAgUGl6bG8gIDxmcGl6bG9AYXBwbGUuY29t PgogCiAgICAgICAgIFdlIGRvbid0IGhhdmUgYSBiYWQgZW5vdWdoIHRpbWUgaWYgYW4gb2JqZWN0 J3MgcHJvdG90eXBlIGNoYWluIGNyb3NzZXMgZ2xvYmFsIG9iamVjdHMKSW5kZXg6IFNvdXJjZS9K YXZhU2NyaXB0Q29yZS9sbGludC9Mb3dMZXZlbEludGVycHJldGVyMzJfNjQuYXNtCj09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9sbGludC9Mb3dMZXZlbEludGVycHJldGVyMzJf NjQuYXNtCShyZXZpc2lvbiAxMjg3OTcpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvbGxpbnQv TG93TGV2ZWxJbnRlcnByZXRlcjMyXzY0LmFzbQkod29ya2luZyBjb3B5KQpAQCAtMTMxMyw3ICsx MzEzLDcgQEAgX2xsaW50X29wX2dldF9ieV92YWw6CiAgICAgbG9hZGkgMTJbUENdLCB0MwogICAg IGxvYWRDb25zdGFudE9yVmFyaWFibGVQYXlsb2FkKHQzLCBJbnQzMlRhZywgdDEsIC5vcEdldEJ5 VmFsU2xvdykKICAgICBsb2FkcCBKU09iamVjdDo6bV9idXR0ZXJmbHlbdDBdLCB0MwotICAgIGJp YWVxIHQxLCAtc2l6ZW9mIEluZGV4aW5nSGVhZGVyICsgSW5kZXhpbmdIZWFkZXI6Om1fdmVjdG9y TGVuZ3RoW3QwXSwgLm9wR2V0QnlWYWxTbG93CisgICAgYmlhZXEgdDEsIC1zaXplb2YgSW5kZXhp bmdIZWFkZXIgKyBJbmRleGluZ0hlYWRlcjo6bV92ZWN0b3JMZW5ndGhbdDNdLCAub3BHZXRCeVZh bFNsb3cKICAgICBsb2FkaSA0W1BDXSwgdDAKICAgICBsb2FkaSBBcnJheVN0b3JhZ2U6Om1fdmVj dG9yICsgVGFnT2Zmc2V0W3QzLCB0MSwgOF0sIHQyCiAgICAgbG9hZGkgQXJyYXlTdG9yYWdlOjpt X3ZlY3RvciArIFBheWxvYWRPZmZzZXRbdDMsIHQxLCA4XSwgdDEK