Bug 137758

Summary:

REGRESSION(r174025): remote inspector crashes frequently when executing inspector frontend's JavaScript

Product:

WebKit

Reporter:

Michael Saboff <msaboff>

Component:

JavaScriptCore

Assignee:

Michael Saboff <msaboff>

Status:

RESOLVED FIXED

Severity:

Normal

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Attachments:

Description	Flags
Patch	none

Description Michael Saboff 2014-10-15 16:53:05 PDT

Change set r174025 <http://trac.webkit.org/changeset/174025> is causing crashes with traceback similar to below.

Determined that reverting the change to PutByOffset case in FixupPhase::fixupNode seems to fix the issue.
        case PutByOffset: {
            if (!node->child1()->hasStorageResult())
                fixEdge<KnownCellUse>(node->child1());
            fixEdge<KnownCellUse>(node->child2());
            insertStoreBarrier(m_indexInBlock, node->child2() /*, node->child3() */);  <== delete the third parameter and use the default parameter
            break;

Using the default third parameter cause insertStoreBarrier() to always insert a barrier, which will revert r174025 for just this section of code.

This bug is to temporarily fix the crashes to give time to address the real underlying issue.

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x0000000110bf88a2 JSC::JSObject::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 1586
1   com.apple.JavaScriptCore      	0x0000000110d501ec operationPutByIdNonStrictBuildList + 300
2   ???                           	0x00003a20f6615c81 0 + 63913246940289
3   ???                           	0x00003a20f6637f93 0 + 63913247080339
4   com.apple.JavaScriptCore      	0x000000011102d72c llint_entry + 22132
5   com.apple.JavaScriptCore      	0x000000011102d72c llint_entry + 22132
6   com.apple.JavaScriptCore      	0x000000011102d72c llint_entry + 22132
7   com.apple.JavaScriptCore      	0x000000011102d72c llint_entry + 22132
8   com.apple.JavaScriptCore      	0x000000011102d797 llint_entry + 22239
9   com.apple.JavaScriptCore      	0x0000000111027ea8 vmEntryToJavaScript + 326
10  com.apple.JavaScriptCore      	0x0000000110f9b149 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 169
11  com.apple.JavaScriptCore      	0x0000000110c1de44 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 468
12  com.apple.JavaScriptCore      	0x0000000110c1dc5e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62
13  com.apple.JavaScriptCore      	0x0000000110d56aaa JSC::boundFunctionCall(JSC::ExecState*) + 586
14  ???                           	0x00003a20f6601034 0 + 63913246855220
15  com.apple.JavaScriptCore      	0x000000011102d961 llint_entry + 22697
16  com.apple.JavaScriptCore      	0x000000011102d72c llint_entry + 22132
17  com.apple.JavaScriptCore      	0x000000011102d72c llint_entry + 22132
18  com.apple.JavaScriptCore      	0x0000000111027ea8 vmEntryToJavaScript + 326
19  com.apple.JavaScriptCore      	0x0000000110f9b149 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 169
20  com.apple.JavaScriptCore      	0x0000000110c1de44 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 468
21  com.apple.JavaScriptCore      	0x0000000110de07ef JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, JSC::JSValue*) + 63
22  com.apple.WebCore             	0x000000011143abb9 WebCore::ScheduledAction::executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue, WebCore::ScriptExecutionContext*) + 537
23  com.apple.WebCore             	0x000000011143a92d WebCore::ScheduledAction::execute(WebCore::Document*) + 141
24  com.apple.WebCore             	0x000000011143a76b WebCore::DOMTimer::fired() + 299
25  com.apple.WebCore             	0x00000001112b884d WebCore::ThreadTimers::sharedTimerFiredInternal() + 157
26  com.apple.WebCore             	0x00000001112b8774 WebCore::timerFired(__CFRunLoopTimer*, void*) + 20
27  com.apple.CoreFoundation      	0x00007fff92845b44 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20
28  com.apple.CoreFoundation      	0x00007fff928457d3 __CFRunLoopDoTimer + 1059
29  com.apple.CoreFoundation      	0x00007fff928b8d9d __CFRunLoopDoTimers + 301
30  com.apple.CoreFoundation      	0x00007fff92802268 __CFRunLoopRun + 2024
31  com.apple.CoreFoundation      	0x00007fff92801838 CFRunLoopRunSpecific + 296
32  com.apple.HIToolbox           	0x00007fff92d1743f RunCurrentEventLoopInMode + 235
33  com.apple.HIToolbox           	0x00007fff92d171ba ReceiveNextEventCommon + 431
34  com.apple.HIToolbox           	0x00007fff92d16ffb _BlockUntilNextEventMatchingListInModeWithFilter + 71
35  com.apple.AppKit              	0x00007fff97b67821 _DPSNextEvent + 964
36  com.apple.AppKit              	0x00007fff97b66fd0 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 194
37  com.apple.AppKit              	0x00007fff97b5af73 -[NSApplication run] + 594
38  com.apple.AppKit              	0x00007fff97b46424 NSApplicationMain + 1832
39  libxpc.dylib                  	0x00007fff988eeef2 _xpc_objc_main + 793
40  libxpc.dylib                  	0x00007fff988f0a9d xpc_main + 490
41  com.apple.WebKit.WebContent.Development	0x00000001096a8620 0x1096a7000 + 5664
42  libdyld.dylib                 	0x00007fff939fe5c9 start + 1

Comment 1 Michael Saboff 2014-10-15 17:04:23 PDT

Created attachment 239908 [details]
Patch

Comment 2 Michael Saboff 2014-10-15 17:15:05 PDT

Committed r174749: <http://trac.webkit.org/changeset/174749>.