Bug 139457

Summary: SIGSEGV from JIT'd Code in WebGL Game
Product: WebKit Reporter: Conrad Kreyling <konistehrad>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED WORKSFORME    
Severity: Normal CC: benjamin, dbates, fpizlo, ggaren, msaboff, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: iPhone / iPad   
OS: iOS 8.1   
Attachments:
Description Flags
Crash log showing SIGSEGV coming from JIT code. none

Description Conrad Kreyling 2014-12-09 12:13:20 PST 
Created attachment 242957 [details]
Crash log showing SIGSEGV coming from JIT code.

On iPhone 6  or 6 Plus, and only on iPhone 6 or 6 Plus, (iOS 8.1.1, Safari/600.1.4) attempting to play the games found at http://target.com/play will result in a crash due to a SIGSEGV coming from JIT code. The easiest way to reproduce this is to visit http://target.com/play and play the games in the following order:

- Arctic Catch
- Snowball Fight
- Hot Cocoa

After playing several rounds of each, in that order, return to the world map via the menu, and wait several seconds. The game will crash, resulting in a stack trace similar to the one attached. I know that this is not related to the audio subsystem, as removing it entirely did not result in a fix (it uses several new Function() calls, leading me initially to believe I could "fix" the problem in that way), but other than that I'm sadly at a loss. Let me know if you have any other questions.

Thanks!
Comment 1 Radar WebKit Bug Importer 2014-12-09 12:44:55 PST 
<rdar://problem/19194371>
Comment 2 Michael Saboff 2015-03-06 15:45:32 PST 
At one point we could reproduce this crash on internal builds about a month ago.

Using an internal release build or a personal debug build of current WebKit (change set r181007 <http://trac.webkit.org/changeset/181007>), I was unable to reproduce this problem on either a iPhone 6 or iPhone 6+.  I suspect that we fixed the issue with another bug repair.