Summary: | Unreproducible crash in Safari at com.apple.JavaScriptCore • JSC::BytecodeGenerator::emitComplexJumpScopes + 468 | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Geoffrey Garen <ggaren> | ||||
Component: | JavaScriptCore | Assignee: | Geoffrey Garen <ggaren> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | barraclough, zwarich | ||||
Priority: | P2 | Keywords: | InRadar | ||||
Version: | 528+ (Nightly build) | ||||||
Hardware: | Mac | ||||||
OS: | OS X 10.5 | ||||||
Attachments: |
|
Description
Geoffrey Garen
2009-05-08 19:23:04 PDT
4/24/09 3:12 PM Geoff Garen: Symbolicated: 0 com.apple.JavaScriptCore 0x95fb1604 JSC::BytecodeGenerator::emitComplexJumpScopes(JSC::Label*, JSC::ControlFlowContext*, JSC::ControlFlowContext*) + 468 (/SourceCache/JavaScriptCore/JavaScriptCore-5528.15/bytecompiler/BytecodeGenerator.cpp:1576) 1 com.apple.JavaScriptCore 0x95f8ba6d JSC::BytecodeGenerator::emitJumpScopes(JSC::Label*, int) + 301 (/SourceCache/JavaScriptCore/JavaScriptCore-5528.15/bytecompiler/BytecodeGenerator.cpp:1594) 5/1/09 12:13 AM Geoff Garen: BytecodeGenerator.cpp: do { ASSERT(topScope->isFinallyBlock); emitJumpSubroutine(topScope->finallyContext.retAddrDst, topScope->finallyContext.finallyAddr); --topScope; if (!topScope->isFinallyBlock) // <-- CRASH (BytecodeGenerator.cpp:1576) break; } while (topScope > bottomScope); 5/1/09 12:16 AM Geoff Garen: Looks like this code is unmodified since its initial merge in http://trac.webkit.org/changeset/33979. 5/8/09 7:20 PM Geoff Garen: Another idea: the set of tokens that can cause an emitComplexJumpScopes is pretty limited. Try writing a fuzzer to create different combinations and nesting levels regarding those tokens, and see if you can get it to crash. The dying read is to 0x000000001964fff4 The ControlFlowContext struct consists of 3 words, one bool and two pointers from FinallyContext. There is no special alignment beyond this, so the ControlFlowContexts in m_scopeContextStack are spaced 3 words apart. It is attempting to read from the first word of a ControlFlowContext, so the previous ControlFlowContext is at 0x0000000019650000 This is a page boundary! We have crossed over a page boundary decrementing topScope. Normally this isn't a problem, as long as we can read from topScope->isFinallyBlock, since we bail out of the loop at the break statement or at the guard below it. However, if we can't read it, we die before the comparison in the loop guard. The fix is to turn the do/while loop into a plain while loop with the guard (topScope > bottomScope && topScope->isFinallyBlock). I reviewed this change from Geoff. He should land it shortly. Created attachment 30151 [details]
patch w/test
Committed revision 43428. |