Bug 281198 – JavaScriptCore Crashed in iOS17 and above system

• Component: JavaScriptCore
• Status: NEW

Created attachment 472891 [details]
The attachment is from the user crash log collected by XCode

After the release of iOS17, our app has collected JavaScriptCore crashes, and the crash has recently appeared in iOS17 and above. The number of crashes collected recently is increasing.
It is the crash information of the App Store package obtained from XCode -> Window -> organiser -> Crashes
The file attached to the email is the crash log

The crash resaon is 
SEGV_ACCERR - Access Permissions Error
JavaScriptCore JSC::MarkedBlock:

The crash codebase is
0 JavaScriptCore JSC::MarkedBlock::aboutToMarkSlow(unsigned int)
1 JavaScriptCore JSC::JSObject::visitChildren(JSC::JSCell*, JSC::SlotVisitor&)
2 JavaScriptCore JSC::JSObject::visitChildren(JSC::JSCell*, JSC::SlotVisitor&)
3 JavaScriptCore JSC::SlotVisitor::drain(WTF::MonotonicTime)
4 JavaScriptCore JSC::SlotVisitor::drainFromShared(JSC::SlotVisitor::SharedDrainMode, WTF::MonotonicTime)
5 JavaScriptCore WTF::SharedTaskFunctor<void (), JSC::Heap::runBeginPhase(JSC::GCConductor)::$_15>::run()
6 JavaScriptCore WTF::ParallelHelperClient::runTask(WTF::RefPtr<WTF::SharedTask<void ()>, WTF::RawPtrTraits<WTF::SharedTask<void ()> >, WTF::DefaultRefDerefTraits<WTF::SharedTask<void ()> > > const&)
7 JavaScriptCore WTF::ParallelHelperPool::Thread::work()
8 JavaScriptCore WTF::Detail::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0, void>::call()
9 JavaScriptCore WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*)
10 JavaScriptCore WTF::wtfThreadEntryPoint(void*)
11 libsystem_pthread.dylib __pthread_start

Please help us analyze how to solve this problem

Thank you

[Alexey Proskuryakov]

Thank you for the report. This is a very generic crash trace that can be caused by any kinds by memory corruption or threading mistakes. 

It is possible that people working on JavaScriptCore will be able to glean something actionable from the attached crash logs.

[Mark Lam]

Hello.  Thanks for the report.  Would you have any reliable ways to reproduce this crash?  If not, can you help find reliable reproduction steps using your app (even if the repro steps only produce a crash once in a 100 runs)?  We will need reproduction steps in order to diagnose this issue.  Thanks.

The complete crash log exported from XCode can be downloaded from this address https://storage.jd.com/animation/CLQ6w-o7pljWK5eiTPbbZY.xccrashpoint.zip
We have not reproduced the crash path, these are the crash logs of online users.

(In reply to Mark Lam from comment #2)
> Hello.  Thanks for the report.  Would you have any reliable ways to
> reproduce this crash?  If not, can you help find reliable reproduction steps
> using your app (even if the repro steps only produce a crash once in a 100
> runs)?  We will need reproduction steps in order to diagnose this issue. 
> Thanks.

The complete crash log exported from XCode can be downloaded from this address https://storage.jd.com/animation/CLQ6w-o7pljWK5eiTPbbZY.xccrashpoint.zip
 We have not reproduced the crash path, these are the crash logs of online users

[Mark Lam]

Without repro steps, this issue is not actionable.

[Mark Lam]

To clarify, the crash log indicates that memory corruption has occurred elsewhere.  Hence, the crash log does not point to the cause of the issue (which may or may not be JSC), and a reproduction scenario is really needed to diagnose this bug.  Otherwise, it is not actionable.

[Radar WebKit Bug Importer]

<rdar://problem/138090989>