Bug 121844 – Crashing under JSC::DFG::SpeculativeJIT::spill visiting citicards.com

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Jessie Berlin]

1 com.apple.JavaScriptCore       0x10bb8906c WTFCrash + 0x4c
>  2 com.apple.JavaScriptCore       0x10ba90ab0 JSC::DFG::SpeculativeJIT::spill(JSC::VirtualRegister) + 0x240
   3 com.apple.JavaScriptCore       0x10bc1c237 JSC::DFG::GPRTemporary::GPRTemporary<JSC::DFG::SpeculateInt32Operand, JSC::DFG::SpeculateInt32Operand>(JSC::DFG::SpeculativeJIT*, JSC::DFG::ReuseTag, JSC::DFG::SpeculateInt32Operand&, JSC::DFG::SpeculateInt32Operand&) + 0x197
   4 com.apple.JavaScriptCore       0x10ba7af02 JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node*) + 0x1662
   5 com.apple.JavaScriptCore       0x10bc0ef85 JSC::DFG::SpeculativeJIT::compileCurrentBlock() + 0x945
   6 com.apple.JavaScriptCore       0x10ba788c0 JSC::DFG::SpeculativeJIT::compile() + 0x70
   7 com.apple.JavaScriptCore       0x10bbed40e JSC::DFG::JITCompiler::compileFunction() + 0x22e
   8 com.apple.JavaScriptCore       0x10bc068aa JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) + 0x48a
   9 com.apple.JavaScriptCore       0x10bc0627f JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&) + 0xff
  10 com.apple.JavaScriptCore       0x10bc32b36 JSC::DFG::Worklist::runThread() + 0x106
  11 com.apple.JavaScriptCore       0x10b97a95f WTF::wtfThreadEntryPoint(void*) + 0xf
  12 libsystem_c.dylib              0x7fff936b1772 _pthread_start + 0x147
  13 libsystem_c.dylib              0x7fff9369e1a1 thread_start + 0xd

I am seeing this on ML with the single web process.

<rdar://problem/15066488>

[Filip Pizlo]

Created attachment 212515 [details]
the patch

[WebKit Commit Bot]

Attachment 212515 [details] did not pass style-queue:

Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'LayoutTests/ChangeLog', u'LayoutTests/js/dfg-int52-spill-expected.txt', u'LayoutTests/js/dfg-int52-spill-trickier-expected.txt', u'LayoutTests/js/dfg-int52-spill-trickier.html', u'LayoutTests/js/dfg-int52-spill.html', u'LayoutTests/js/script-tests/dfg-int52-spill-trickier.js', u'LayoutTests/js/script-tests/dfg-int52-spill.js', u'Source/JavaScriptCore/ChangeLog', u'Source/JavaScriptCore/bytecode/ValueRecovery.h', u'Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h', u'Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp', u'Tools/ChangeLog', u'Tools/Scripts/run-javascriptcore-tests']" exit_code: 1
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:516:  Weird number of spaces at line-start.  Are you using a 4-space indent?  [whitespace/indent] [3]
Total errors found: 1 in 13 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Mark Hahnenberg]

Comment on attachment 212515 [details]
the patch

r=me

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/156371