After r167094 JSC crashes at the beginning on ARM Traditional. Program received signal SIGSEGV, Segmentation fault. 0x0041e0ac in llint_entry () (gdb) bt #0 0x0041e0ac in llint_entry () #1 0x00000000 in ?? () 0x0041e09c <llint_entry+2680>: push {lr} 0x0041e0a0 <llint_entry+2684>: push {r11} 0x0041e0a4 <llint_entry+2688>: mov r11, sp 0x0041e0a8 <llint_entry+2692>: ldr r1, [r11, #8] => 0x0041e0ac <llint_entry+2696>: ldr r12, [r1, #316] ; 0x13c 0x0041e0b0 <llint_entry+2700>: adds r12, r12, #5 0x0041e0b4 <llint_entry+2704>: str r12, [r1, #316] ; 0x13c 0x0041e0b8 <llint_entry+2708>: bmi 0x41e0ec <llint_entry+2760> 0x0041e0bc <llint_entry+2712>: subs sp, sp, #8 0x0041e0c0 <llint_entry+2716>: mov r0, r11 0x0041e0c4 <llint_entry+2720>: mov r1, r9 0x0041e0c8 <llint_entry+2724>: bl 0x4dfab0 <llint_entry_osr> 0x0041e0cc <llint_entry+2728>: adds sp, sp, #8 0x0041e0d0 <llint_entry+2732>: tst r0, r0 0x0041e0d4 <llint_entry+2736>: beq 0x41e0e8 <llint_entry+2756> 0x0041e0d8 <llint_entry+2740>: mov sp, r11 0x0041e0dc <llint_entry+2744>: pop {r11} 0x0041e0e0 <llint_entry+2748>: pop {lr} The crash occurs inside the llint_program_prologue function.
I managed to debug what happens here. The jump table contains invalid addresses and llint_program_prologue isn't called properly. The branch instruction jumps to 0x0041e0a2 instead of 0x0041e09c - the start of the function. 0x0041e0a2 isn't 4 bytes aligned, but the CPU starts executing this code from push {r11}, which breaks the stack and ldr tries to load from an invalid address.
Created attachment 231150 [details] Proposed patch
Comment on attachment 231150 [details] Proposed patch Nice catch. r=me
Comment on attachment 231150 [details] Proposed patch Clearing flags on attachment: 231150 Committed r168530: <http://trac.webkit.org/changeset/168530>
All reviewed patches have been landed. Closing bug.