Bug 143645 – Crash in JSC::DFG::SpeculativeJIT::fillSpeculateInt52(JSC::DFG::Edge, JSC::DataFormat)

• Status: RESOLVED
• Resolution: WORKSFORME
• Component: JavaScriptCore

[Dieter Komendera]

Created attachment 250607 [details]
crash report

I’ve had Safari’s “DFG Worklist Worker Thread” crash Safari (8.0.5 on 10.10.3) twice. The last time I was typing into a text field (ironically at bugreport.apple.com), loosing my already typed text.


Thread 15 Crashed:: DFG Worklist Worker Thread
0   com.apple.JavaScriptCore      	0x00007fff8e9ed5fe WTFCrash + 62
1   com.apple.JavaScriptCore      	0x00007fff8ead5a08 JSC::DFG::SpeculativeJIT::fillSpeculateInt52(JSC::DFG::Edge, JSC::DataFormat) + 1944
2   com.apple.JavaScriptCore      	0x00007fff8e90ecd0 JSC::DFG::SpeculativeJIT::compileAdd(JSC::DFG::Node*) + 2720
3   com.apple.JavaScriptCore      	0x00007fff8e8ed59e JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node*) + 3694
4   com.apple.JavaScriptCore      	0x00007fff8eabcdc6 JSC::DFG::SpeculativeJIT::compileCurrentBlock() + 1302
5   com.apple.JavaScriptCore      	0x00007fff8e8ebea2 JSC::DFG::SpeculativeJIT::compile() + 114
6   com.apple.JavaScriptCore      	0x00007fff8ea8f426 JSC::DFG::JITCompiler::compileFunction() + 710
7   com.apple.JavaScriptCore      	0x00007fff8eab7aa5 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) + 1925
8   com.apple.JavaScriptCore      	0x00007fff8eab70bd JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) + 493
9   com.apple.JavaScriptCore      	0x00007fff8eaf0a82 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) + 546
10  com.apple.JavaScriptCore      	0x00007fff8e7eecff WTF::wtfThreadEntryPoint(void*) + 15


Also filed rdar://20512791

[Dieter Komendera]

Created attachment 250608 [details]
crash report 2

[Geoffrey Garen]

Can you reproduce this failure @ bugreport.apple.com? 

Are both crash reports from bugreport.apple.com, or is there another URL we should try to reproduce this bug?

[Dieter Komendera]

No, I can't reproduce this at all and I don't know that if this has anything to do with bugreport.apple.com, though I can't rule it out either. The first crash definitely wasn't while bugreport.apple.com was the active tab, though it could be that it was in some tab in the background.

At the time of the 2 crashes I had somewhat between 10 and 20 tabs open, some of them could be executing js in the background.

I have no idea how I could relate the crash to one of the tabs.

[Michael Saboff]

I suspect that this is fixed by the change to <https://bugs.webkit.org/show_bug.cgi?id=143727> - "DFG register fillSpeculate*() functions should validate incoming spill format is compatible with requested fill format" which was landed in change set r182827: <http://trac.webkit.org/changeset/182827>.

It is hard to prove if we can't reproduce the crash.

[Dieter Komendera]

Thank you Michael. Should I encounter the crash again, I will note all open URLs so I can try to reproduce, and let you know.

However, the crash seems pretty rare, as I'm having Safari open almost all day long and using it heavily, but encountered it only those 2 times I have the crash logs attached.

[Dieter Komendera]

Haven't come across this since then, marking as resolved.