Bug 173643 – [GTK][Stable] Crash in JSC::DFG::operationParseIntGeneric

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Bastien Nocera]

webkitgtk4-2.16.3-1.fc26.x86_64
and
webkitgtk4-2.16.4-1.fc26.x86_64

Running:
/usr/libexec/webkit2gtk-4.0/MiniBrowser 'http://www.omgubuntu.co.uk/2017/06/dash-to-dock-unity-features-coming?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+d0od+(OMG!+Ubuntu!)'
makes the WebKitProcess crash when the page finishes loading. Same problem in epiphany.

[Bastien Nocera]

#0  0x00007f6fd57bf467 in JSC::JSValue::isString() const (this=0x7fffdd3ad4a8) at /usr/src/debug/webkitgtk-2.16.4/Source/JavaScriptCore/runtime/JSCJSValueInlines.h:576
#1  0x00007f6fd57bf467 in JSC::JSValue::toStringOrNull(JSC::ExecState*) const (exec=0x7fffdd3ad700, this=0x7fffdd3ad4a8) at /usr/src/debug/webkitgtk-2.16.4/Source/JavaScriptCore/runtime/JSString.h:773
#2  0x00007f6fd57bf467 in JSC::toStringView<JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)::<lambda(WTF::StringView)> > (callback=..., value=..., exec=0x7fffdd3ad700)
    at /usr/src/debug/webkitgtk-2.16.4/Source/JavaScriptCore/runtime/ParseInt.h:219
#3  0x00007f6fd57bf467 in JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t) (exec=0x7fffdd3ad700, value=0, radix=10)
    at /usr/src/debug/webkitgtk-2.16.4/Source/JavaScriptCore/dfg/DFGOperations.cpp:904


576	    return isCell() && asCell()->isString();

[Carlos Garcia Campos]

I can't reproduce it with trunk

[Michael Catanzaro]

I can reproduce with 2.16.3. I'll try to get a better backtrace.

[Michael Catanzaro]

Tagging [Stable] since Carlos reports it doesn't reproduce in trunk.

Additional reproducers with 2.16.3 (note Bastien says above he's tested 2.16.4):

http://www.akitaonrails.com/2017/01/10/arch-linux-best-distro-ever
http://www.omgubuntu.co.uk/2017/06/quickly-change-folder-color-ubuntu

Unfortunately, since it's JSC, it looks like that's pretty much all there is to the stacktrace:

(gdb) bt full
#0  0x00007f87000f4db6 in JSC::JSValue::isString() const (this=0x7ffce7397080)
    at /usr/src/debug/webkitgtk-2.16.3/Source/JavaScriptCore/runtime/JSCJSValueInlines.h:576
        returnEmptyStringOnError = <optimized out>
        viewWithString = <optimized out>
#1  0x00007f87000f4db6 in JSC::JSValue::toStringOrNull(JSC::ExecState*) const (exec=0x7ffce73972e0, this=0x7ffce7397080)
    at /usr/src/debug/webkitgtk-2.16.3/Source/JavaScriptCore/runtime/JSString.h:773
        returnEmptyStringOnError = <optimized out>
        viewWithString = <optimized out>
#2  0x00007f87000f4db6 in JSC::toStringView<JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)::<lambda(WTF::StringView)> > (callback=..., value=..., exec=0x7ffce73972e0)
    at /usr/src/debug/webkitgtk-2.16.3/Source/JavaScriptCore/runtime/ParseInt.h:219
        viewWithString = <optimized out>
#3  0x00007f87000f4db6 in JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t) (exec=0x7ffce73972e0, value=0, radix=10)
    at /usr/src/debug/webkitgtk-2.16.3/Source/JavaScriptCore/dfg/DFGOperations.cpp:904
#4  0x00007f86942e517f in  ()

But maybe some of this will be useful:

(gdb) info registers
rax            0xffff000000000002	-281474976710654
rbx            0x7ffce73972e0	140724187788000
rcx            0xa	10
rdx            0xa	10
rsi            0x0	0
rdi            0x7ffce73972e0	140724187788000
rbp            0xa	0xa
rsp            0x7ffce7397070	0x7ffce7397070
r8             0x34	52
r9             0x0	0
r10            0x179d708079f688	6647030981719688
r11            0x7f87000f4d50	140217798315344
r12            0x7f86934acca8	140215973498024
r13            0x7f86d8fe8008	140217142902792
r14            0x7f86d9600000	140217149292544
r15            0xffff000000000002	-281474976710654
rip            0x7f87000f4db6	0x7f87000f4db6 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+102>
eflags         0x10246	[ PF ZF IF RF ]
cs             0x33	51
ss             0x2b	43
ds             0x0	0
es             0x0	0
fs             0x0	0
gs             0x0	0


(gdb) disassemble
Dump of assembler code for function JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t):
   0x00007f87000f4d96 <+70>:	mov    0x18(%rdi),%rax
   0x00007f87000f4d9a <+74>:	and    $0xffffffffffffc000,%rax
   0x00007f87000f4da0 <+80>:	mov    0x98(%rax),%r14
   0x00007f87000f4da7 <+87>:	movabs $0xffff000000000002,%rax
   0x00007f87000f4db1 <+97>:	test   %rax,%rsi
   0x00007f87000f4db4 <+100>:	jne    0x7f87000f4dc0 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+112>
=> 0x00007f87000f4db6 <+102>:	cmpb   $0x6,0x5(%rsi)
   0x00007f87000f4dba <+106>:	je     0x7f87000f5250 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1280>
   0x00007f87000f4dc0 <+112>:	lea    0x10(%rsp),%rdi
   0x00007f87000f4dc5 <+117>:	xor    %edx,%edx
   0x00007f87000f4dc7 <+119>:	mov    %rbx,%rsi
   0x00007f87000f4dca <+122>:	callq  0x7f86ffc41b20 <_ZNK3JSC7JSValue16toStringSlowCaseEPNS_9ExecStateEb@plt>
   0x00007f87000f4dcf <+127>:	test   %rax,%rax
   0x00007f87000f4dd2 <+130>:	mov    %rax,%r13
   0x00007f87000f4dd5 <+133>:	je     0x7f87000f5430 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1760>
   0x00007f87000f4ddb <+139>:	mov    0x10(%r13),%r12
   0x00007f87000f4ddf <+143>:	test   %r12,%r12
   0x00007f87000f4de2 <+146>:	jne    0x7f87000f4e07 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+183>
   0x00007f87000f4de4 <+148>:	cmpq   $0x1,0x18(%r13)
   0x00007f87000f4de9 <+153>:	je     0x7f87000f5210 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1216>
   0x00007f87000f4def <+159>:	mov    %rbx,%rsi
   0x00007f87000f4df2 <+162>:	mov    %r13,%rdi
   0x00007f87000f4df5 <+165>:	callq  0x7f86ffc30820 <_ZNK3JSC12JSRopeString11resolveRopeEPNS_9ExecStateE@plt>
   0x00007f87000f4dfa <+170>:	mov    0x10(%r13),%r12
   0x00007f87000f4dfe <+174>:	test   %r12,%r12
   0x00007f87000f4e01 <+177>:	je     0x7f87000f4ee0 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+400>
   0x00007f87000f4e07 <+183>:	testb  $0x8,0x10(%r12)
   0x00007f87000f4e0d <+189>:	mov    0x8(%r12),%rcx
   0x00007f87000f4e12 <+194>:	mov    $0x1,%eax
   0x00007f87000f4e17 <+199>:	mov    0x4(%r12),%ebx
   0x00007f87000f4e1c <+204>:	jne    0x7f87000f4e20 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+208>
   0x00007f87000f4e1e <+206>:	xor    %eax,%eax
   0x00007f87000f4e20 <+208>:	addl   $0x2,(%r12)
   0x00007f87000f4e25 <+213>:	mov    %rcx,%r13
   0x00007f87000f4e28 <+216>:	cmpq   $0x0,0x81b0(%r14)
   0x00007f87000f4e30 <+224>:	jne    0x7f87000f54d6 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1926>
   0x00007f87000f4e36 <+230>:	test   %al,%al
   0x00007f87000f4e38 <+232>:	jne    0x7f87000f4f00 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+432>
   0x00007f87000f4e3e <+238>:	test   %ebx,%ebx
   0x00007f87000f4e40 <+240>:	mov    %r13,0x20(%rsp)
   0x00007f87000f4e45 <+245>:	mov    %ebx,0x28(%rsp)
   0x00007f87000f4e49 <+249>:	movb   $0x0,0x2c(%rsp)
   0x00007f87000f4e4e <+254>:	mov    %ebx,(%rsp)
   0x00007f87000f4e51 <+257>:	jle    0x7f87000f5200 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1200>
   0x00007f87000f4e57 <+263>:	mov    %r13,%r15
   0x00007f87000f4e5a <+266>:	xor    %r14d,%r14d
   0x00007f87000f4e5d <+269>:	nopl   (%rax)
   0x00007f87000f4e60 <+272>:	movzwl (%r15),%edi
   0x00007f87000f4e64 <+276>:	cmp    $0xa0,%di
   0x00007f87000f4e69 <+281>:	je     0x7f87000f4f85 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+565>
   0x00007f87000f4e6f <+287>:	jbe    0x7f87000f51b0 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1120>
   0x00007f87000f4e75 <+293>:	cmp    $0x2029,%di
   0x00007f87000f4e7a <+298>:	ja     0x7f87000f51d8 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1160>
   0x00007f87000f4e80 <+304>:	cmp    $0x2028,%di
   0x00007f87000f4e85 <+309>:	jae    0x7f87000f4f85 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+565>
   0x00007f87000f4e8b <+315>:	cmp    $0x180e,%di
   0x00007f87000f4e90 <+320>:	je     0x7f87000f4f85 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+565>
   0x00007f87000f4e96 <+326>:	cmp    $0xff,%edi
   0x00007f87000f4e9c <+332>:	jg     0x7f87000f4f78 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+552>
   0x00007f87000f4ea2 <+338>:	cmp    %r14d,%ebx
   0x00007f87000f4ea5 <+341>:	jle    0x7f87000f4f99 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+585>
   0x00007f87000f4eab <+347>:	movzwl (%r15),%eax
   0x00007f87000f4eaf <+351>:	cmp    $0x2b,%ax
   0x00007f87000f4eb3 <+355>:	je     0x7f87000f5260 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1296>
   0x00007f87000f4eb9 <+361>:	cmp    $0x2d,%ax
   0x00007f87000f4ebd <+365>:	movsd  0x6b3f6b(%rip),%xmm2        # 0x7f87007a8e30
   0x00007f87000f4ec5 <+373>:	jne    0x7f87000f4fa1 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+593>
   0x00007f87000f4ecb <+379>:	add    $0x1,%r14d
   0x00007f87000f4ecf <+383>:	movsd  0x6b4039(%rip),%xmm2        # 0x7f87007a8f10
   0x00007f87000f4ed7 <+391>:	jmpq   0x7f87000f4fa1 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+593>
   0x00007f87000f4edc <+396>:	nopl   0x0(%rax)
   0x00007f87000f4ee0 <+400>:	xor    %ebx,%ebx
   0x00007f87000f4ee2 <+402>:	xor    %r13d,%r13d
   0x00007f87000f4ee5 <+405>:	cmpq   $0x0,0x81b0(%r14)
   0x00007f87000f4eed <+413>:	jne    0x7f87000f5430 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1760>
   0x00007f87000f4ef3 <+419>:	xor    %r12d,%r12d
   0x00007f87000f4ef6 <+422>:	mov    $0x1,%eax
   0x00007f87000f4efb <+427>:	nopl   0x0(%rax,%rax,1)
   0x00007f87000f4f00 <+432>:	test   %ebx,%ebx
   0x00007f87000f4f02 <+434>:	mov    %r13,0x30(%rsp)
   0x00007f87000f4f07 <+439>:	mov    %ebx,0x38(%rsp)
   0x00007f87000f4f0b <+443>:	mov    %al,0x3c(%rsp)
   0x00007f87000f4f0f <+447>:	jle    0x7f87000f51f0 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1184>
   0x00007f87000f4f15 <+453>:	mov    %r13,%rax
   0x00007f87000f4f18 <+456>:	xor    %esi,%esi
   0x00007f87000f4f1a <+458>:	nopw   0x0(%rax,%rax,1)
   0x00007f87000f4f20 <+464>:	movzbl (%rax),%ecx
   0x00007f87000f4f23 <+467>:	cmp    $0x20,%cl
   0x00007f87000f4f26 <+470>:	je     0x7f87000f50c1 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+881>
   0x00007f87000f4f2c <+476>:	ja     0x7f87000f50b8 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+872>
   0x00007f87000f4f32 <+482>:	lea    -0x9(%rcx),%edi
   0x00007f87000f4f35 <+485>:	cmp    $0x4,%dil
   0x00007f87000f4f39 <+489>:	jbe    0x7f87000f50c1 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+881>
   0x00007f87000f4f3f <+495>:	cmp    %esi,%ebx
   0x00007f87000f4f41 <+497>:	jle    0x7f87000f50d0 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+896>
   0x00007f87000f4f47 <+503>:	cmp    $0x2b,%cl
   0x00007f87000f4f4a <+506>:	je     0x7f87000f5278 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1320>
   0x00007f87000f4f50 <+512>:	cmp    $0x2d,%cl
   0x00007f87000f4f53 <+515>:	movsd  0x6b3ed5(%rip),%xmm2        # 0x7f87007a8e30
   0x00007f87000f4f5b <+523>:	jne    0x7f87000f50d8 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+904>
   0x00007f87000f4f61 <+529>:	add    $0x1,%esi
   0x00007f87000f4f64 <+532>:	movsd  0x6b3fa4(%rip),%xmm2        # 0x7f87007a8f10
   0x00007f87000f4f6c <+540>:	jmpq   0x7f87000f50d8 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+904>
   0x00007f87000f4f71 <+545>:	nopl   0x0(%rax)
   0x00007f87000f4f78 <+552>:	callq  0x7f86ffc41b40 <u_charType_57@plt>
   0x00007f87000f4f7d <+557>:	cmp    $0xc,%al
   0x00007f87000f4f7f <+559>:	jne    0x7f87000f4ea2 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+338>
   0x00007f87000f4f85 <+565>:	add    $0x1,%r14d
   0x00007f87000f4f89 <+569>:	add    $0x2,%r15
   0x00007f87000f4f8d <+573>:	cmp    %r14d,%ebx
   0x00007f87000f4f90 <+576>:	jne    0x7f87000f4e60 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+272>
   0x00007f87000f4f96 <+582>:	mov    %ebx,%r14d
   0x00007f87000f4f99 <+585>:	movsd  0x6b3e8f(%rip),%xmm2        # 0x7f87007a8e30
   0x00007f87000f4fa1 <+593>:	test   $0xffffffef,%ebp
   0x00007f87000f4fa7 <+599>:	jne    0x7f87000f53f8 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1704>
   0x00007f87000f4fad <+605>:	mov    %ebx,%eax
   0x00007f87000f4faf <+607>:	sub    %r14d,%eax
   0x00007f87000f4fb2 <+610>:	cmp    $0x1,%eax
   0x00007f87000f4fb5 <+613>:	jle    0x7f87000f4fcb <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+635>
   0x00007f87000f4fb7 <+615>:	movslq %r14d,%rax
   0x00007f87000f4fba <+618>:	cmpw   $0x30,0x0(%r13,%rax,2)
   0x00007f87000f4fc1 <+625>:	lea    (%rax,%rax,1),%rcx
   0x00007f87000f4fc5 <+629>:	je     0x7f87000f5490 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1856>
   0x00007f87000f4fcb <+635>:	test   %ebp,%ebp
   0x00007f87000f4fcd <+637>:	jne    0x7f87000f53f8 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1704>
   0x00007f87000f4fd3 <+643>:	mov    $0xa,%ebp
   0x00007f87000f4fd8 <+648>:	cmp    %r14d,%ebx
   0x00007f87000f4fdb <+651>:	jle    0x7f87000f53b4 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1636>
   0x00007f87000f4fe1 <+657>:	movslq %r14d,%rax
   0x00007f87000f4fe4 <+660>:	xor    %r8d,%r8d
   0x00007f87000f4fe7 <+663>:	mov    %r14d,%esi
   0x00007f87000f4fea <+666>:	lea    0x0(%r13,%rax,2),%rcx
   0x00007f87000f4fef <+671>:	pxor   %xmm0,%xmm0
   0x00007f87000f4ff3 <+675>:	movzwl (%rcx),%eax
   0x00007f87000f4ff6 <+678>:	lea    -0x30(%rax),%edi
   0x00007f87000f4ff9 <+681>:	mov    %eax,%edx
   0x00007f87000f4ffb <+683>:	cmp    $0x9,%di
   0x00007f87000f4fff <+687>:	ja     0x7f87000f5390 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1600>
   0x00007f87000f5005 <+693>:	nopl   (%rax)
   0x00007f87000f5008 <+696>:	sub    $0x30,%eax
   0x00007f87000f500b <+699>:	cmp    %ebp,%eax
   0x00007f87000f500d <+701>:	jl     0x7f87000f5348 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1528>
   0x00007f87000f5013 <+707>:	test   %r8b,%r8b
   0x00007f87000f5016 <+710>:	je     0x7f87000f53b4 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1636>
   0x00007f87000f501c <+716>:	mov    %esi,(%rsp)
   0x00007f87000f501f <+719>:	ucomisd 0x6b3ef1(%rip),%xmm0        # 0x7f87007a8f18
   0x00007f87000f5027 <+727>:	jb     0x7f87000f5040 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+752>
   0x00007f87000f5029 <+729>:	cmp    $0xa,%ebp
   0x00007f87000f502c <+732>:	je     0x7f87000f54dd <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1933>
   0x00007f87000f5032 <+738>:	cmp    $0x20,%ebp
   0x00007f87000f5035 <+741>:	jle    0x7f87000f5290 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1344>
   0x00007f87000f503b <+747>:	nopl   0x0(%rax,%rax,1)
   0x00007f87000f5040 <+752>:	mulsd  %xmm2,%xmm0
   0x00007f87000f5044 <+756>:	pxor   %xmm1,%xmm1
   0x00007f87000f5048 <+760>:	cvttsd2si %xmm0,%eax
   0x00007f87000f504c <+764>:	cvtsi2sd %eax,%xmm1
   0x00007f87000f5050 <+768>:	ucomisd %xmm1,%xmm0
   0x00007f87000f5054 <+772>:	jp     0x7f87000f5440 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1776>
   0x00007f87000f505a <+778>:	mov    %eax,%eax
   0x00007f87000f505c <+780>:	movabs $0xffff000000000000,%rdx
   0x00007f87000f5066 <+790>:	or     %rdx,%rax
   0x00007f87000f5069 <+793>:	ucomisd %xmm1,%xmm0
   0x00007f87000f506d <+797>:	jne    0x7f87000f5440 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1776>
   0x00007f87000f5073 <+803>:	test   %r12,%r12
   0x00007f87000f5076 <+806>:	je     0x7f87000f5089 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+825>
   0x00007f87000f5078 <+808>:	mov    (%r12),%edx
   0x00007f87000f507c <+812>:	sub    $0x2,%edx
   0x00007f87000f507f <+815>:	je     0x7f87000f5418 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1736>
   0x00007f87000f5085 <+821>:	mov    %edx,(%r12)
   0x00007f87000f5089 <+825>:	mov    0x88(%rsp),%rsi
   0x00007f87000f5091 <+833>:	xor    %fs:0x28,%rsi
   0x00007f87000f509a <+842>:	jne    0x7f87000f5676 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+2342>
   0x00007f87000f50a0 <+848>:	add    $0x98,%rsp
   0x00007f87000f50a7 <+855>:	pop    %rbx
   0x00007f87000f50a8 <+856>:	pop    %rbp
   0x00007f87000f50a9 <+857>:	pop    %r12
   0x00007f87000f50ab <+859>:	pop    %r13
   0x00007f87000f50ad <+861>:	pop    %r14
   0x00007f87000f50af <+863>:	pop    %r15
   0x00007f87000f50b1 <+865>:	retq   
   0x00007f87000f50b2 <+866>:	nopw   0x0(%rax,%rax,1)
   0x00007f87000f50b8 <+872>:	cmp    $0xa0,%cl
   0x00007f87000f50bb <+875>:	jne    0x7f87000f4f3f <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+495>
   0x00007f87000f50c1 <+881>:	add    $0x1,%esi
   0x00007f87000f50c4 <+884>:	add    $0x1,%rax
   0x00007f87000f50c8 <+888>:	cmp    %esi,%ebx
   0x00007f87000f50ca <+890>:	jne    0x7f87000f4f20 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+464>
   0x00007f87000f50d0 <+896>:	movsd  0x6b3d58(%rip),%xmm2        # 0x7f87007a8e30
   0x00007f87000f50d8 <+904>:	test   $0xffffffef,%ebp
   0x00007f87000f50de <+910>:	jne    0x7f87000f53a8 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1624>
   0x00007f87000f50e4 <+916>:	mov    %ebx,%eax
   0x00007f87000f50e6 <+918>:	sub    %esi,%eax
   0x00007f87000f50e8 <+920>:	cmp    $0x1,%eax
   0x00007f87000f50eb <+923>:	jle    0x7f87000f50fc <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+940>
   0x00007f87000f50ed <+925>:	movslq %esi,%rax
   0x00007f87000f50f0 <+928>:	cmpb   $0x30,0x0(%r13,%rax,1)
   0x00007f87000f50f6 <+934>:	je     0x7f87000f54b8 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1896>
   0x00007f87000f50fc <+940>:	test   %ebp,%ebp
   0x00007f87000f50fe <+942>:	jne    0x7f87000f53a8 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1624>
   0x00007f87000f5104 <+948>:	mov    $0xa,%ebp
   0x00007f87000f5109 <+953>:	cmp    %esi,%ebx
   0x00007f87000f510b <+955>:	jle    0x7f87000f53b4 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1636>
   0x00007f87000f5111 <+961>:	movslq %esi,%rcx
   0x00007f87000f5114 <+964>:	xor    %r9d,%r9d
   0x00007f87000f5117 <+967>:	mov    %esi,%edx
   0x00007f87000f5119 <+969>:	add    %r13,%rcx
   0x00007f87000f511c <+972>:	pxor   %xmm0,%xmm0
   0x00007f87000f5120 <+976>:	movzbl (%rcx),%eax
   0x00007f87000f5123 <+979>:	lea    -0x30(%rax),%r8d
   0x00007f87000f5127 <+983>:	mov    %eax,%edi
   0x00007f87000f5129 <+985>:	cmp    $0x9,%r8w
   0x00007f87000f512e <+990>:	ja     0x7f87000f532a <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1498>
   0x00007f87000f5134 <+996>:	nopl   0x0(%rax)
   0x00007f87000f5138 <+1000>:	sub    $0x30,%eax
   0x00007f87000f513b <+1003>:	cmp    %ebp,%eax
   0x00007f87000f513d <+1005>:	jl     0x7f87000f52e0 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1424>
   0x00007f87000f5143 <+1011>:	test   %r9b,%r9b
   0x00007f87000f5146 <+1014>:	je     0x7f87000f53b4 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1636>
   0x00007f87000f514c <+1020>:	ucomisd 0x6b3dc4(%rip),%xmm0        # 0x7f87007a8f18
   0x00007f87000f5154 <+1028>:	jb     0x7f87000f5040 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+752>
   0x00007f87000f515a <+1034>:	cmp    $0xa,%ebp
   0x00007f87000f515d <+1037>:	je     0x7f87000f5567 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+2071>
   0x00007f87000f5163 <+1043>:	cmp    $0x20,%ebp
   0x00007f87000f5166 <+1046>:	jg     0x7f87000f5040 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+752>
   0x00007f87000f516c <+1052>:	movabs $0x100010114,%rax
   0x00007f87000f5176 <+1062>:	bt     %rbp,%rax
   0x00007f87000f517a <+1066>:	jae    0x7f87000f5040 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+752>
   0x00007f87000f5180 <+1072>:	lea    0x30(%rsp),%rdi
   0x00007f87000f5185 <+1077>:	sub    %esi,%edx
   0x00007f87000f5187 <+1079>:	movsd  %xmm2,(%rsp)
   0x00007f87000f518c <+1084>:	callq  0x7f86ffc41b50 <_ZNK3WTF10StringView9substringEjj@plt>
   0x00007f87000f5191 <+1089>:	mov    %ebp,%ecx
   0x00007f87000f5193 <+1091>:	mov    %rdx,%rsi
   0x00007f87000f5196 <+1094>:	mov    %rax,%rdi
   0x00007f87000f5199 <+1097>:	shr    $0x20,%rdx
   0x00007f87000f519d <+1101>:	callq  0x7f87000eb6e0 <JSC::parseIntOverflow(int)>
   0x00007f87000f51a2 <+1106>:	movsd  (%rsp),%xmm2
   0x00007f87000f51a7 <+1111>:	jmpq   0x7f87000f5040 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+752>
   0x00007f87000f51ac <+1116>:	nopl   0x0(%rax)
   0x00007f87000f51b0 <+1120>:	cmp    $0x9,%di
   0x00007f87000f51b4 <+1124>:	jb     0x7f87000f4e96 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+326>
   0x00007f87000f51ba <+1130>:	cmp    $0xd,%di
   0x00007f87000f51be <+1134>:	jbe    0x7f87000f4f85 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+565>
   0x00007f87000f51c4 <+1140>:	cmp    $0x20,%di
   0x00007f87000f51c8 <+1144>:	jne    0x7f87000f4e96 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+326>
   0x00007f87000f51ce <+1150>:	jmpq   0x7f87000f4f85 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+565>
   0x00007f87000f51d3 <+1155>:	nopl   0x0(%rax,%rax,1)
   0x00007f87000f51d8 <+1160>:	cmp    $0xfeff,%di
   0x00007f87000f51dd <+1165>:	jne    0x7f87000f4e96 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+326>
   0x00007f87000f51e3 <+1171>:	jmpq   0x7f87000f4f85 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+565>
   0x00007f87000f51e8 <+1176>:	nopl   0x0(%rax,%rax,1)
   0x00007f87000f51f0 <+1184>:	xor    %esi,%esi
   0x00007f87000f51f2 <+1186>:	jmpq   0x7f87000f50d0 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+896>
   0x00007f87000f51f7 <+1191>:	nopw   0x0(%rax,%rax,1)
   0x00007f87000f5200 <+1200>:	xor    %r14d,%r14d
   0x00007f87000f5203 <+1203>:	jmpq   0x7f87000f4f99 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+585>
   0x00007f87000f5208 <+1208>:	nopl   0x0(%rax,%rax,1)
   0x00007f87000f5210 <+1216>:	testb  $0x1,0x8(%r13)
   0x00007f87000f5215 <+1221>:	mov    0x20(%r13),%rax
   0x00007f87000f5219 <+1225>:	mov    0x10(%rax),%r12
   0x00007f87000f521d <+1229>:	je     0x7f87000f5460 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1808>
   0x00007f87000f5223 <+1235>:	test   %r12,%r12
   0x00007f87000f5226 <+1238>:	je     0x7f87000f5647 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+2295>
   0x00007f87000f522c <+1244>:	mov    0x28(%r13),%rcx
   0x00007f87000f5230 <+1248>:	add    0x8(%r12),%rcx
   0x00007f87000f5235 <+1253>:	mov    $0x1,%eax
   0x00007f87000f523a <+1258>:	mov    0xc(%r13),%ebx
   0x00007f87000f523e <+1262>:	addl   $0x2,(%r12)
   0x00007f87000f5243 <+1267>:	mov    %rcx,%r13
   0x00007f87000f5246 <+1270>:	jmpq   0x7f87000f4e28 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+216>
   0x00007f87000f524b <+1275>:	nopl   0x0(%rax,%rax,1)
   0x00007f87000f5250 <+1280>:	mov    %rsi,%r13
   0x00007f87000f5253 <+1283>:	jmpq   0x7f87000f4ddb <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+139>
   0x00007f87000f5258 <+1288>:	nopl   0x0(%rax,%rax,1)
   0x00007f87000f5260 <+1296>:	add    $0x1,%r14d
   0x00007f87000f5264 <+1300>:	movsd  0x6b3bc4(%rip),%xmm2        # 0x7f87007a8e30
   0x00007f87000f526c <+1308>:	jmpq   0x7f87000f4fa1 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+593>
   0x00007f87000f5271 <+1313>:	nopl   0x0(%rax)
   0x00007f87000f5278 <+1320>:	add    $0x1,%esi
   0x00007f87000f527b <+1323>:	movsd  0x6b3bad(%rip),%xmm2        # 0x7f87007a8e30
   0x00007f87000f5283 <+1331>:	jmpq   0x7f87000f50d8 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+904>
   0x00007f87000f5288 <+1336>:	nopl   0x0(%rax,%rax,1)
   0x00007f87000f5290 <+1344>:	movabs $0x100010114,%rax
   0x00007f87000f529a <+1354>:	bt     %rbp,%rax
   0x00007f87000f529e <+1358>:	jae    0x7f87000f5040 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+752>
   0x00007f87000f52a4 <+1364>:	mov    (%rsp),%edx
   0x00007f87000f52a7 <+1367>:	lea    0x20(%rsp),%rdi
   0x00007f87000f52ac <+1372>:	mov    %r14d,%esi
   0x00007f87000f52af <+1375>:	movsd  %xmm2,0x8(%rsp)
   0x00007f87000f52b5 <+1381>:	sub    %r14d,%edx
   0x00007f87000f52b8 <+1384>:	callq  0x7f86ffc41b50 <_ZNK3WTF10StringView9substringEjj@plt>
   0x00007f87000f52bd <+1389>:	mov    %ebp,%ecx
   0x00007f87000f52bf <+1391>:	mov    %rdx,%rsi
   0x00007f87000f52c2 <+1394>:	mov    %rax,%rdi
   0x00007f87000f52c5 <+1397>:	shr    $0x20,%rdx
   0x00007f87000f52c9 <+1401>:	callq  0x7f87000eb6e0 <JSC::parseIntOverflow(int)>
   0x00007f87000f52ce <+1406>:	movsd  0x8(%rsp),%xmm2
   0x00007f87000f52d4 <+1412>:	jmpq   0x7f87000f5040 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+752>
   0x00007f87000f52d9 <+1417>:	nopl   0x0(%rax)
   0x00007f87000f52e0 <+1424>:	cmp    $0xffffffff,%eax
   0x00007f87000f52e3 <+1427>:	je     0x7f87000f5143 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1011>
   0x00007f87000f52e9 <+1433>:	pxor   %xmm1,%xmm1
   0x00007f87000f52ed <+1437>:	add    $0x1,%edx
   0x00007f87000f52f0 <+1440>:	add    $0x1,%rcx
   0x00007f87000f52f4 <+1444>:	cmp    %edx,%ebx
   0x00007f87000f52f6 <+1446>:	mov    $0x1,%r9d
   0x00007f87000f52fc <+1452>:	cvtsi2sd %ebp,%xmm1
   0x00007f87000f5300 <+1456>:	mulsd  %xmm0,%xmm1
   0x00007f87000f5304 <+1460>:	pxor   %xmm0,%xmm0
   0x00007f87000f5308 <+1464>:	cvtsi2sd %eax,%xmm0
   0x00007f87000f530c <+1468>:	addsd  %xmm1,%xmm0
   0x00007f87000f5310 <+1472>:	je     0x7f87000f514c <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1020>
   0x00007f87000f5316 <+1478>:	movzbl (%rcx),%eax
   0x00007f87000f5319 <+1481>:	lea    -0x30(%rax),%r8d
   0x00007f87000f531d <+1485>:	mov    %eax,%edi
   0x00007f87000f531f <+1487>:	cmp    $0x9,%r8w
   0x00007f87000f5324 <+1492>:	jbe    0x7f87000f5138 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1000>
   0x00007f87000f532a <+1498>:	lea    -0x41(%rax),%r8d
   0x00007f87000f532e <+1502>:	cmp    $0x19,%r8w
   0x00007f87000f5333 <+1507>:	ja     0x7f87000f53e0 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1680>
   0x00007f87000f5339 <+1513>:	sub    $0x37,%eax
   0x00007f87000f533c <+1516>:	jmpq   0x7f87000f513b <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1003>
   0x00007f87000f5341 <+1521>:	nopl   0x0(%rax)
   0x00007f87000f5348 <+1528>:	cmp    $0xffffffff,%eax
   0x00007f87000f534b <+1531>:	je     0x7f87000f5013 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+707>
   0x00007f87000f5351 <+1537>:	pxor   %xmm1,%xmm1
   0x00007f87000f5355 <+1541>:	add    $0x1,%esi
   0x00007f87000f5358 <+1544>:	add    $0x2,%rcx
   0x00007f87000f535c <+1548>:	cmp    %esi,%ebx
   0x00007f87000f535e <+1550>:	mov    $0x1,%r8d
   0x00007f87000f5364 <+1556>:	cvtsi2sd %ebp,%xmm1
   0x00007f87000f5368 <+1560>:	mulsd  %xmm0,%xmm1
   0x00007f87000f536c <+1564>:	pxor   %xmm0,%xmm0
   0x00007f87000f5370 <+1568>:	cvtsi2sd %eax,%xmm0
   0x00007f87000f5374 <+1572>:	addsd  %xmm1,%xmm0
   0x00007f87000f5378 <+1576>:	je     0x7f87000f501f <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+719>
   0x00007f87000f537e <+1582>:	movzwl (%rcx),%eax
   0x00007f87000f5381 <+1585>:	lea    -0x30(%rax),%edi
   0x00007f87000f5384 <+1588>:	mov    %eax,%edx
   0x00007f87000f5386 <+1590>:	cmp    $0x9,%di
   0x00007f87000f538a <+1594>:	jbe    0x7f87000f5008 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+696>
   0x00007f87000f5390 <+1600>:	lea    -0x41(%rax),%edi
   0x00007f87000f5393 <+1603>:	cmp    $0x19,%di
   0x00007f87000f5397 <+1607>:	ja     0x7f87000f53c8 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1656>
   0x00007f87000f5399 <+1609>:	sub    $0x37,%eax
   0x00007f87000f539c <+1612>:	jmpq   0x7f87000f500b <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+699>
   0x00007f87000f53a1 <+1617>:	nopl   0x0(%rax)
   0x00007f87000f53a8 <+1624>:	lea    -0x2(%rbp),%eax
   0x00007f87000f53ab <+1627>:	cmp    $0x22,%eax
   0x00007f87000f53ae <+1630>:	jbe    0x7f87000f5109 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+953>
   0x00007f87000f53b4 <+1636>:	movabs $0x7ff9000000000000,%rax
   0x00007f87000f53be <+1646>:	jmpq   0x7f87000f5073 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+803>
   0x00007f87000f53c3 <+1651>:	nopl   0x0(%rax,%rax,1)
   0x00007f87000f53c8 <+1656>:	sub    $0x61,%edx
   0x00007f87000f53cb <+1659>:	cmp    $0x19,%dx
   0x00007f87000f53cf <+1663>:	ja     0x7f87000f5013 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+707>
   0x00007f87000f53d5 <+1669>:	sub    $0x57,%eax
   0x00007f87000f53d8 <+1672>:	jmpq   0x7f87000f500b <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+699>
   0x00007f87000f53dd <+1677>:	nopl   (%rax)
   0x00007f87000f53e0 <+1680>:	sub    $0x61,%edi
   0x00007f87000f53e3 <+1683>:	cmp    $0x19,%di
   0x00007f87000f53e7 <+1687>:	ja     0x7f87000f5143 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1011>
   0x00007f87000f53ed <+1693>:	sub    $0x57,%eax
   0x00007f87000f53f0 <+1696>:	jmpq   0x7f87000f513b <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1003>
   0x00007f87000f53f5 <+1701>:	nopl   (%rax)
   0x00007f87000f53f8 <+1704>:	lea    -0x2(%rbp),%eax
   0x00007f87000f53fb <+1707>:	cmp    $0x22,%eax
   0x00007f87000f53fe <+1710>:	jbe    0x7f87000f4fd8 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+648>
   0x00007f87000f5404 <+1716>:	movabs $0x7ff9000000000000,%rax
   0x00007f87000f540e <+1726>:	jmpq   0x7f87000f5073 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+803>
   0x00007f87000f5413 <+1731>:	nopl   0x0(%rax,%rax,1)
   0x00007f87000f5418 <+1736>:	mov    %r12,%rdi
   0x00007f87000f541b <+1739>:	mov    %rax,(%rsp)
   0x00007f87000f541f <+1743>:	callq  0x7f86ffc2f470 <_ZN3WTF10StringImpl7destroyEPS0_@plt>
   0x00007f87000f5424 <+1748>:	mov    (%rsp),%rax
   0x00007f87000f5428 <+1752>:	jmpq   0x7f87000f5089 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+825>
   0x00007f87000f542d <+1757>:	nopl   (%rax)
   0x00007f87000f5430 <+1760>:	xor    %eax,%eax
   0x00007f87000f5432 <+1762>:	jmpq   0x7f87000f5089 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+825>
   0x00007f87000f5437 <+1767>:	nopw   0x0(%rax,%rax,1)
   0x00007f87000f5440 <+1776>:	movq   %xmm0,%rsi
   0x00007f87000f5445 <+1781>:	movabs $0x1000000000000,%rax
   0x00007f87000f544f <+1791>:	add    %rax,%rsi
   0x00007f87000f5452 <+1794>:	mov    %rsi,%rax
   0x00007f87000f5455 <+1797>:	jmpq   0x7f87000f5073 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+803>
   0x00007f87000f545a <+1802>:	nopw   0x0(%rax,%rax,1)
   0x00007f87000f5460 <+1808>:	test   %r12,%r12
   0x00007f87000f5463 <+1811>:	je     0x7f87000f5654 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+2308>
   0x00007f87000f5469 <+1817>:	mov    0x28(%r13),%rdx
   0x00007f87000f546d <+1821>:	mov    0x8(%r12),%rax
   0x00007f87000f5472 <+1826>:	mov    0xc(%r13),%ebx
   0x00007f87000f5476 <+1830>:	addl   $0x2,(%r12)
   0x00007f87000f547b <+1835>:	lea    (%rax,%rdx,2),%r13
   0x00007f87000f547f <+1839>:	xor    %eax,%eax
   0x00007f87000f5481 <+1841>:	jmpq   0x7f87000f4e28 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+216>
   0x00007f87000f5486 <+1846>:	nopw   %cs:0x0(%rax,%rax,1)
   0x00007f87000f5490 <+1856>:	movzwl 0x2(%r13,%rcx,1),%eax
   0x00007f87000f5496 <+1862>:	and    $0xffffffdf,%eax
   0x00007f87000f5499 <+1865>:	cmp    $0x58,%ax
   0x00007f87000f549d <+1869>:	jne    0x7f87000f4fcb <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+635>
   0x00007f87000f54a3 <+1875>:	add    $0x2,%r14d
   0x00007f87000f54a7 <+1879>:	mov    $0x10,%ebp
   0x00007f87000f54ac <+1884>:	jmpq   0x7f87000f4fd8 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+648>
   0x00007f87000f54b1 <+1889>:	nopl   0x0(%rax)
   0x00007f87000f54b8 <+1896>:	movzbl 0x1(%r13,%rax,1),%eax
   0x00007f87000f54be <+1902>:	and    $0xffffffdf,%eax
   0x00007f87000f54c1 <+1905>:	cmp    $0x58,%al
   0x00007f87000f54c3 <+1907>:	jne    0x7f87000f50fc <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+940>
   0x00007f87000f54c9 <+1913>:	add    $0x2,%esi
   0x00007f87000f54cc <+1916>:	mov    $0x10,%ebp
   0x00007f87000f54d1 <+1921>:	jmpq   0x7f87000f5109 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+953>
   0x00007f87000f54d6 <+1926>:	xor    %eax,%eax
   0x00007f87000f54d8 <+1928>:	jmpq   0x7f87000f5078 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+808>
   0x00007f87000f54dd <+1933>:	mov    (%rsp),%edx
   0x00007f87000f54e0 <+1936>:	lea    0x20(%rsp),%rdi
   0x00007f87000f54e5 <+1941>:	mov    %r14d,%esi
   0x00007f87000f54e8 <+1944>:	movsd  %xmm2,0x8(%rsp)
   0x00007f87000f54ee <+1950>:	sub    %r14d,%edx
   0x00007f87000f54f1 <+1953>:	callq  0x7f86ffc41b50 <_ZNK3WTF10StringView9substringEjj@plt>
   0x00007f87000f54f6 <+1958>:	mov    %rdx,%rcx
   0x00007f87000f54f9 <+1961>:	movsd  0x8(%rsp),%xmm2
   0x00007f87000f54ff <+1967>:	shr    $0x20,%rcx
   0x00007f87000f5503 <+1971>:	test   %cl,%cl
   0x00007f87000f5505 <+1973>:	jne    0x7f87000f5603 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+2227>
   0x00007f87000f550b <+1979>:	mov    %edx,%esi
   0x00007f87000f550d <+1981>:	cmp    $0x40,%rsi
   0x00007f87000f5511 <+1985>:	ja     0x7f87000f560f <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+2239>
   0x00007f87000f5517 <+1991>:	test   %edx,%edx
   0x00007f87000f5519 <+1993>:	jle    0x7f87000f5685 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+2357>
   0x00007f87000f551f <+1999>:	lea    -0x1(%rdx),%edi
   0x00007f87000f5522 <+2002>:	lea    0x40(%rsp),%r8
   0x00007f87000f5527 <+2007>:	xor    %edx,%edx
   0x00007f87000f5529 <+2009>:	xor    %r9d,%r9d
   0x00007f87000f552c <+2012>:	add    $0x1,%rdi
   0x00007f87000f5530 <+2016>:	movzwl (%rax,%rdx,2),%ecx
   0x00007f87000f5534 <+2020>:	test   $0xff80,%ecx
   0x00007f87000f553a <+2026>:	cmovne %r9d,%ecx
   0x00007f87000f553e <+2030>:	mov    %cl,(%r8,%rdx,1)
   0x00007f87000f5542 <+2034>:	add    $0x1,%rdx
   0x00007f87000f5546 <+2038>:	cmp    %rdi,%rdx
   0x00007f87000f5549 <+2041>:	jne    0x7f87000f5530 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+2016>
   0x00007f87000f554b <+2043>:	lea    0x30(%rsp),%rdx
   0x00007f87000f5550 <+2048>:	mov    %r8,%rdi
   0x00007f87000f5553 <+2051>:	movsd  %xmm2,(%rsp)
   0x00007f87000f5558 <+2056>:	callq  0x7f86ffc41950 <_ZN3WTF17double_conversion23StringToDoubleConverter14StringToDoubleEPKcmPm@plt>
   0x00007f87000f555d <+2061>:	movsd  (%rsp),%xmm2
   0x00007f87000f5562 <+2066>:	jmpq   0x7f87000f5040 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+752>
   0x00007f87000f5567 <+2071>:	lea    0x30(%rsp),%rdi
   0x00007f87000f556c <+2076>:	sub    %esi,%edx
   0x00007f87000f556e <+2078>:	movsd  %xmm2,(%rsp)
   0x00007f87000f5573 <+2083>:	callq  0x7f86ffc41b50 <_ZNK3WTF10StringView9substringEjj@plt>
   0x00007f87000f5578 <+2088>:	mov    %rdx,%rcx
   0x00007f87000f557b <+2091>:	movsd  (%rsp),%xmm2
   0x00007f87000f5580 <+2096>:	shr    $0x20,%rcx
   0x00007f87000f5584 <+2100>:	test   %cl,%cl
   0x00007f87000f5586 <+2102>:	jne    0x7f87000f55e7 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+2199>
   0x00007f87000f5588 <+2104>:	mov    %edx,%esi
   0x00007f87000f558a <+2106>:	cmp    $0x40,%rsi
   0x00007f87000f558e <+2110>:	ja     0x7f87000f562b <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+2267>
   0x00007f87000f5594 <+2116>:	test   %edx,%edx
   0x00007f87000f5596 <+2118>:	jle    0x7f87000f567b <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+2347>
   0x00007f87000f559c <+2124>:	lea    -0x1(%rdx),%edi
   0x00007f87000f559f <+2127>:	lea    0x40(%rsp),%r8
   0x00007f87000f55a4 <+2132>:	xor    %edx,%edx
   0x00007f87000f55a6 <+2134>:	xor    %r9d,%r9d
   0x00007f87000f55a9 <+2137>:	add    $0x1,%rdi
   0x00007f87000f55ad <+2141>:	nopl   (%rax)
   0x00007f87000f55b0 <+2144>:	movzwl (%rax,%rdx,2),%ecx
   0x00007f87000f55b4 <+2148>:	test   $0xff80,%ecx
   0x00007f87000f55ba <+2154>:	cmovne %r9d,%ecx
   0x00007f87000f55be <+2158>:	mov    %cl,(%r8,%rdx,1)
   0x00007f87000f55c2 <+2162>:	add    $0x1,%rdx
   0x00007f87000f55c6 <+2166>:	cmp    %rdi,%rdx
   0x00007f87000f55c9 <+2169>:	jne    0x7f87000f55b0 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+2144>
   0x00007f87000f55cb <+2171>:	lea    0x20(%rsp),%rdx
   0x00007f87000f55d0 <+2176>:	mov    %r8,%rdi
   0x00007f87000f55d3 <+2179>:	movsd  %xmm2,(%rsp)
   0x00007f87000f55d8 <+2184>:	callq  0x7f86ffc41950 <_ZN3WTF17double_conversion23StringToDoubleConverter14StringToDoubleEPKcmPm@plt>
   0x00007f87000f55dd <+2189>:	movsd  (%rsp),%xmm2
   0x00007f87000f55e2 <+2194>:	jmpq   0x7f87000f5040 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+752>
   0x00007f87000f55e7 <+2199>:	lea    0x20(%rsp),%rcx
   0x00007f87000f55ec <+2204>:	mov    %edx,%esi
   0x00007f87000f55ee <+2206>:	mov    %rax,%rdi
   0x00007f87000f55f1 <+2209>:	mov    %rcx,%rdx
   0x00007f87000f55f4 <+2212>:	callq  0x7f86ffc41950 <_ZN3WTF17double_conversion23StringToDoubleConverter14StringToDoubleEPKcmPm@plt>
   0x00007f87000f55f9 <+2217>:	movsd  (%rsp),%xmm2
   0x00007f87000f55fe <+2222>:	jmpq   0x7f87000f5040 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+752>
   0x00007f87000f5603 <+2227>:	movsd  %xmm2,(%rsp)
   0x00007f87000f5608 <+2232>:	lea    0x30(%rsp),%rcx
   0x00007f87000f560d <+2237>:	jmp    0x7f87000f55ec <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+2204>
   0x00007f87000f560f <+2239>:	lea    0x30(%rsp),%rdx
   0x00007f87000f5614 <+2244>:	mov    %rax,%rdi
   0x00007f87000f5617 <+2247>:	movsd  %xmm2,(%rsp)
   0x00007f87000f561c <+2252>:	callq  0x7f86ffc41960 <_ZN3WTF8Internal25parseDoubleFromLongStringEPKtmRm@plt>
   0x00007f87000f5621 <+2257>:	movsd  (%rsp),%xmm2
   0x00007f87000f5626 <+2262>:	jmpq   0x7f87000f5040 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+752>
   0x00007f87000f562b <+2267>:	lea    0x20(%rsp),%rdx
   0x00007f87000f5630 <+2272>:	mov    %rax,%rdi
   0x00007f87000f5633 <+2275>:	movsd  %xmm2,(%rsp)
   0x00007f87000f5638 <+2280>:	callq  0x7f86ffc41960 <_ZN3WTF8Internal25parseDoubleFromLongStringEPKtmRm@plt>
   0x00007f87000f563d <+2285>:	movsd  (%rsp),%xmm2
   0x00007f87000f5642 <+2290>:	jmpq   0x7f87000f5040 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+752>
   0x00007f87000f5647 <+2295>:	mov    0xc(%r13),%ebx
   0x00007f87000f564b <+2299>:	mov    0x28(%r13),%r13
   0x00007f87000f564f <+2303>:	jmpq   0x7f87000f4ee5 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+405>
   0x00007f87000f5654 <+2308>:	cmpq   $0x0,0x81b0(%r14)
   0x00007f87000f565c <+2316>:	mov    0x28(%r13),%rax
   0x00007f87000f5660 <+2320>:	mov    0xc(%r13),%ebx
   0x00007f87000f5664 <+2324>:	lea    (%rax,%rax,1),%rdx
   0x00007f87000f5668 <+2328>:	jne    0x7f87000f5430 <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+1760>
   0x00007f87000f566e <+2334>:	mov    %rdx,%r13
   0x00007f87000f5671 <+2337>:	jmpq   0x7f87000f4e3e <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+238>
   0x00007f87000f5676 <+2342>:	callq  0x7f86ffc2f490 <__stack_chk_fail@plt>
   0x00007f87000f567b <+2347>:	lea    0x40(%rsp),%r8
   0x00007f87000f5680 <+2352>:	jmpq   0x7f87000f55cb <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+2171>
   0x00007f87000f5685 <+2357>:	lea    0x40(%rsp),%r8
   0x00007f87000f568a <+2362>:	jmpq   0x7f87000f554b <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue, int32_t)+2043>
End of assembler dump.

[Michael Catanzaro]

(In reply to Michael Catanzaro from comment #4)
>    0x00007f87000f4db4 <+100>:	jne    0x7f87000f4dc0
> <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue,
> int32_t)+112>
> => 0x00007f87000f4db6 <+102>:	cmpb   $0x6,0x5(%rsi)
>    0x00007f87000f4dba <+106>:	je     0x7f87000f5250
> <JSC::DFG::operationParseIntGeneric(JSC::ExecState*, JSC::EncodedJSValue,
> int32_t)+1280>

(Note the crash is at the => line.)

[Michael Catanzaro]

*** Bug 173805 has been marked as a duplicate of this bug. ***

[Michael Catanzaro]

*** Bug 173502 has been marked as a duplicate of this bug. ***

[Michael Catanzaro]

From the duplicates above, this can also be triggered by scrolling on http://joeduffyblog.com/2016/02/07/the-error-model/ or http://www.francetvinfo.fr/politique/la-france-insoumise/vous-ne-pouvez-pas-dire-vive-la-france-une-interview-d-une-deputee-insoumise-suscite-la-polemique_2250759.html. Probably better to test with the reproducers I posted before, which work by just loading the page.

[Michael Catanzaro]

*** Bug 171570 has been marked as a duplicate of this bug. ***

[Michael Catanzaro]

Hey Yusuke, any chance you have time to look into this one? I've found a bunch of duplicates....

[Yusuke Suzuki]

(In reply to Michael Catanzaro from comment #10)
> Hey Yusuke, any chance you have time to look into this one? I've found a
> bunch of duplicates....

I'll check it ;) Maybe it takes a bit time since I'm now in Toronto...

[Yusuke Suzuki]

(In reply to Yusuke Suzuki from comment #11)
> (In reply to Michael Catanzaro from comment #10)
> > Hey Yusuke, any chance you have time to look into this one? I've found a
> > bunch of duplicates....
> 
> I'll check it ;) Maybe it takes a bit time since I'm now in Toronto...

I'm not testing it yet. But, is it related?
https://bugs.webkit.org/show_bug.cgi?id=170865

[Carlos Garcia Campos]

(In reply to Yusuke Suzuki from comment #12)
> (In reply to Yusuke Suzuki from comment #11)
> > (In reply to Michael Catanzaro from comment #10)
> > > Hey Yusuke, any chance you have time to look into this one? I've found a
> > > bunch of duplicates....
> > 
> > I'll check it ;) Maybe it takes a bit time since I'm now in Toronto...
> 
> I'm not testing it yet. But, is it related?
> https://bugs.webkit.org/show_bug.cgi?id=170865

Yes! I've just merged r215387 and I can't reproduce the crashes anymore in 2.16. Thanks!

[Carlos Garcia Campos]

Merged <http://trac.webkit.org/changeset/218801>

[Yusuke Suzuki]

(In reply to Carlos Garcia Campos from comment #13)
> (In reply to Yusuke Suzuki from comment #12)
> > (In reply to Yusuke Suzuki from comment #11)
> > > (In reply to Michael Catanzaro from comment #10)
> > > > Hey Yusuke, any chance you have time to look into this one? I've found a
> > > > bunch of duplicates....
> > > 
> > > I'll check it ;) Maybe it takes a bit time since I'm now in Toronto...
> > 
> > I'm not testing it yet. But, is it related?
> > https://bugs.webkit.org/show_bug.cgi?id=170865
> 
> Yes! I've just merged r215387 and I can't reproduce the crashes anymore in
> 2.16. Thanks!

Nice!

[Michael Catanzaro]

(In reply to Carlos Garcia Campos from comment #13)
> Yes! I've just merged r215387 and I can't reproduce the crashes anymore in
> 2.16. Thanks!

Maybe we should inform JSC developers of our branch points and ask for help with deciding which commits to backport.