192050 – REGRESSION: Flaky crash in JSC::speculationFromValue(JSC::JSValue)

RESOLVED FIXED Bug 192050

REGRESSION: Flaky crash in JSC::speculationFromValue(JSC::JSValue)

https://bugs.webkit.org/show_bug.cgi?id=192050

Summary REGRESSION: Flaky crash in JSC::speculationFromValue(JSC::JSValue)

Truitt Savell

Reported 2018-11-27 16:11:45 PST

The following layout test is crashing on MacOS workers/bomb.html Probable cause: This test is known to timeout on some platforms but is now crashing recently. I was able to reproduce the crashing on tip of tree using command: run-webkit-tests --root testbuild-238565 workers/bomb.html --iterations 500 -f --exit-after-n-crashes 1 I am attempting to find the regression point Flakiness Dashboard: https://webkit-test-results.webkit.org/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=workers%2Fbomb.html crash log: https://build.webkit.org/results/Apple%20Sierra%20Release%20WK2%20(Tests)/r238565%20(13016)/workers/bomb-crash-log.txt

Attachments
Archive of layout-test-results from webkit-cq-02 (2.46 MB, application/zip) 2018-12-03 15:13 PST, WebKit Commit Bot	no flags	Details
Archive of layout-test-results from webkit-cq-02 (2.46 MB, application/zip) 2018-12-03 21:46 PST, WebKit Commit Bot	no flags	Details
Archive of layout-test-results from webkit-cq-02 (2.57 MB, application/zip) 2018-12-04 09:58 PST, WebKit Commit Bot	no flags	Details
Archive of layout-test-results from webkit-cq-03 (2.52 MB, application/zip) 2018-12-06 13:21 PST, WebKit Commit Bot	no flags	Details
Archive of layout-test-results from webkit-cq-02 (2.84 MB, application/zip) 2018-12-06 14:51 PST, WebKit Commit Bot	no flags	Details
Archive of layout-test-results from webkit-cq-02 (2.47 MB, application/zip) 2018-12-06 17:20 PST, WebKit Commit Bot	no flags	Details
Patch (3.17 KB, patch) 2018-12-07 15:49 PST, Tadeu Zagallo	no flags	Details Formatted Diff Diff
Show Obsolete (6) View All Add attachment proposed patch, testcase, etc.

Truitt Savell

Comment 1 2018-11-27 16:54:04 PST

This test began crashing with r238525. Running the previous command using a spade of 238525 yields a crash eventually. Running this on 238524 yields no crashes.

Truitt Savell

Comment 2 2018-11-27 16:54:28 PST

https://trac.webkit.org/changeset/238525/webkit

Chris Dumez

Comment 3 2018-11-27 16:57:56 PST

Crashed Thread: 39 WebCore: Worker Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000159325 Exception Note: EXC_CORPSE_NOTIFY Termination Signal: Segmentation fault: 11 Termination Reason: Namespace SIGNAL, Code 0xb Terminating Process: exc handler [0] Thread 39 Crashed:: WebCore: Worker 0 com.apple.JavaScriptCore 0x0000000110d59b65 JSC::speculationFromValue(JSC::JSValue) + 213 (SpeculatedType.cpp:477) 1 com.apple.JavaScriptCore 0x0000000110d2c356 JSC::CodeBlock::updateAllPredictionsAndCountLiveness(unsigned int&, unsigned int&) + 4950 (CodeBlock.cpp:2577) 2 com.apple.JavaScriptCore 0x0000000110d26386 JSC::CodeBlock::updateAllPredictions() + 22 (CodeBlock.cpp:2624) 3 com.apple.JavaScriptCore 0x000000011112869c operationOptimize + 348 (JITOperations.cpp:1422) 4 ??? 0x000003fdbb2baff5 0 + 4388301811701 5 com.apple.JavaScriptCore 0x0000000110b382c8 llint_entry + 62053 6 com.apple.JavaScriptCore 0x0000000110b28ea9 vmEntryToJavaScript + 200 7 com.apple.JavaScriptCore 0x00000001110ba4e4 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*) + 11172 (Interpreter.cpp:832) 8 com.apple.JavaScriptCore 0x00000001112f28a3 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 307 (Completion.cpp:106) 9 com.apple.WebCore 0x000000010cf853c4 WebCore::JSExecState::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 84 (JSExecState.h:80) 10 com.apple.WebCore 0x000000010cfcc19c WebCore::WorkerScriptController::evaluate(WebCore::ScriptSourceCode const&, WTF::NakedPtr<JSC::Exception>&, WTF::String*) + 156 (WorkerScriptController.cpp:148) 11 com.apple.WebCore 0x000000010cfcc09c WebCore::WorkerScriptController::evaluate(WebCore::ScriptSourceCode const&, WTF::String*) + 44 (WorkerScriptController.cpp:131) 12 com.apple.WebCore 0x000000010dba40ac WebCore::WorkerThread::workerThread() + 556 (RefPtr.h:69) 13 com.apple.JavaScriptCore 0x000000011096ac34 WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) + 212 (Threading.cpp:137) 14 com.apple.JavaScriptCore 0x000000011096c7d9 WTF::wtfThreadEntryPoint(void*) + 9 (ThreadingPthreads.cpp:203) 15 libsystem_pthread.dylib 0x00007fff9e2db93b _pthread_body + 180 16 libsystem_pthread.dylib 0x00007fff9e2db887 _pthread_start + 286 17 libsystem_pthread.dylib 0x00007fff9e2db08d thread_start + 13 Definitely does not look related to https://trac.webkit.org/changeset/238525/webkit. Adding a few JSC people in cc given where it crashes.

Ryan Haddad

Comment 4 2018-11-28 09:11:20 PST

This test has been flaky for a while, but something definitely made it crash more frequently in the past 2-3 days.

Chris Dumez

Comment 5 2018-11-28 09:14:14 PST

(In reply to Ryan Haddad from comment #4) > This test has been flaky for a while, but something definitely made it crash > more frequently in the past 2-3 days. My patch may impact the how fast you get a new process (by disabling process-prewarming for some clients) but it should not matter here since this test does not create new processes, just dedicated workers.

Radar WebKit Bug Importer

Comment 6 2018-11-28 09:53:52 PST

<rdar://problem/46312674>

Ryan Haddad

Comment 7 2018-11-30 14:40:51 PST

This crash is being hit very frequently by the commit queue with workers/bomb.html as well as various inspector and webGL tests.

Alexey Proskuryakov

Comment 8 2018-12-01 15:56:32 PST

*** Bug 192269 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 9 2018-12-01 15:56:45 PST

*** Bug 192245 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 10 2018-12-01 15:56:52 PST

*** Bug 192244 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 11 2018-12-01 15:57:04 PST

*** Bug 192243 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 12 2018-12-01 15:57:20 PST

*** Bug 192239 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 13 2018-12-01 15:57:40 PST

*** Bug 192238 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 14 2018-12-01 15:57:44 PST

*** Bug 192237 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 15 2018-12-01 15:57:48 PST

*** Bug 192235 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 16 2018-12-01 15:57:52 PST

*** Bug 192225 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 17 2018-12-01 15:57:56 PST

*** Bug 192221 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 18 2018-12-01 15:58:01 PST

*** Bug 192220 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 19 2018-12-01 15:58:18 PST

*** Bug 192219 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 20 2018-12-01 15:58:22 PST

*** Bug 192218 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 21 2018-12-01 15:58:26 PST

*** Bug 192202 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 22 2018-12-01 15:58:53 PST

*** Bug 192199 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 23 2018-12-01 15:59:17 PST

*** Bug 192196 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 24 2018-12-01 15:59:21 PST

*** Bug 192195 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 25 2018-12-01 15:59:25 PST

*** Bug 192194 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 26 2018-12-01 15:59:30 PST

*** Bug 192188 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 27 2018-12-01 15:59:34 PST

*** Bug 192187 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 28 2018-12-01 15:59:38 PST

*** Bug 192186 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 29 2018-12-01 15:59:43 PST

*** Bug 192177 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 30 2018-12-01 16:00:00 PST

*** Bug 192176 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 31 2018-12-01 16:00:03 PST

*** Bug 192146 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 32 2018-12-01 16:00:38 PST

*** Bug 192145 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 33 2018-12-01 16:00:49 PST

*** Bug 192144 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 34 2018-12-01 16:01:07 PST

*** Bug 192142 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 35 2018-12-01 16:01:10 PST

*** Bug 192141 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 36 2018-12-01 16:01:14 PST

*** Bug 192140 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 37 2018-12-01 16:01:18 PST

*** Bug 192139 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 38 2018-12-01 16:01:24 PST

*** Bug 192125 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 39 2018-12-01 16:01:27 PST

*** Bug 192104 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 40 2018-12-01 16:01:59 PST

*** Bug 192098 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 41 2018-12-01 16:02:02 PST

*** Bug 192103 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 42 2018-12-01 16:02:26 PST

*** Bug 192095 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 43 2018-12-01 16:02:30 PST

*** Bug 192096 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 44 2018-12-01 16:03:23 PST

*** Bug 171985 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 45 2018-12-01 16:05:02 PST

*** Bug 192072 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 46 2018-12-01 16:05:14 PST

*** Bug 192065 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 47 2018-12-01 16:05:20 PST

*** Bug 192064 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 48 2018-12-01 16:05:28 PST

*** Bug 192063 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 49 2018-12-01 16:05:35 PST

*** Bug 192058 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 50 2018-12-01 16:06:06 PST

*** Bug 192057 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 51 2018-12-01 16:06:16 PST

*** Bug 192052 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 52 2018-12-01 16:06:24 PST

*** Bug 192051 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 53 2018-12-01 16:06:31 PST

*** Bug 192048 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 54 2018-12-01 16:06:39 PST

*** Bug 192047 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 55 2018-12-01 16:07:05 PST

*** Bug 192043 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 56 2018-12-01 16:07:14 PST

*** Bug 191992 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 57 2018-12-01 16:07:20 PST

*** Bug 191991 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 58 2018-12-03 10:29:38 PST

*** Bug 192311 has been marked as a duplicate of this bug. ***

WebKit Commit Bot

Comment 59 2018-12-03 15:13:42 PST

The commit-queue just saw workers/bomb.html flake (DumpRenderTree crashed) while processing attachment 356402 [details] on bug 192091. Bot: webkit-cq-02 Port: <class 'webkitpy.common.config.ports.MacPort'> Platform: Mac OS X 10.12.6

WebKit Commit Bot

Comment 60 2018-12-03 15:13:43 PST

Created attachment 356414 [details] Archive of layout-test-results from webkit-cq-02

Alexey Proskuryakov

Comment 61 2018-12-03 16:37:18 PST

*** Bug 192339 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 62 2018-12-03 16:37:32 PST

*** Bug 192338 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 63 2018-12-03 16:37:46 PST

*** Bug 192333 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 64 2018-12-03 16:37:54 PST

*** Bug 192332 has been marked as a duplicate of this bug. ***

WebKit Commit Bot

Comment 65 2018-12-03 21:46:18 PST

The commit-queue just saw inspector/unit-tests/event-listener.html flake (DumpRenderTree crashed) while processing attachment 356454 [details] on bug 192346. Bot: webkit-cq-02 Port: <class 'webkitpy.common.config.ports.MacPort'> Platform: Mac OS X 10.12.6

WebKit Commit Bot

Comment 66 2018-12-03 21:46:19 PST

Created attachment 356462 [details] Archive of layout-test-results from webkit-cq-02

WebKit Commit Bot

Comment 67 2018-12-04 09:58:09 PST

The commit-queue just saw workers/bomb.html flake (DumpRenderTree crashed) while processing attachment 356502 [details] on bug 192120. Bot: webkit-cq-02 Port: <class 'webkitpy.common.config.ports.MacPort'> Platform: Mac OS X 10.12.6

WebKit Commit Bot

Comment 68 2018-12-04 09:58:11 PST

Created attachment 356512 [details] Archive of layout-test-results from webkit-cq-02

Alexey Proskuryakov

Comment 69 2018-12-04 13:54:58 PST

*** Bug 192370 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 70 2018-12-04 13:55:33 PST

*** Bug 192368 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 71 2018-12-04 13:55:36 PST

*** Bug 192367 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 72 2018-12-04 13:55:39 PST

*** Bug 192365 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 73 2018-12-04 13:55:43 PST

*** Bug 192364 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 74 2018-12-04 13:55:50 PST

*** Bug 192369 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 75 2018-12-04 13:59:25 PST

*** Bug 192351 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 76 2018-12-04 13:59:34 PST

*** Bug 192350 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 77 2018-12-04 16:49:22 PST

*** Bug 192343 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 78 2018-12-04 16:49:41 PST

*** Bug 192383 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 79 2018-12-04 16:50:25 PST

*** Bug 192382 has been marked as a duplicate of this bug. ***

Simon Fraser (smfr)

Comment 80 2018-12-05 10:16:13 PST

I can hit this crash running https://browserbench.org/Speedometer2.0/?suite=VueJS-TodoMVC&iterationCount=1000

Alexey Proskuryakov

Comment 81 2018-12-05 10:30:34 PST

*** Bug 192399 has been marked as a duplicate of this bug. ***

Ryan Haddad

Comment 82 2018-12-06 09:04:46 PST

*** Bug 192442 has been marked as a duplicate of this bug. ***

Ryan Haddad

Comment 83 2018-12-06 09:05:16 PST

*** Bug 192440 has been marked as a duplicate of this bug. ***

Ryan Haddad

Comment 84 2018-12-06 09:05:55 PST

*** Bug 192423 has been marked as a duplicate of this bug. ***

Ryan Haddad

Comment 85 2018-12-06 09:06:13 PST

*** Bug 192419 has been marked as a duplicate of this bug. ***

WebKit Commit Bot

Comment 86 2018-12-06 13:21:26 PST

The commit-queue just saw workers/bomb.html flake (DumpRenderTree crashed) while processing attachment 356741 [details] on bug 187554. Bot: webkit-cq-03 Port: <class 'webkitpy.common.config.ports.MacPort'> Platform: Mac OS X 10.12.6

WebKit Commit Bot

Comment 87 2018-12-06 13:21:27 PST

Created attachment 356744 [details] Archive of layout-test-results from webkit-cq-03

WebKit Commit Bot

Comment 88 2018-12-06 14:51:13 PST

The commit-queue just saw workers/bomb.html flake (DumpRenderTree crashed) while processing attachment 356748 [details] on bug 192409. Bot: webkit-cq-02 Port: <class 'webkitpy.common.config.ports.MacPort'> Platform: Mac OS X 10.12.6

WebKit Commit Bot

Comment 89 2018-12-06 14:51:15 PST

Created attachment 356758 [details] Archive of layout-test-results from webkit-cq-02

WebKit Commit Bot

Comment 90 2018-12-06 17:20:23 PST

The commit-queue just saw imported/w3c/web-platform-tests/WebCryptoAPI/generateKey/failures_AES-GCM.https.any.html flake (DumpRenderTree crashed) while processing attachment 356762 [details] on bug 192377. Bot: webkit-cq-02 Port: <class 'webkitpy.common.config.ports.MacPort'> Platform: Mac OS X 10.12.6

WebKit Commit Bot

Comment 91 2018-12-06 17:20:24 PST

Created attachment 356768 [details] Archive of layout-test-results from webkit-cq-02

Alexey Proskuryakov

Comment 92 2018-12-07 11:11:31 PST

*** Bug 192475 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 93 2018-12-07 11:11:58 PST

*** Bug 192476 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 94 2018-12-07 11:12:03 PST

*** Bug 192477 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 95 2018-12-07 11:12:46 PST

*** Bug 192488 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 96 2018-12-07 11:12:51 PST

*** Bug 192485 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 97 2018-12-07 11:12:55 PST

*** Bug 192484 has been marked as a duplicate of this bug. ***

Tadeu Zagallo

Comment 98 2018-12-07 15:49:57 PST

Created attachment 356847 [details] Patch

Mark Lam

Comment 99 2018-12-07 15:52:28 PST

Comment on attachment 356847 [details] Patch r=me

WebKit Commit Bot

Comment 100 2018-12-07 17:13:05 PST

Comment on attachment 356847 [details] Patch Clearing flags on attachment: 356847 Committed r238997: <https://trac.webkit.org/changeset/238997>

WebKit Commit Bot

Comment 101 2018-12-07 17:13:08 PST

All reviewed patches have been landed. Closing bug.

Saam Barati

Comment 102 2018-12-07 18:17:51 PST

Comment on attachment 356847 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=356847&action=review > Source/JavaScriptCore/ChangeLog:9 > + Although certain platforms don't require the metadata to be aligned, a nit on wording here -- I think the point here is actually more of: - Some platforms don't trap on unaligned accesses - However, *all platforms need* this because no platform we support is atomic on unaligned accesses. Otherwise, we may observe tearing which can lead us to crash. - This patch aligns all metadata. > Source/JavaScriptCore/bytecode/Opcode.cpp:-196 > -#if CPU(NEEDS_ALIGNED_ACCESS) Not pertinent to this patch, but we should really rename this #define. "Needs" is a super convoluted word in this context. "Needs" depends on the workload. We should probably have something along the lines of CPU(TRAPS_ON_UNALIGNED_ACCESSES)

Alexey Proskuryakov

Comment 103 2018-12-10 13:55:56 PST

*** Bug 192506 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 104 2018-12-10 13:56:01 PST

*** Bug 192505 has been marked as a duplicate of this bug. ***

Michael Catanzaro

Comment 105 2018-12-20 19:49:32 PST

*** Bug 192882 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.