Bug 222358 – SIGILL crash in JSC::operationLinkCall

• Status: RESOLVED
• Resolution: DUPLICATE
• Component: JavaScriptCore

[Dennis Nezic]

These sites:

  https://www.nyse.com/quote/index/SPX
  https://community.ui.com/

cause kernel traps, like:

  kernel: traps: WebKitWebProces[19538] trap invalid opcode ip:7f1fc039e0e5 sp:7fff970dc810 error:0

I don't think these sites were ever able to work with webkit-gtk, including the latest stable 2.30.5. Do they work for anyone else?

[Carlos Garcia Campos]

Both work for me

[Dennis Nezic]

Fascinating! You're using webkit-gtk 2.30.5?

[Carlos Garcia Campos]

What's your hardware? Can you try running the program with JavaScriptCoreUseJIT=0?

[Dennis Nezic]

Yes!! Exporting that environment variable worked! Awesome.

[Carlos Garcia Campos]

That means it's JSC bug. Could you provide details about your hardware? It would help jsc developers to find the problem.

[Jernej Jakob]

Created attachment 421549 [details]
backtrace of the crashed thread

Backtrace of the crashing thread. This is what I could get on my machine with only 8GB RAM. Trying to get a backtrace of all threads made gdb run out of memory. Some things are missing, I'm not sure why.

[Radar WebKit Bug Importer]

<rdar://problem/74984105>

[Jernej Jakob]

(In reply to Jernej Jakob from comment #6)
> Created attachment 421549 [details]
> backtrace of the crashed thread
> 
> Backtrace of the crashing thread. This is what I could get on my machine
> with only 8GB RAM. Trying to get a backtrace of all threads made gdb run out
> of memory. Some things are missing, I'm not sure why.

The backtrace has problems, probably because I still had -O2 on my flags. Since the workaround was found I won't be debugging this myself any more. If anyone wants to debug this on Gentoo, in addition to the general debugging process described in the Gentoo Handbook, he can try to add -Og to his CFLAGS/CXXFLAGS using package.env, or use another way to override his global compiler flags before rebuilding.

[Carlos Garcia Campos]

The only JSC change in 2.30.5 is bug #219288. I don't know if that's related, though

[Michael Catanzaro]

That could be related if this is on aarch64. I doubt it. :P

[Michael Catanzaro]

I can't reproduce with 2.30.5 or with 2.31.91.

[Michael Catanzaro]

Carlos suspects bug #222805, unlikely but possible. What is your CPU model?

[Carlos Garcia Campos]

(In reply to Michael Catanzaro from comment #12)
> Carlos suspects bug #222805, unlikely but possible. What is your CPU model?

Only because this was reported for 2.30.5 and that's the only jsc change in that version.

[Dennis Nezic]

I'm on x86_64 (no sse4)

[Michael Catanzaro]

Wow.

OK, for final confirmation, you could run: (gdb) layout asm. But I guess this is very likely bug #222805. That bug is newer, but it also has proof.

*** This bug has been marked as a duplicate of bug 222805 ***

[Jernej Jakob]

My system is a Core 2 Quad without SSE4 as well, which would add weight that this is the bug. I've looked through my merge history and the bug was present since the beginning (since I installed webkit-gtk), on versions 2.28.4, 2.30.3, 2.30.5.