Bug 234004 – Crash issue observed in JIT operationOptimize method

• Status: NEW
• Component: JavaScriptCore

[Bharanitharan]

We have faced the crash issue in JIT compiler while continuous playback the OnDemand content we have used webkit v1.16.5 in ARM platform, the caller stack of the crash pointer API name is operationOptimize .We could not able to debug this issue due to continuously hit the callback from different caller. We suspect any CFLAGS need to be additionally added for that ?
Kindly provide the solution for this issue.

[Radar WebKit Bug Importer]

<rdar://problem/86523188>

[Smoley]

Thanks for filing, can you please provide a test case or a crash log?

[Bharanitharan]

#1 We have observed crash issue while performed the continuous playback(around 20mins) in an ondemand application.
#2 The exception raised from JIT optimization, points the exact caller stack as operationOptimize().
#3 We are currently using the Webkit v2.16.5 in ARM 32Bit architecture and using DFG_JIT instead of FTL_JIT.
#4 We could not able to trace it further due to optimization callback continuously triggered from different caller. So could anyone support me to narrow down the root cause for this issue.

[Bharanitharan]

(In reply to Smoley from comment #2)
> Thanks for filing, can you please provide a test case or a crash log?

Ok, Thanks for your kind reply, I will share it by tomorrow.

[Yusuke Suzuki]

OK, this is an issue in ARMv7 32bit (note that this is maintained by Igalia since Apple does not use 32bit JIT).

[Bharanitharan]

(In reply to Yusuke Suzuki from comment #5)
> OK, this is an issue in ARMv7 32bit (note that this is maintained by Igalia
> since Apple does not use 32bit JIT).

From your comment, we understood this issue is specific to ARMv7 32Bit architecture? Whether there is any resolution for this issue? Please kindly help.

[Yusuke Suzuki]

(In reply to Bharanitharan from comment #6)
> (In reply to Yusuke Suzuki from comment #5)
> > OK, this is an issue in ARMv7 32bit (note that this is maintained by Igalia
> > since Apple does not use 32bit JIT).
> 
> From your comment, we understood this issue is specific to ARMv7 32Bit
> architecture? Whether there is any resolution for this issue? Please kindly
> help.

I mean, Igalia folks can look into it.

[Bharanitharan]

(In reply to Bharanitharan from comment #4)
> (In reply to Smoley from comment #2)
> > Thanks for filing, can you please provide a test case or a crash log?
> 
> Ok, Thanks for your kind reply, I will share it by tomorrow.


We have attached the crash log for your reference:
In crash issue observed case we have faced the below prints are continuously running so could you please help to find the root cause of this issue.

JITInlines.h 157> Entry appendCallWithExceptionCheck
AssemblyHelpers.cpp 389> Entry emitExceptionCheck 
AssemblyHelpers.cpp 319> Entry callExceptionFuzz

Crash Log:
+++++++++++
Thread 18 "WebkitBrowser" received signal SIGSEGV, Segmentation fault
[Switching to LWP1802]

0x8a073860 in  ?? ()

(gdb) bt
#0  0x8a073860	in ?? ()
#1  0x019d4df0	in operationOptimize()
#2  0xfffffffa	in ?? ()

Backtrace Stopped : Previous frame identical to this frame (Corrupt stack?)