Bug 92691 - Crashes in dfgBuildPutByIdList when clicking on just about anything on Google Maps
Summary: Crashes in dfgBuildPutByIdList when clicking on just about anything on Google...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac (Intel) OS X 10.7
: P1 Major
Assignee: Filip Pizlo
URL: http://maps.google.com
Keywords:
Depends on: 93157
Blocks:
  Show dependency treegraph
 
Reported: 2012-07-30 16:37 PDT by Wade
Modified: 2012-08-03 18:05 PDT (History)
2 users (show)

See Also:


Attachments
dump of crash log (15.83 KB, application/zip)
2012-07-30 16:38 PDT, Wade
no flags Details
latest crash log (15.42 KB, application/zip)
2012-08-02 15:22 PDT, Wade
no flags Details
the patch (18.67 KB, patch)
2012-08-03 17:41 PDT, Filip Pizlo
mhahnenberg: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Wade 2012-07-30 16:37:35 PDT
As above, plus, the damn thing crashed when I attempted to log this bug! I'm using the release Safari to do this now. Possible extension conflict.
Comment 1 Wade 2012-07-30 16:38:23 PDT
Created attachment 155395 [details]
dump of crash log
Comment 2 Alexey Proskuryakov 2012-07-31 10:34:36 PDT
0   com.apple.JavaScriptCore      	0x0000000107c57140 JSC::DFG::dfgBuildPutByIdList(JSC::ExecState*, JSC::JSValue, JSC::Identifier const&, JSC::PutPropertySlot const&, JSC::StructureStubInfo&, JSC::PutKind) + 448
1   com.apple.JavaScriptCore      	0x0000000107c4bf01 operationPutByIdStrictBuildListWithReturnAddress + 241
2   ???                           	0x00004aac23e85bbd 0 + 82103197260733
3   com.apple.JavaScriptCore      	0x0000000107cb87f4 JSC::Interpreter::execute(JSC::EvalExecutable*, JSC::ExecState*, JSC::JSValue, JSC::ScopeChainNode*, int) + 1140

> I'm using the release Safari to do this now.

The crash on Google Maps appears to be a nightly-only issue, I suspect that the crash you got in released Safari/WebKit was different.
Comment 3 Wade 2012-08-02 08:20:18 PDT
new nightly does not fix this problem. Version 6.0 (7536.25, 537+)
Comment 4 Filip Pizlo 2012-08-02 13:47:47 PDT
I cannot repro in a debug build.  Trying release.
Comment 5 Filip Pizlo 2012-08-02 14:07:23 PDT
I cannot reproduce in a release build of r124487.  I was able to click on all sorts of things, get directions, etc.

Do you have any extensions installed?  Can you give more specific repro steps?

Alexey, were you ever able to reproduce this?
Comment 6 Wade 2012-08-02 15:11:43 PDT
I have several extensions installed. I've disabled them and used the most recent nightly and still got the crash.
Comment 7 Filip Pizlo 2012-08-02 15:13:47 PDT
(In reply to comment #6)
> I have several extensions installed. I've disabled them and used the most recent nightly and still got the crash.

Can you give me a specific set of actions that will lead to a crash?  I'd really like to fix this, but I currently cannot cause the crash to happen at all.  The title implies that I can "click on just about anything".  I've clicked on various things that I can think to click on, but none of them result in crashes.
Comment 8 Wade 2012-08-02 15:18:25 PDT
"I suspect that the crash you got in released Safari/WebKit was different."

I did not get a crash in the Safari release. Only in the nightly. And now there have been three nightlies released which all have the crash. The crash log looks similar to me so I haven't attached any new ones.
Comment 9 Wade 2012-08-02 15:20:42 PDT
"I suspect that the crash you got in released Safari/WebKit was different."

I did not get a crash in the Safari release. Only in the nightly. And now there have been three nightlies released which all have the crash. The crash log looks similar to me so I haven't attached any new ones.
Comment 10 Wade 2012-08-02 15:22:03 PDT
Created attachment 156180 [details]
latest crash log
Comment 11 Wade 2012-08-02 15:23:03 PDT
often simply navigating to maps.google.com will cause the crash.
Comment 12 Wade 2012-08-02 15:24:28 PDT
(In reply to comment #7)
> (In reply to comment #6)
> > I have several extensions installed. I've disabled them and used the most recent nightly and still got the crash.
> 
> Can you give me a specific set of actions that will lead to a crash?  I'd really like to fix this, but I currently cannot cause the crash to happen at all.  The title implies that I can "click on just about anything".  I've clicked on various things that I can think to click on, but none of them result in crashes.

I'm baffled that you don't get the crash. Simply opening maps.google.com will cause it sometimes.
Comment 13 Wade 2012-08-03 07:46:59 PDT
newest nightly also crashes, just by opening maps.google.com
Comment 14 Alexey Proskuryakov 2012-08-03 13:07:19 PDT
I can reproduce this. With a debug build and GuardMalloc, the stack trace is:

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x000000010c604d98 JSC::DFG::Node::child1() + 24 (DFGNode.h:805)
1   com.apple.JavaScriptCore      	0x000000010c94526d JSC::DFG::StructureCheckHoistingPhase::run() + 7197 (DFGStructureCheckHoistingPhase.cpp:366)
2   com.apple.JavaScriptCore      	0x000000010c9433b5 bool JSC::DFG::runAndLog<JSC::DFG::StructureCheckHoistingPhase>(JSC::DFG::StructureCheckHoistingPhase&) + 21 (DFGPhase.h:83)
3   com.apple.JavaScriptCore      	0x000000010c943345 bool JSC::DFG::runPhase<JSC::DFG::StructureCheckHoistingPhase>(JSC::DFG::Graph&) + 37 (DFGPhase.h:95)
4   com.apple.JavaScriptCore      	0x000000010c9431f8 JSC::DFG::performStructureCheckHoisting(JSC::DFG::Graph&) + 40 (DFGStructureCheckHoistingPhase.cpp:473)
5   com.apple.JavaScriptCore      	0x000000010c645179 JSC::DFG::compile(JSC::DFG::CompileMode, JSC::ExecState*, JSC::CodeBlock*, JSC::JITCode&, JSC::MacroAssemblerCodePtr*) + 809 (DFGDriver.cpp:105)
6   com.apple.JavaScriptCore      	0x000000010c644e44 JSC::DFG::tryCompileFunction(JSC::ExecState*, JSC::CodeBlock*, JSC::JITCode&, JSC::MacroAssemblerCodePtr&) + 52 (DFGDriver.cpp:145)
Comment 15 Filip Pizlo 2012-08-03 14:15:50 PDT
(In reply to comment #14)
> I can reproduce this. With a debug build and GuardMalloc, the stack trace is:
> 
> Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
> 0   com.apple.JavaScriptCore          0x000000010c604d98 JSC::DFG::Node::child1() + 24 (DFGNode.h:805)
> 1   com.apple.JavaScriptCore          0x000000010c94526d JSC::DFG::StructureCheckHoistingPhase::run() + 7197 (DFGStructureCheckHoistingPhase.cpp:366)
> 2   com.apple.JavaScriptCore          0x000000010c9433b5 bool JSC::DFG::runAndLog<JSC::DFG::StructureCheckHoistingPhase>(JSC::DFG::StructureCheckHoistingPhase&) + 21 (DFGPhase.h:83)
> 3   com.apple.JavaScriptCore          0x000000010c943345 bool JSC::DFG::runPhase<JSC::DFG::StructureCheckHoistingPhase>(JSC::DFG::Graph&) + 37 (DFGPhase.h:95)
> 4   com.apple.JavaScriptCore          0x000000010c9431f8 JSC::DFG::performStructureCheckHoisting(JSC::DFG::Graph&) + 40 (DFGStructureCheckHoistingPhase.cpp:473)
> 5   com.apple.JavaScriptCore          0x000000010c645179 JSC::DFG::compile(JSC::DFG::CompileMode, JSC::ExecState*, JSC::CodeBlock*, JSC::JITCode&, JSC::MacroAssemblerCodePtr*) + 809 (DFGDriver.cpp:105)
> 6   com.apple.JavaScriptCore          0x000000010c644e44 JSC::DFG::tryCompileFunction(JSC::ExecState*, JSC::CodeBlock*, JSC::JITCode&, JSC::MacroAssemblerCodePtr&) + 52 (DFGDriver.cpp:145)

This appears to be a separate bug, since prior to http://trac.webkit.org/changeset/124404 we didn't even have this code.  Creating a separate bug 93157.
Comment 16 Alexey Proskuryakov 2012-08-03 15:49:26 PDT
Oh well. So, new debug crash is:


ASSERTION FAILED: stubInfo.accessType == access_put_by_id_replace || stubInfo.accessType == access_put_by_id_transition_normal || stubInfo.accessType == access_put_by_id_transition_direct
/Users/ap/Safari/OpenSource/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.cpp(105) : static JSC::PolymorphicPutByIdList *JSC::PolymorphicPutByIdList::from(JSC::PutKind, JSC::StructureStubInfo &, JSC::MacroAssemblerCodePtr)
1   0x105220cf8 JSC::PolymorphicPutByIdList::from(JSC::PutKind, JSC::StructureStubInfo&, JSC::MacroAssemblerCodePtr)
2   0x104f92dd2 _ZN3JSC3DFGL19tryBuildPutByIdListEPNS_9ExecStateENS_7JSValueERKNS_10IdentifierERKNS_15PutPropertySlotERNS_17StructureStubInfoENS_7PutKindE
3   0x104f92bc5 JSC::DFG::dfgBuildPutByIdList(JSC::ExecState*, JSC::JSValue, JSC::Identifier const&, JSC::PutPropertySlot const&, JSC::StructureStubInfo&, JSC::PutKind)
4   0x104f7dfa2 operationPutByIdStrictBuildListWithReturnAddress
5   0x10c30c14d
6   0x1050284c4 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*)
7   0x10502522f JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
Comment 17 Filip Pizlo 2012-08-03 17:41:29 PDT
Created attachment 156489 [details]
the patch
Comment 18 Mark Hahnenberg 2012-08-03 17:47:22 PDT
Comment on attachment 156489 [details]
the patch

r=me
Comment 19 Filip Pizlo 2012-08-03 18:05:37 PDT
Landed in http://trac.webkit.org/changeset/124678.

I'm closing this bug, but I'm relying on you guys to repro since I could never repro on my machine.  Please reopen if I failed to fix it!