<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Overflow crash in CodeBlock::getArrayProfile under ::FixupPhase::attemptToMakeGetArrayLength running inspector tests under heavy system load"
href="https://bugs.webkit.org/show_bug.cgi?id=147741">147741</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Overflow crash in CodeBlock::getArrayProfile under ::FixupPhase::attemptToMakeGetArrayLength running inspector tests under heavy system load
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>528+ (Nightly build)
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>OS</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>JavaScriptCore
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>joepeck@webkit.org
</td>
</tr>
<tr>
<th>CC</th>
<td>ap@webkit.org, fpizlo@apple.com, ggaren@apple.com, msaboff@apple.com, webkit-bug-importer@group.apple.com
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=258386" name="attach_258386" title="[CRASH] Crash Report">attachment 258386</a> <a href="attachment.cgi?id=258386&action=edit" title="[CRASH] Crash Report">[details]</a></span>
[CRASH] Crash Report
* SUMMARY
Overflow crash in CodeBlock::getArrayProfile under ::FixupPhase::attemptToMakeGetArrayLength running inspector tests under heavy system load.
I was at WebKit r188015.
* STEPS TO REPRODUCE
1. shell> run-webkit-tests --release inspector/dom --iterations=1000 --v
=> saw this crash happen 3 out of 10000 times, presumably on the Web Inspector process, causing 3 timeout failures (each on different inspector/dom tests)
* NOTES
The only times I saw the crashes happen were when the system was under heavy load (I was compiling a debug build of WebKit while the tests were running).
* CRASH SNIPPET (full log attached)
Crashed Thread: 14 DFG Worklist Worker Thread
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x00000000bbadbeef
Thread 14 Crashed:: DFG Worklist Worker Thread
0 com.apple.JavaScriptCore 0x000000010f3e2a1e WTFCrash + 62
1 com.apple.JavaScriptCore 0x000000010edab849 WTF::CrashOnOverflow::crash() + 9
2 com.apple.JavaScriptCore 0x000000010edab839 WTF::CrashOnOverflow::overflowed() + 9
3 com.apple.JavaScriptCore 0x000000010ee0691f JSC::CodeBlock::getArrayProfile(unsigned int) + 111
4 com.apple.JavaScriptCore 0x000000010eef8c25 JSC::DFG::FixupPhase::attemptToMakeGetArrayLength(JSC::DFG::Node*) + 165
5 com.apple.JavaScriptCore 0x000000010eef22aa JSC::DFG::FixupPhase::fixupNode(JSC::DFG::Node*) + 12618
6 com.apple.JavaScriptCore 0x000000010eeeddc9 JSC::DFG::FixupPhase::run() + 121
7 com.apple.JavaScriptCore 0x000000010eeedc71 bool JSC::DFG::runPhase<JSC::DFG::FixupPhase>(JSC::DFG::Graph&) + 113
8 com.apple.JavaScriptCore 0x000000010eeedba9 JSC::DFG::performFixup(JSC::DFG::Graph&) + 9
9 com.apple.JavaScriptCore 0x000000010ef60871 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) + 625
10 com.apple.JavaScriptCore 0x000000010ef602e5 JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) + 565
11 com.apple.JavaScriptCore 0x000000010eff97c1 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) + 545
12 com.apple.JavaScriptCore 0x000000010f4106c3 WTF::threadEntryPoint(void*) + 179
13 com.apple.JavaScriptCore 0x000000010f410b2f WTF::wtfThreadEntryPoint(void*) + 15
14 libsystem_pthread.dylib 0x00007fff8a56405a _pthread_body + 131
15 libsystem_pthread.dylib 0x00007fff8a563fd7 _pthread_start + 176
16 libsystem_pthread.dylib 0x00007fff8a5613ed thread_start + 13</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>