WPEWebProcess Crash observed while running benchmark test

[vdinak240]

Crash observed while running https://browserbench.org/ARES-6/
WPEWebProcess hanged and crashed with SIGFPE signal.

Frequency of occurrence is 100%.

webkit version:wpe2.22

Devices tried
Arrisxi6
Pacexi5

Steps to Reproduce

1)Execute

/usr/bin/rdkbrowser2.sh "https://browserbench.org/ARES-6/"

2)In another terminal
open
rdkbrowser2-control
b = rt.locate()
b.evaluateJavaScript('document.getElementById("trigger").click();')

The above statement will trigger the test.

After a few seconds we can observe the crash.

Attaching stack trace
Stackwalk_Result__aug4.txt
Stackwalk_Result_aug5.txt

[guijemont]

I ran the benchmark several times on an rpi3 with wpe-2.22 57bbecb and could not reproduce. Are you able to hook a debugger to get a disassembly of the code around the crash location?

[guijemont]

I ran the benchmark several times on an rpi3 with wpe-2.22 57bbecb and could not reproduce. Are you able to hook a debugger to get a disassembly of the code around the crash location?

...If you are, and the debugger is gdb, I would be interested in the output of:

disassemble $pc-100,$pc+10

I would also like to know if the issue reproduces with the following environments:

1. JSC_useLLInt=false JSC_useJIT=true JSC_useDFGJIT=true
2. JSC_useLLInt=true JSC_useJIT=true JSC_useDFGJIT=false
3. JSC_useLLInt=true JSC_useJIT=false JSC_useDFGJIT=false

Thanks.

[vdinak240]

Issue still reproduces with these environmental variable
JSC_useLLInt=false JSC_useJIT=true JSC_useDFGJIT=true
JSC_useLLInt=true JSC_useJIT=true JSC_useDFGJIT=false
JSC_useLLInt=true JSC_useJIT=false JSC_useDFGJIT=false

[vdinak240]

output of disassemble $pc-100,$pc+10

Core was generated by `/usr/bin/WPEWebProcess 2 22 libWPEBackend-default.so -1'.
Program terminated with signal SIGFPE, Arithmetic exception.
#0 JSC::TypeInfo::mergeInlineTypeFlags ()
at /usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/JavaScriptCore/runtime/JSTypeInfo.h:123
123 /usr/src/debug/wpe-webkit/2.22+gitAUTOINC+686cd2f7df-r0/git/Source/JavaScriptCore/runtime/JSTypeInfo.h: No such file or directory.
[Current thread is 1 (LWP 14063)]
(gdb)
(gdb) disassemble $pc-100,$pc+10
Dump of assembler code from 0xb67424ce to 0xb674253c:
0xb67424ce JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+26: add.w r2, r2, #536870912 ; 0x20000000
0xb67424d2 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+30: sub.w r0, r3, #8
0xb67424d6 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+34: add.w r2, r2, #4294967295 ; 0xffffffff
0xb67424da JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+38: mvn.w r1, #5
0xb67424de JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+42: add.w r3, r3, r2, lsl #3
0xb67424e2 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+46: mov.w r2, #0
0xb67424e6 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+50: strd r2, r1, [r3]
0xb67424ea JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+54: sub.w r3, r3, #8
0xb67424ee JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+58: cmp r0, r3
0xb67424f0 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+60: bne.n 0xb67424e6 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+50
0xb67424f2 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+62: dmb ishst
0xb67424f6 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+66: ldr r1, [r4, #0]
0xb67424f8 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+68: bic.w r1, r1, #1
0xb67424fc JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+72: ldr r0, [r1, #24]
0xb67424fe JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+74: ldrb r2, [r1, #12]
0xb6742500 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+76: cbz r0, 0xb674251e JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+106
0xb6742502 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+78: lsls r3, r2, #27
0xb6742504 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+80: itett mi
0xb6742506 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+82: andmi.w r3, r2, #14
0xb674250a JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+86: ubfxpl r3, r2, #1, #3
0xb674250e JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+90: addmi r3, #10
0xb6742510 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+92: asrmi r3, r3, #1
0xb6742512 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+94: add.w r3, r3, #80 ; 0x50
0xb6742516 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+98: ldr.w r3, [r0, r3, lsl #2]
0xb674251a JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+102: cmp r1, r3
0xb674251c JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+104: beq.n 0xb674259c JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+232
0xb674251e JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+106: mov.w r2, #3
0xb6742522 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+110: mov r0, r5
0xb6742524 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+112: bl 0xb67dc550 <JSC::Structure::nonPropertyTransitionSlow(JSC::VM&, JSC::Structure*, JSC::NonPropertyTransition)>
0xb6742528 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+116: mov r6, r0
---Type to continue, or q to quit---
0xb674252a JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+118: ldr r1, [r6, #8]
0xb674252c JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+120: ldrb r3, [r4, #6]
0xb674252e JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+122: ldrb r2, [r4, #4]
0xb6742530 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+124: str r1, [r4, #0]
=> 0xb6742532 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+126: ldrb r1, [r6, #14]
0xb6742534 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+128: bic.w r3, r3, #127 ; 0x7f
0xb6742538 JSC::JSObject::convertUndecidedToContiguous(JSC::VM&)+132: orr.w r3, r3, r1
End of assembler dump.

[modeveci]

Inactive ticket for long time!

Closing the ticket; if you think it is still relevant and/or valid for the latest version/s. Please do not hesitate to re-open!