JavaScript interpreter crash issue (2.0.1-development).

[asowani]

Hi!

I am porting PhantomJS to IBM Power8 platform (ppc64le). I resolved the breakpad dependency for ppc64le and could compile PhantomJS (2.0.1-development). The resulting binary works just with --version and --help options. If I start it in a stand-alone mode or with a javascript (e.g. bin/phantomjs examples/hello.js), it crashes. I debugged this issue and found that JavaScript interpreter is crashing while doing "pushFrame". The complete function stack obtained using gdb is as follows:

(gdb) set language c++
(gdb) run -dograb
Starting program: /root/junk/phantomjs/bin/phantomjs -dograb
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/powerpc64le-linux-gnu/libthread_db.so.1".
ASSERTION FAILED: isPageAligned(size)
../WTF/wtf/PageReservation.h(81) : void WTF::PageReservation::commit(void*, size_t)
1 0x12b4666c /root/junk/phantomjs/bin/phantomjs() [0x12b4666c]
2 0x12831558 /root/junk/phantomjs/bin/phantomjs() [0x12831558]
3 0x1282b218 /root/junk/phantomjs/bin/phantomjs() [0x1282b218]
4 0x12829564 /root/junk/phantomjs/bin/phantomjs() [0x12829564]
5 0x129434b8 /root/junk/phantomjs/bin/phantomjs() [0x129434b8]
6 0x10206604 /root/junk/phantomjs/bin/phantomjs() [0x10206604]
7 0x102070a0 /root/junk/phantomjs/bin/phantomjs() [0x102070a0]
8 0x101ec4dc /root/junk/phantomjs/bin/phantomjs() [0x101ec4dc]
9 0x101b4000 /root/junk/phantomjs/bin/phantomjs() [0x101b4000]
10 0x100e5d94 /root/junk/phantomjs/bin/phantomjs() [0x100e5d94]
11 0x1005b598 /root/junk/phantomjs/bin/phantomjs() [0x1005b598]
12 0x1005b8d8 /root/junk/phantomjs/bin/phantomjs() [0x1005b8d8]
13 0x100d6770 /root/junk/phantomjs/bin/phantomjs() [0x100d6770]
14 0x13a6be88 /root/junk/phantomjs/bin/phantomjs() [0x13a6be88]
15 0x13a6b3c8 /root/junk/phantomjs/bin/phantomjs() [0x13a6b3c8]
16 0x100e3bfc /root/junk/phantomjs/bin/phantomjs() [0x100e3bfc]
17 0x10182234 /root/junk/phantomjs/bin/phantomjs() [0x10182234]
18 0x104c51c0 /root/junk/phantomjs/bin/phantomjs() [0x104c51c0]
19 0x102048d0 /root/junk/phantomjs/bin/phantomjs() [0x102048d0]
20 0x10206f90 /root/junk/phantomjs/bin/phantomjs() [0x10206f90]
21 0x102070a0 /root/junk/phantomjs/bin/phantomjs() [0x102070a0]
22 0x101ec4dc /root/junk/phantomjs/bin/phantomjs() [0x101ec4dc]
23 0x101b4000 /root/junk/phantomjs/bin/phantomjs() [0x101b4000]
24 0x100e5d94 /root/junk/phantomjs/bin/phantomjs() [0x100e5d94]
25 0x10094788 /root/junk/phantomjs/bin/phantomjs() [0x10094788]
26 0x10093e7c /root/junk/phantomjs/bin/phantomjs() [0x10093e7c]
27 0x1004458c /root/junk/phantomjs/bin/phantomjs() [0x1004458c]
28 0x1006cfec /root/junk/phantomjs/bin/phantomjs() [0x1006cfec]
29 0x3fffb70f3500 /lib/powerpc64le-linux-gnu/libc.so.6(+0x23500) [0x3fffb70f3500]
30 0x3fffb70f3734 /lib/powerpc64le-linux-gnu/libc.so.6(__libc_start_main+0xb4) [0x3fffb70f3734]
[New Thread 0x3fffb51bf170 (LWP 24300)]
[New Thread 0x3fffb59df170 (LWP 24299)]

Program received signal SIGSEGV, Segmentation fault.
0x0000000012b46688 in WTFCrash ()
(gdb) bt
#0 0x0000000012b46688 in WTFCrash ()
#1 0x0000000012831558 in JSC::JSStack::growSlowCase(JSC::Register*) ()
#2 0x000000001282b218 in JSC::JSStack::pushFrame(JSC::ExecState_, JSC::CodeBlock_, JSC::JSScope_, int, JSC::JSObject_) ()
#3 0x0000000012829564 in JSC::Interpreter::execute(JSC::ProgramExecutable_, JSC::ExecState_, JSC::JSObject*) ()
#4 0x00000000129434b8 in JSC::evaluate(JSC::ExecState_, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue_) ()
#5 0x0000000010206604 in WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld*) ()
#6 0x00000000102070a0 in WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&) ()
#7 0x00000000101ec4dc in WebCore::ScriptController::executeScript(WebCore::ScriptSourceCode const&) ()
#8 0x00000000101b4000 in QWebFrameAdapter::evaluateJavaScript(QString const&, QString const&) ()
#9 0x00000000100e5d94 in QWebFrame::evaluateJavaScript(QString const&, QString const&) ()
#10 0x000000001005b598 in injectCallbacksObjIntoFrame (frame=0x156c08e0, callbacksObject=0x155c3a10) at webpage.cpp:1601
#11 0x000000001005b8d8 in WebPage::setupFrame (this=0x1547ffb0, frame=0x0) at webpage.cpp:1613
#12 0x00000000100d6770 in WebPage::qt_static_metacall (_o=0x1547ffb0, _c=QMetaObject::InvokeMetaMethod, _id=67, _a=0x3fffffffe8e8) at moc_webpage.cpp:519
#13 0x0000000013a6be88 in QMetaObject::activate (sender=0x156c08e0, signalOffset=3, local_signal_index=0, argv=0x0) at kernel/qobject.cpp:3680
#14 0x0000000013a6b3c8 in QMetaObject::activate (sender=0x156c08e0, m=0x153072a8 QWebFrame::staticMetaObject, local_signal_index=0, argv=0x0)

at kernel/qobject.cpp:3546

#15 0x00000000100e3bfc in QWebFramePrivate::didClearWindowObject() ()
#16 0x0000000010182234 in WebCore::FrameLoaderClientQt::dispatchDidClearWindowObjectInWorld(WebCore::DOMWrapperWorld*) ()
#17 0x00000000104c51c0 in WebCore::FrameLoader::dispatchDidClearWindowObjectInWorld(WebCore::DOMWrapperWorld*) ()
#18 0x00000000102048d0 in WebCore::ScriptController::initScript(WebCore::DOMWrapperWorld*) ()
#19 0x0000000010206f90 in WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld*) ()
#20 0x00000000102070a0 in WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&) ()
#21 0x00000000101ec4dc in WebCore::ScriptController::executeScript(WebCore::ScriptSourceCode const&) ()
#22 0x00000000101b4000 in QWebFrameAdapter::evaluateJavaScript(QString const&, QString const&) ()
#23 0x00000000100e5d94 in QWebFrame::evaluateJavaScript(QString const&, QString const&) ()
#24 0x0000000010094788 in REPL::REPL (this=0x157023c0, webframe=0x156c08e0, parent=0x15482b30) at repl.cpp:150
#25 0x0000000010093e7c in REPL::getInstance (webframe=0x156c08e0, parent=0x15482b30) at repl.cpp:78
#26 0x000000001004458c in Phantom::execute (this=0x15482b30) at phantom.cpp:216
#27 0x000000001006cfec in main (argc=1, argv=0x3ffffffff6a8) at main.cpp:68

There is some problem with the memory allocation while pushing frames on the stack. I tried understanding isPageAligned() function, but could not find from where the page size (dwPageSize and/or SYSTEM_INFO structure) is getting initialized. Can somebody comment on where to look for this information? Also any suggestions about porting this JS interpreter to ppc64le (or a new platform)?

The isPageAligned() receives size value as 16384 (0x4000) whereas pagesize is 65536 (0x10000). Before this, the delta requested in JSStack::growSlowCase is 0x4000. What if we always request delta to be 0x10000? To test this, I modified growSlowCase to always set the delta to desired value. However, this did eliminate the isPageAligned() assert, but now the program hangs somewhere in WTF::mult() while dealing with WebCore::InspectorBasicValue::writeJSON().

Additionally, I would like to know more about the page alignment expectations by the JS interpreter.

Thanks,
Atul.

[zackw]

I'm afraid nobody on the PhantomJS team has the kind of in-depth knowledge of the guts of the JavaScript interpreter needed to help you with a port to a new CPU architecture. You will have much better luck discussing this directly with the Webkit developers (https://www.webkit.org/coding/contributing.html, https://lists.webkit.org/mailman/listinfo/webkit-dev) In addition, there is no way we would carry an entire CPU port as a patch; you would need to get this into upstream Webkit anyway before we would pickt it up.

[asowani]

Thank you Zack! I will get in touch with webkit developers.