Bug 2177696

Created attachment 1950222 [details]
Tentative (untested) fix

Description of problem:

Qt's V4 JIT engine generates bad JIT code that corrupts JS stack slots, causing random garbage collector crashes later on. On a vanilla KDE Plasma setup, this can cause plasmashell to sometimes or consistently crash, depending on the alignment of the stars (sometimes sessions are completely unusable). See below for a consistent repro.

Version-Release number of selected component (if applicable): 5.15.8-1.fc37

How reproducible:

Randomly by default, 100% with QV4_MM_AGGRESSIVE_GC=1, never with QV4_FORCE_INTERPRETER=1.

Steps to Reproduce:
1. Start a KDE Plasma session
2. killall plasmashell
3. QV4_MM_AGGRESSIVE_GC=1 plasmashell

Actual results:

plasmashell instantly segfaults

Expected results:

plasmashell does not segfault

Additional info:

Example of the bad JIT code here:

https://social.treehouse.systems/@marcan/110015722134175810

I believe the issue is a missing accumulator save/restore around a call to PushCallContext.

Tentative fix patch is attached (untested). This is generic code, so I think this is actually broken on *all architectures* in principle, it's just that ARM64 got unlucky with the register clobbering and value encoding lottery and ended up with actual crashes.

Upstream should probably audit the whole file to see if there are any other missed accumulator save/restores.

Also identically reproducible on Arch Linux ARM.