112067 2013-03-11 14:31:43 -0700 Crash beneath operationCreateInlinedArguments running fast/js/dfg-create-inlined-arguments-in-closure-inline.html (32-bit only) 2013-03-11 15:38:45 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED InRadar P2 Normal --- 1 msaboff msaboff oldest_to_newest 852728 0 msaboff 2013-03-11 14:31:43 -0700 If you run run-webkit-tests --32-bit --debug fast/js, you will get a crash in running fast/js/dfg-create-inlined-arguments-in-closure-inline with a traceback like: ASSERTION FAILED: isCell() /Volumes/Data/src/webkit/Source/JavaScriptCore/runtime/JSCJSValueInlines.h(298) : JSC::JSCell *JSC::JSValue::asCell() const 1 0xfc657 JSC::JSValue::asCell() const 2 0x107a41 JSC::asObject(JSC::JSValue) 3 0x10c805 JSC::Register::function() const 4 0x109acc JSC::ExecState::callee() const 5 0x1dbc7c JSC::InlineCallFrame::calleeForCallFrame(JSC::ExecState*) const 6 0x2b8b8c JSC::Arguments::finishCreation(JSC::ExecState*, JSC::InlineCallFrame*) 7 0x2b7032 JSC::Arguments::create(JSC::JSGlobalData&, JSC::ExecState*, JSC::InlineCallFrame*) 8 0x2b1c6d operationCreateInlinedArguments 9 0x14bbb3e 10 0x3be164 JSC::JITCode::execute(JSC::JSStack*, JSC::ExecState*, JSC::JSGlobalData*) 11 0x3ba5be JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) 12 0x1e50df JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) 13 0x8d6a9 functionLoad(JSC::ExecState*) 14 0x14ba68f 15 0x3be164 JSC::JITCode::execute(JSC::JSStack*, JSC::ExecState*, JSC::JSGlobalData*) 16 0x3ba5be JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) 17 0x1e50df JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) 18 0x8c61e runInteractive(GlobalObject*) 19 0x8b6cc jscmain(int, char**) 20 0x8b4a7 main 21 0x93901725 start It appears that we aren't setting the tag for the inline callee. <rdar://problem/13095042> 852746 1 192565 msaboff 2013-03-11 14:44:02 -0700 Created attachment 192565 Patch 852751 2 192565 ggaren 2013-03-11 14:45:52 -0700 Comment on attachment 192565 Patch r=me 852804 3 msaboff 2013-03-11 15:38:45 -0700 Committed r145417: <http://trac.webkit.org/changeset/145417> 192565 2013-03-11 14:44:02 -0700 2013-03-11 14:45:50 -0700 Patch 112067.patch text/plain 1598 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTQ1NDA1KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBA CisyMDEzLTAzLTExICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIENyYXNoIGJlbmVhdGggb3BlcmF0aW9uQ3JlYXRlSW5saW5lZEFyZ3VtZW50cyBydW5uaW5n IGZhc3QvanMvZGZnLWNyZWF0ZS1pbmxpbmVkLWFyZ3VtZW50cy1pbi1jbG9zdXJlLWlubGluZS5o dG1sICgzMi1iaXQgb25seSkKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i dWcuY2dpP2lkPTExMjA2NworCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgor CisgICAgICAgIFdlIHdlcmVuJ3Qgc2V0dGluZyB0aGUgdGFnIGluIFNldENhbGxlZS4gIFRoZXJl Zm9yZSBzZXQgaXQgdG8gQ2VsbFRhZy4KKworICAgICAgICAqIGRmZy9ERkdTcGVjdWxhdGl2ZUpJ VDMyXzY0LmNwcDoKKyAgICAgICAgKEpTQzo6REZHOjpTcGVjdWxhdGl2ZUpJVDo6Y29tcGlsZSk6 CisKIDIwMTMtMDMtMTEgIE9saXZlciBIdW50ICA8b2xpdmVyQGFwcGxlLmNvbT4KIAogICAgICAg ICBNYWtlIFNlZ21lbnRlZFZlY3RvciBOb25jb3B5YWJsZQpJbmRleDogU291cmNlL0phdmFTY3Jp cHRDb3JlL2RmZy9ERkdTcGVjdWxhdGl2ZUpJVDMyXzY0LmNwcAo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3Vy Y2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1NwZWN1bGF0aXZlSklUMzJfNjQuY3BwCShyZXZpc2lv biAxNDUxNTEpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1NwZWN1bGF0aXZlSklU MzJfNjQuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0zNzQ1LDYgKzM3NDUsNyBAQCB2b2lkIFNwZWN1 bGF0aXZlSklUOjpjb21waWxlKE5vZGUqIG5vZGUpCiAgICAgY2FzZSBTZXRDYWxsZWU6IHsKICAg ICAgICAgU3BlY3VsYXRlQ2VsbE9wZXJhbmQgY2FsbGVlKHRoaXMsIG5vZGUtPmNoaWxkMSgpKTsK ICAgICAgICAgbV9qaXQuc3RvcmVQdHIoY2FsbGVlLmdwcigpLCBKSVRDb21waWxlcjo6cGF5bG9h ZEZvcihzdGF0aWNfY2FzdDxWaXJ0dWFsUmVnaXN0ZXI+KG5vZGUtPmNvZGVPcmlnaW4uc3RhY2tP ZmZzZXQoKSArIHN0YXRpY19jYXN0PGludD4oSlNTdGFjazo6Q2FsbGVlKSkpKTsKKyAgICAgICAg bV9qaXQuc3RvcmUzMihNYWNyb0Fzc2VtYmxlcjo6VHJ1c3RlZEltbTMyKEpTVmFsdWU6OkNlbGxU YWcpLCBKSVRDb21waWxlcjo6dGFnRm9yKHN0YXRpY19jYXN0PFZpcnR1YWxSZWdpc3Rlcj4obm9k ZS0+Y29kZU9yaWdpbi5zdGFja09mZnNldCgpICsgc3RhdGljX2Nhc3Q8aW50PihKU1N0YWNrOjpD YWxsZWUpKSkpOwogICAgICAgICBub1Jlc3VsdChub2RlKTsKICAgICAgICAgYnJlYWs7CiAgICAg fQo=