117605 2013-06-13 11:09:43 -0700 [ARM] Assertion failure on maps.google.com 2013-06-14 00:09:50 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified All UNCONFIRMED P2 Normal --- 108645 0 ctruta webkit-unassigned fpizlo oliver ossy rgabor zherczeg oldest_to_newest 900226 0 ctruta 2013-06-13 11:09:43 -0700 The following failure occurs on Linux (tested on armel/Qt) and on QNX ARM, while loading the desktop version of Google Maps: ASSERTION FAILED: !(forNode(edge).m_type & ~typeFilterFor(edge.useKind())) ~/WebKit/Source/JavaScriptCore/dfg/DFGAbstractState.cpp(263) : void JSC::DFG::AbstractState::verifyEdge(JSC::DFG::Node*, JSC::DFG::Edge) Program received signal SIGSEGV, Segmentation fault. 0x73e8249a in WTFCrash () from ~/WebKit/WebKitBuild/Debug/lib/libWTF.so.1 (gdb) bt #0 0x73e8249a in WTFCrash () from ~/WebKit/WebKitBuild/Debug/lib/libWTF.so.1 #1 0x73893218 in JSC::DFG::AbstractState::verifyEdge (this=0x7effcd18, edge=...) at ~/WebKit/Source/JavaScriptCore/dfg/DFGAbstractState.cpp:263 #2 0x73893342 in JSC::DFG::AbstractState::verifyEdges (this=0x7effcd18, node=0x6ec70688) at ~/WebKit/Source/JavaScriptCore/dfg/DFGAbstractState.cpp:268 #3 0x7389341c in JSC::DFG::AbstractState::executeEffects (this=0x7effcd18, indexInBlock=18, node=0x6ec70688) at ~/WebKit/Source/JavaScriptCore/dfg/DFGAbstractState.cpp:274 #4 0x73897b26 in JSC::DFG::AbstractState::executeEffects (this=0x7effcd18, indexInBlock=18) at ~/WebKit/Source/JavaScriptCore/dfg/DFGAbstractState.cpp:1569 #5 0x7391bbc8 in JSC::DFG::SpeculativeJIT::compile (this=0x7effc800, block=...) at ~/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:1833 #6 0x7391c0c4 in JSC::DFG::SpeculativeJIT::compile (this=0x7effc800) at ~/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:1913 #7 0x738ef5a4 in JSC::DFG::JITCompiler::compileBody (this=0x7effdb70, speculative=...) at ~/WebKit/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp:108 #8 0x738f03ac in JSC::DFG::JITCompiler::compileFunction (this=0x7effdb70, entry=..., entryWithArityCheck=...) at ~/WebKit/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp:302 #9 0x738e0f9c in JSC::DFG::compile (compileMode=JSC::DFG::CompileFunction, exec=0x70b98de0, codeBlock=0xcd3188, jitCode=..., jitCodeWithArityCheck=0x6ea4a0c4, osrEntryBytecodeIndex=0) at ~/WebKit/Source/JavaScriptCore/dfg/DFGDriver.cpp:164 #10 0x738e092c in JSC::DFG::tryCompileFunction (exec=0x70b98de0, codeBlock=0xcd3188, jitCode=..., jitCodeWithArityCheck=..., bytecodeIndex=0) at ~/WebKit/Source/JavaScriptCore/dfg/DFGDriver.cpp:182 #11 0x73a3df06 in JSC::jitCompileFunctionIfAppropriate (exec=0x70b98de0, codeBlock=..., jitCode=..., jitCodeWithArityCheck=..., jitType=JSC::JITCode::DFGJIT, bytecodeIndex=0, effort=JSC::JITCompilationCanFail) at ~/WebKit/Source/JavaScriptCore/jit/JITDriver.h:95 #12 0x73a3e112 in JSC::prepareFunctionForExecution (exec=0x70b98de0, codeBlock=..., jitCode=..., jitCodeWithArityCheck=..., jitType=JSC::JITCode::DFGJIT, bytecodeIndex=0, kind=JSC::CodeForCall) at ~/WebKit/Source/JavaScriptCore/runtime/ExecutionHarness.h:68 #13 0x73a3c994 in JSC::FunctionExecutable::compileForCallInternal (this=0x6ea4a098, exec=0x70b98de0, scope=0x6ed1efb8, jitType=JSC::JITCode::DFGJIT, bytecodeIndex=0) at ~/WebKit/Source/JavaScriptCore/runtime/Executable.cpp:539 #14 0x73a3c39a in JSC::FunctionExecutable::compileOptimizedForCall (this=0x6ea4a098, exec=0x70b98de0, scope=0x6ed1efb8, bytecodeIndex=0) at ~/WebKit/Source/JavaScriptCore/runtime/Executable.cpp:464 #15 0x737f5912 in JSC::FunctionExecutable::compileOptimizedFor (this=0x6ea4a098, exec=0x70b98de0, scope=0x6ed1efb8, bytecodeIndex=0, kind=JSC::CodeForCall) at ~/WebKit/Source/JavaScriptCore/runtime/Executable.h:679 #16 0x737f00ec in JSC::FunctionCodeBlock::compileOptimized (this=0xbdcb80, exec=0x70b98de0, scope=0x6ed1efb8, bytecodeIndex=0) at ~/WebKit/Source/JavaScriptCore/bytecode/CodeBlock.cpp:2843 #17 0x739a7e8c in JSC::JITStubThunked_optimize (args=0x7effe138) at ~/WebKit/Source/JavaScriptCore/jit/JITStubs.cpp:1964 #18 0x739a7dcc in cti_optimize () at ~/WebKit/Source/JavaScriptCore/jit/JITStubs.cpp:1895 #19 0x739a5894 in JSC::tryCacheGetByID (callFrame=0x7effe1e8, codeBlock=0x6ee0920c, returnAddress=..., baseValue=..., propertyName=..., slot=..., stubInfo=0x0) at ~/WebKit/Source/JavaScriptCore/jit/JITStubs.cpp:1068 #20 0x00000000 in ?? () 900228 1 ctruta 2013-06-13 11:10:21 -0700 Here are my findings so far: The error was introduced in http://trac.webkit.org/changeset/143654 The effect did not show up right away, however. It only became obvious after the fix http://trac.webkit.org/changeset/145828 Could this be a regression of r143654? Or, is it rather that r145828 wasn't quite the right fix? I will appreciate any help with this.