122929 2013-10-16 16:58:42 -0700 We need test coverage for just the Baseline JIT 2013-10-16 20:35:30 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 122930 122937 122938 1 fpizlo fpizlo ap barraclough ggaren mark.lam mhahnenberg msaboff oliver sam oldest_to_newest 940588 0 fpizlo 2013-10-16 16:58:42 -0700 Currently we can run tests for just the LLInt very easily, and we're getting better at running tests that are targeted at the DFG and FTL. But the Baseline JIT needs some love, also. 940598 1 214409 fpizlo 2013-10-16 17:21:37 -0700 Created attachment 214409 the patch Note, I will land this after I make sure that all of the tests pass in this configuration. I suspect that I will see failures. 940601 2 fpizlo 2013-10-16 17:28:18 -0700 Sure enough this reveals a crash: mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 12.10-1 The with statment mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: ASSERTION FAILED: !Heap::heap(value) || Heap::heap(value) == Heap::heap(thisObject) mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: /Volumes/Data/primary/OpenSource/Source/JavaScriptCore/runtime/JSObject.cpp(347) : static void JSC::JSObject::put(JSC::JSCell *, JSC::ExecState *, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot &) mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 1 0x10098ffd0 WTFCrash mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 2 0x10075c0cc JSC::JSObject::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 3 0x100552cad JSC::JSValue::put(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 4 0x10054df0e operationPutByIdNonStrictOptimizeWithReturnAddress mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 5 0x4e58cb207457 mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 6 0x1006cad77 JSC::JITCode::execute(JSC::JSStack*, JSC::ExecState*, JSC::VM*) mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 7 0x1006adf8b JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 8 0x10047980f JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 9 0x100365827 runWithScripts(GlobalObject*, WTF::Vector<Script, 0ul, WTF::CrashOnOverflow> const&, bool) mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 10 0x100364f1c jscmain(int, char**) mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 11 0x100364cf6 main mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 12 0x7fff845865fd start mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: test_script_2124: line 2: 7580 Segmentation fault: 11 "$@" /Volumes/Data/primary/OpenSource/WebKitBuild/Debug/jsc --useLLInt\=false --useDFGJIT\=false /Volumes/Data/primary/OpenSource/Source/JavaScriptCore/tests/mozilla/ecma/shell.js 12.10-1.js mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: ERROR: Unexpected exit code: 139 940602 3 fpizlo 2013-10-16 17:29:20 -0700 And another failure: jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: DIFF FAILURE! jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: --- /Volumes/Data/primary/OpenSource/LayoutTests/js/dictionary-prototype-caching-expected.txt 2013-10-01 11:22:42.000000000 -0700 jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: +++ /Volumes/Data/primary/OpenSource/WebKitBuild/Debug/jsc-stress-results/jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint.out 2013-10-16 17:28:57.000000000 -0700 jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: @@ -9,7 +9,7 @@ jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: PASS protoKeys is [1,2,3] jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: PASS testFunction(subclass1) is true jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: PASS testFunction(subclass2) is true jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: -PASS testFunction(subclass2) is true jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: +FAIL testFunction(subclass2) should be true. Was false. jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: PASS successfullyParsed is true jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: TEST COMPLETE 940630 4 fpizlo 2013-10-16 19:48:59 -0700 (In reply to comment #2) > Sure enough this reveals a crash: > > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 12.10-1 The with statment > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: ASSERTION FAILED: !Heap::heap(value) || Heap::heap(value) == Heap::heap(thisObject) > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: /Volumes/Data/primary/OpenSource/Source/JavaScriptCore/runtime/JSObject.cpp(347) : static void JSC::JSObject::put(JSC::JSCell *, JSC::ExecState *, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot &) > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 1 0x10098ffd0 WTFCrash > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 2 0x10075c0cc JSC::JSObject::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 3 0x100552cad JSC::JSValue::put(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 4 0x10054df0e operationPutByIdNonStrictOptimizeWithReturnAddress > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 5 0x4e58cb207457 > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 6 0x1006cad77 JSC::JITCode::execute(JSC::JSStack*, JSC::ExecState*, JSC::VM*) > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 7 0x1006adf8b JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 8 0x10047980f JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 9 0x100365827 runWithScripts(GlobalObject*, WTF::Vector<Script, 0ul, WTF::CrashOnOverflow> const&, bool) > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 10 0x100364f1c jscmain(int, char**) > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 11 0x100364cf6 main > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 12 0x7fff845865fd start > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: test_script_2124: line 2: 7580 Segmentation fault: 11 "$@" /Volumes/Data/primary/OpenSource/WebKitBuild/Debug/jsc --useLLInt\=false --useDFGJIT\=false /Volumes/Data/primary/OpenSource/Source/JavaScriptCore/tests/mozilla/ecma/shell.js 12.10-1.js > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: ERROR: Unexpected exit code: 139 Fix in: https://bugs.webkit.org/show_bug.cgi?id=122937 940642 5 fpizlo 2013-10-16 20:35:30 -0700 Landed in http://trac.webkit.org/changeset/157557 214409 2013-10-16 17:21:37 -0700 2013-10-16 20:26:46 -0700 the patch blah.patch text/plain 2567 fpizlo SW5kZXg6IFRvb2xzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBUb29scy9DaGFuZ2VMb2cJKHJl dmlzaW9uIDE1NzU0MykKKysrIFRvb2xzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwz ICsxLDE1IEBACisyMDEzLTEwLTE2ICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisK KyAgICAgICAgV2UgbmVlZCB0ZXN0IGNvdmVyYWdlIGZvciBqdXN0IHRoZSBCYXNlbGluZSBKSVQK KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEyMjkyOQor CisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorICAgICAgICAKKyAgICAgICAg QWRkcyBuby1MTEludCB2ZXJzaW9ucyBvZiBhbGwgdGVzdHMuIEZvciB0aGUgTW96aWxsYSB0ZXN0 cywgYWxzbyBhZGQgYSBCYXNlbGluZUpJVC1vbmx5CisgICAgICAgIHZhcmlhbnQuCisKKyAgICAg ICAgKiBTY3JpcHRzL3J1bi1qc2Mtc3RyZXNzLXRlc3RzOgorCiAyMDEzLTEwLTE2ICBEYXJpbiBB ZGxlciAgPGRhcmluQGFwcGxlLmNvbT4KIAogICAgICAgICBBZGQgUGFzc1JlZiBhbmQgY3JlYXRl UmVmQ291bnRlZCBzbyB3ZSBjYW4gaW1wcm92ZSBjcmVhdGlvbiBvZiBSZWZDb3VudGVkIG9iamVj dHMKSW5kZXg6IFRvb2xzL1NjcmlwdHMvcnVuLWpzYy1zdHJlc3MtdGVzdHMKPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0gVG9vbHMvU2NyaXB0cy9ydW4tanNjLXN0cmVzcy10ZXN0cwkocmV2aXNpb24gMTU3NTQyKQor KysgVG9vbHMvU2NyaXB0cy9ydW4tanNjLXN0cmVzcy10ZXN0cwkod29ya2luZyBjb3B5KQpAQCAt MzgxLDYgKzM4MSwxMCBAQCBkZWYgcnVuRGVmYXVsdAogICAgIHJ1bigiZGVmYXVsdCIpCiBlbmQK IAorZGVmIHJ1bk5vTExJbnQKKyAgICBydW4oIm5vLWxsaW50IiwgIi0tdXNlTExJbnQ9ZmFsc2Ui KQorZW5kCisKIGRlZiBydW5Ob0NKSVQKICAgICBydW4oIm5vLWNqaXQiLCAiLS1lbmFibGVDb25j dXJyZW50SklUPWZhbHNlIikKIGVuZApAQCAtNDE1LDYgKzQxOSw3IEBAIGVuZAogCiBkZWYgZGVm YXVsdFJ1bgogICAgIHJ1bkRlZmF1bHQKKyAgICBydW5Ob0xMSW50CiAgICAgcnVuQWx3YXlzVHJp Z2dlckNvcHlQaGFzZQogICAgIHJ1bk5vQ0pJVAogICAgIHJ1bkRGR0VhZ2VyCkBAIC00NTcsNiAr NDYyLDEwIEBAIGRlZiBydW5MYXlvdXRUZXN0RGVmYXVsdAogICAgIHJ1bkxheW91dFRlc3Qobmls KQogZW5kCiAKK2RlZiBydW5MYXlvdXRUZXN0Tm9MTEludAorICAgIHJ1bkxheW91dFRlc3QoIm5v LWxsaW50IiwgIi0tdXNlTExJbnQ9ZmFsc2UiKQorZW5kCisKIGRlZiBydW5MYXlvdXRUZXN0Tm9D SklUCiAgICAgcnVuTGF5b3V0VGVzdCgibm8tY2ppdCIsICItLWVuYWJsZUNvbmN1cnJlbnRKSVQ9 ZmFsc2UiKQogZW5kCkBAIC00NjcsNiArNDc2LDcgQEAgZW5kCiAKIGRlZiBkZWZhdWx0UnVuTGF5 b3V0VGVzdAogICAgIHJ1bkxheW91dFRlc3REZWZhdWx0CisgICAgcnVuTGF5b3V0VGVzdE5vTExJ bnQKICAgICBydW5MYXlvdXRUZXN0Tm9DSklUCiAgICAgcnVuTGF5b3V0VGVzdERGR0VhZ2VyTm9D SklUCiBlbmQKQEAgLTUwMSw2ICs1MTEsMTAgQEAgZGVmIHJ1bk1vemlsbGFUZXN0TExJbnQobW9k ZSwgKmV4dHJhRmlsZQogICAgIHJ1bk1vemlsbGFUZXN0KCJsbGludCIsIG1vZGUsIGV4dHJhRmls ZXMsICItLXVzZUpJVD1mYWxzZSIpCiBlbmQKIAorZGVmIHJ1bk1vemlsbGFUZXN0QmFzZWxpbmVK SVQobW9kZSwgKmV4dHJhRmlsZXMpCisgICAgcnVuTW96aWxsYVRlc3QoImJhc2VsaW5lIiwgbW9k ZSwgZXh0cmFGaWxlcywgIi0tdXNlTExJbnQ9ZmFsc2UiLCAiLS11c2VERkdKSVQ9ZmFsc2UiKQor ZW5kCisKIGRlZiBydW5Nb3ppbGxhVGVzdERGR0VhZ2VyTm9DSklUKG1vZGUsICpleHRyYUZpbGVz KQogICAgIHJ1bk1vemlsbGFUZXN0KCJkZmctZWFnZXItbm8tY2ppdCIsIG1vZGUsIGV4dHJhRmls ZXMsICItLWVuYWJsZUNvbmN1cnJlbnRKSVQ9ZmFsc2UiLCAqRUFHRVJfT1BUSU9OUykKIGVuZApA QCAtNTA4LDYgKzUyMiw3IEBAIGVuZAogZGVmIGRlZmF1bHRSdW5Nb3ppbGxhVGVzdChtb2RlLCAq ZXh0cmFGaWxlcykKICAgICBydW5Nb3ppbGxhVGVzdERlZmF1bHQobW9kZSwgKmV4dHJhRmlsZXMp CiAgICAgcnVuTW96aWxsYVRlc3RMTEludChtb2RlLCAqZXh0cmFGaWxlcykKKyAgICBydW5Nb3pp bGxhVGVzdEJhc2VsaW5lSklUKG1vZGUsICpleHRyYUZpbGVzKQogICAgIHJ1bk1vemlsbGFUZXN0 REZHRWFnZXJOb0NKSVQobW9kZSwgKmV4dHJhRmlsZXMpCiBlbmQKIApAQCAtNzA0LDYgKzcxOSw4 IEBAIHRvRGVsZXRlLmVhY2ggewogICAgIEZpbGUudW5saW5rKHBhcmFsbGVsRGlyICsgZmlsZW5h bWUpCiB9CiAKK3B1dHMKKwogJHJ1bmxpc3QuZWFjaCB7CiAgICAgfCBwbGFuIHwKICAgICBwbGFu LndyaXRlUnVuU2NyaXB0KHBhcmFsbGVsRGlyICsgInRlc3Rfc2NyaXB0XyN7cGxhbi5pbmRleH0i KQo=