126219 2013-12-24 12:34:24 -0800 js/dom/dfg-custom-getter-throw.html and js/dom/dfg-custom-getter-throw-inlined.html hit assertions after r161051 2014-03-06 18:25:36 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar, Regression P2 Normal --- 45994 1 rniwa webkit-unassigned ap fpizlo ggaren mark.lam oliver webkit-bug-importer oldest_to_newest 962783 0 rniwa 2013-12-24 12:34:24 -0800 js/dom/dfg-custom-getter-throw.html and js/dom/dfg-custom-getter-throw-inlined.html have started hitting assertions after http://trac.webkit.org/changeset/161051 ASSERTION FAILED: exec == topCallFrame || exec == exec->lexicalGlobalObject()->globalExec() || exec == exec->vmEntryGlobalObject()->globalExec() /Volumes/Data/slave/mavericks-debug/build/Source/JavaScriptCore/runtime/VM.cpp(634) : JSC::JSValue JSC::VM::throwException(JSC::ExecState *, JSC::JSValue) 1 0x10da505b0 WTFCrash 2 0x10d9f14af JSC::VM::throwException(JSC::ExecState*, JSC::JSValue) 3 0x10f6cb39f WebCore::setDOMException(JSC::ExecState*, int) 4 0x10fbe6119 WebCore::JSXMLHttpRequest::responseText(JSC::ExecState*) const 5 0x10fbe0d3f WebCore::jsXMLHttpRequestResponseText(JSC::ExecState*, long long, long long, JSC::PropertyName) 6 0x3ed880e68ffa http://build.webkit.org/results/Apple%20Mavericks%20Debug%20WK2%20(Tests)/r161053%20(1201)/results.html 962784 1 rniwa 2013-12-24 12:36:05 -0800 Looks like this is a fairly recent regression in JSC. I certainly did not encounter it at r158715, and reverting the WebCore code change in r161051 confirms that the assertion failure exists without the patch. 962797 2 219979 rniwa 2013-12-24 12:53:20 -0800 Created attachment 219979 The version of js/dom/dfg-custom-getter-throw.html that reproduces the assertion failure 962798 3 webkit-bug-importer 2013-12-24 12:54:32 -0800 <rdar://problem/15723849> 962799 4 rniwa 2013-12-24 12:57:00 -0800 Committed r161059: <http://trac.webkit.org/changeset/161059> 962801 5 rniwa 2013-12-24 12:58:48 -0800 Sorry, didn't mean to close this bug. 987927 6 mark.lam 2014-03-06 16:07:16 -0800 Testing with a recent build (r165197), I don't see this issue manifest anymore. There also have been numerous changes and bug fixes in the area of exception handling and stack management since the time this bug was filed. Those changes appear to have resolved the issue. There doesn't seem to be anything left to do for this bug. Will close. 987973 7 ap 2014-03-06 17:47:05 -0800 Mark, did you unskip the skipped tests? 987991 8 mark.lam 2014-03-06 18:25:36 -0800 (In reply to comment #7) > Mark, did you unskip the skipped tests? They were already unskipped. See https://bugs.webkit.org/show_bug.cgi?id=126219#c4. 219979 2013-12-24 12:53:20 -0800 2013-12-24 12:53:20 -0800 The version of js/dom/dfg-custom-getter-throw.html that reproduces the assertion failure dfg-custom-getter-throw.html text/html 834 rniwa PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9JRVRGLy9EVEQgSFRNTC8vRU4iPgo8aHRtbD4KPGhl YWQ+CjxzY3JpcHQgc3JjPSIuLi8uLi9yZXNvdXJjZXMvanMtdGVzdC1wcmUuanMiPjwvc2NyaXB0 Pgo8L2hlYWQ+Cjxib2R5Pgo8c2NyaXB0PgoKZGVzY3JpcHRpb24oCiJUZXN0cyB0aGF0IERGRyBj dXN0b20gZ2V0dGVyIGNhY2hpbmcgZG9lcyBub3QgYnJlYWsgdGhlIHdvcmxkIGlmIHRoZSBnZXR0 ZXIgdGhyb3dzIGFuIGV4Y2VwdGlvbi4iCik7CgpmdW5jdGlvbiBmb28oeCkgewogICAgcmV0dXJu IHgucmVzcG9uc2VUZXh0Owp9CgpmdW5jdGlvbiBiYXIoYmluYXJ5KSB7CiAgICB2YXIgeCA9IG5l dyBYTUxIdHRwUmVxdWVzdCgpOwogICAgeC5vcGVuKCJHRVQiLCAiaHR0cDovL2Zvby5iYXIuY29t LyIpOwogICAgaWYgKGJpbmFyeSkKICAgICAgICB4LnJlc3BvbnNlVHlwZSA9ICJhcnJheWJ1ZmZl ciI7CiAgICB0cnkgewogICAgICAgIHJldHVybiAiUmV0dXJuZWQgcmVzdWx0OiAiICsgZm9vKHgp OwogICAgfSBjYXRjaCAoZSkgewogICAgICAgIHJldHVybiAiVGhyZXcgZXhjZXB0aW9uOiAiICsg ZTsKICAgIH0KfQoKZm9yICh2YXIgaSA9IDA7IGkgPCAyMDA7ICsraSkgewogICAgc2hvdWxkQmUo ImJhcihpID49IDEwMCkiLCBpID49IDEwMCA/ICJcIlRocmV3IGV4Y2VwdGlvbjogRXJyb3I6IElu dmFsaWRTdGF0ZUVycm9yOiBET00gRXhjZXB0aW9uIDExXCIiIDogIlwiUmV0dXJuZWQgcmVzdWx0 OiBcIiIpOwp9Cgo8L3NjcmlwdD4KPHNjcmlwdCBzcmM9Ii4uLy4uL3Jlc291cmNlcy9qcy10ZXN0 LXBvc3QuanMiPjwvc2NyaXB0Pgo8L2JvZHk+CjwvaHRtbD4K