129101 2014-02-20 05:38:25 -0800 ASSERTION FAILED: isUInt16() on ARMv7 after r113253 2014-02-20 09:32:59 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Linux RESOLVED FIXED P2 Normal --- 108645 83191 1 rgabor webkit-unassigned commit-queue fpizlo msaboff oliver ossy zherczeg oldest_to_newest 982805 0 rgabor 2014-02-20 05:38:25 -0800 Testcase: var args = "a"; for (var i = 0; i < 600; ++i) args += ",a"; var myFunc = Function(args, "print(myFunc.length)"); myFunc(); #0 0xb69fd2b8 in WTFCrash () at /home/rgabor/WebKit/Source/WTF/wtf/Assertions.cpp:333 #1 0xb6705faa in JSC::ARMThumbImmediate::getUInt16 (this=0xbeffe984) at /home/rgabor/WebKit/Source/JavaScriptCore/assembler/ARMv7Assembler.h:437 #2 0xb67060fa in JSC::ARMv7Assembler::add (this=0xbeffea18, rd=JSC::ARMRegisters::r13, rn=JSC::ARMRegisters::r13, imm=...) at /home/rgabor/WebKit/Source/JavaScriptCore/assembler/ARMv7Assembler.h:861 #3 0xb67075ae in JSC::MacroAssemblerARMv7::add32 (this=0xbeffea18, imm=..., src=JSC::ARMRegisters::r13, dest=JSC::ARMRegisters::r13) at /home/rgabor/WebKit/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h:182 #4 0xb670754c in JSC::MacroAssemblerARMv7::add32 (this=0xbeffea18, imm=..., dest=JSC::ARMRegisters::r13) at /home/rgabor/WebKit/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h:161 #5 0xb6707d88 in JSC::MacroAssembler::addPtr (this=0xbeffea18, imm=..., srcDest=JSC::ARMRegisters::r13) at /home/rgabor/WebKit/Source/JavaScriptCore/assembler/MacroAssembler.h:444 #6 0xb681d8b8 in JSC::ArityCheckFailReturnThunks::returnPCsFor (this=0x5b6f8, vm=..., numExpectedArgumentsIncludingThis=524) at /home/rgabor/WebKit/Source/JavaScriptCore/jit/ArityCheckFailReturnThunks.cpp:86 #7 0xb681db82 in JSC::ArityCheckFailReturnThunks::returnPCFor (this=0x5b6f8, vm=..., slotsToAdd=524) at /home/rgabor/WebKit/Source/JavaScriptCore/jit/ArityCheckFailReturnThunks.cpp:128 #8 0xb68e5b4a in JSC::setupArityCheckData (vm=..., slotsToAdd=262) at /home/rgabor/WebKit/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp:173 #9 0xb68e5c34 in JSC::slow_path_call_arityCheck (exec=0xbeffec88, pc=0x772c8) at /home/rgabor/WebKit/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp:193 #10 0xb69e8516 in llint_function_for_call_arity_check () from /home/rgabor/WebKit/WebKitBuild/Debug/lib/libjavascriptcore_efl.so.0 #11 0xb69ec2a2 in llint_op_call () from /home/rgabor/WebKit/WebKitBuild/Debug/lib/libjavascriptcore_efl.so.0 #12 0xb69ec2a2 in llint_op_call () from /home/rgabor/WebKit/WebKitBuild/Debug/lib/libjavascriptcore_efl.so.0 982813 1 224751 rgabor 2014-02-20 06:00:39 -0800 Created attachment 224751 proposed patch 982838 2 224751 msaboff 2014-02-20 08:50:15 -0800 Comment on attachment 224751 proposed patch r=me 982854 3 224751 commit-queue 2014-02-20 09:32:57 -0800 Comment on attachment 224751 proposed patch Clearing flags on attachment: 224751 Committed r164433: <http://trac.webkit.org/changeset/164433> 982855 4 commit-queue 2014-02-20 09:32:59 -0800 All reviewed patches have been landed. Closing bug. 224751 2014-02-20 06:00:39 -0800 2014-02-20 09:32:57 -0800 proposed patch immediate.patch text/plain 1397 rgabor ZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cgYi9Tb3VyY2UvSmF2 YVNjcmlwdENvcmUvQ2hhbmdlTG9nCmluZGV4IGU4ZmQxMzIuLmI1YzkxN2MgMTAwNjQ0Ci0tLSBh L1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL0phdmFTY3JpcHRD b3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDE0LTAyLTIwICBHYWJvciBSYXBjc2Fu eWkgIDxyZ2Fib3JAd2Via2l0Lm9yZz4KKworICAgICAgICBBU1NFUlRJT04gRkFJTEVEOiBpc1VJ bnQxNigpIG9uIEFSTXY3IGFmdGVyIHIxMTMyNTMuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMjkxMDEKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP RFkgKE9PUFMhKS4KKworICAgICAgICBJZiB0aGUgaW1tZWRpYXRlIHZhbHVlIHR5cGUgaXMgZW5j b2RlZCB0aGVuIHdlIHNob3VsZG4ndCByZWFjaCB0aGlzIGFzc2VydC4KKyAgICAgICAgQ2hlY2sg dGhlIGltbWVkaWF0ZSB0eXBlIHRvIGF2b2lkIGFzc2VydGlvbiBpbiBhbGlnbmVtbnQgY2hlY2su CisKKyAgICAgICAgKiBhc3NlbWJsZXIvQVJNdjdBc3NlbWJsZXIuaDoKKyAgICAgICAgKEpTQzo6 QVJNdjdBc3NlbWJsZXI6OmFkZCk6CisKIDIwMTQtMDItMTYgIEZpbGlwIFBpemxvICA8ZnBpemxv QGFwcGxlLmNvbT4KIAogICAgICAgICBVbnJldmlld2VkLCAzMi1iaXQgYnVpbGQgZml4LgpkaWZm IC0tZ2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2Fzc2VtYmxlci9BUk12N0Fzc2VtYmxlci5o IGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2Fzc2VtYmxlci9BUk12N0Fzc2VtYmxlci5oCmluZGV4 IDU5YmYyNDIuLjA4NzQ1OTYgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9hc3Nl bWJsZXIvQVJNdjdBc3NlbWJsZXIuaAorKysgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvYXNzZW1i bGVyL0FSTXY3QXNzZW1ibGVyLmgKQEAgLTg1Nyw3ICs4NTcsNyBAQCBwdWJsaWM6CiAgICAgICAg IEFTU0VSVChybiAhPSBBUk1SZWdpc3RlcnM6OnBjKTsKICAgICAgICAgQVNTRVJUKGltbS5pc1Zh bGlkKCkpOwogCi0gICAgICAgIGlmIChybiA9PSBBUk1SZWdpc3RlcnM6OnNwKSB7CisgICAgICAg IGlmIChybiA9PSBBUk1SZWdpc3RlcnM6OnNwICYmIGltbS5pc1VJbnQxNigpKSB7CiAgICAgICAg ICAgICBBU1NFUlQoIShpbW0uZ2V0VUludDE2KCkgJiAzKSk7CiAgICAgICAgICAgICBpZiAoIShy ZCAmIDgpICYmIGltbS5pc1VJbnQxMCgpKSB7CiAgICAgICAgICAgICAgICAgbV9mb3JtYXR0ZXIu b25lV29yZE9wNVJlZzNJbW04KE9QX0FERF9TUF9pbW1fVDEsIHJkLCBzdGF0aWNfY2FzdDx1aW50 OF90PihpbW0uZ2V0VUludDEwKCkgPj4gMikpOwo=