130066 2014-03-10 20:51:23 -0700 REGRESSION(r165407): DoYouEvenBench crashes in DRT 2014-03-10 23:51:55 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar, Regression P2 Normal --- 130040 1 rniwa mhahnenberg barraclough commit-queue fpizlo ggaren kling mhahnenberg oldest_to_newest 989207 0 rniwa 2014-03-10 20:51:23 -0700 After http://trac.webkit.org/changeset/165407, DYEBench has been crashing on the perf builders: http://build.webkit.org/builders/Apple%20MountainLion%20Release%20%28Perf%29/builds/8249 http://build.webkit.org/builders/Apple%20Mavericks%20Release%20%28Perf%29/builds/843 While the blame list contains other changes, I've built r165406 and 165407 locally and only r165407 reproduces the crash quite reliably. It appears, however, that this crash doesn't always occur. While Tools/Scripts/run-perf-tests PerformanceTests/DoYouEvenBench/Full.html --test-runner-count=4 --reset-results reproduces the crash quite reliably, Tools/Scripts/run-perf-tests PerformanceTests/DoYouEvenBench/Full.html --test-runner-count=1 --reset-results doesn't. 989227 1 ggaren 2014-03-10 21:37:45 -0700 <rdar://problem/16285126> 989228 2 mhahnenberg 2014-03-10 21:39:07 -0700 After testing with a debug build, I get a reliable ASSERT during compilation in the DFG, but no crash during GC. 989235 3 rniwa 2014-03-10 22:03:43 -0700 In the debug build, we're hitting the following assertion: ASSERTION FAILED: node->op() == Phi || node->op() == SetArgument /Volumes/Data/webkit/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp(262) : void JSC::DFG::DCEPhase::cleanVariables(VariablesVectorType &) [VariablesVectorType = JSC::Operands<JSC::DFG::Node *, JSC::DFG::NodePointerTraits>] 1 0x1067dc750 WTFCrash 2 0x1062728e1 void JSC::DFG::DCEPhase::cleanVariables<JSC::Operands<JSC::DFG::Node*, JSC::DFG::NodePointerTraits> >(JSC::Operands<JSC::DFG::Node*, JSC::DFG::NodePointerTraits>&) 3 0x1062722d0 JSC::DFG::DCEPhase::fixupBlock(JSC::DFG::BasicBlock*) 4 0x106271e2e JSC::DFG::DCEPhase::run() 5 0x106271005 bool JSC::DFG::runAndLog<JSC::DFG::DCEPhase>(JSC::DFG::DCEPhase&) 6 0x106270f8e bool JSC::DFG::runPhase<JSC::DFG::DCEPhase>(JSC::DFG::Graph&) 7 0x106270f48 JSC::DFG::performDCE(JSC::DFG::Graph&) 8 0x106326f40 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) 9 0x106326674 JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) 10 0x1063c9ac0 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) 11 0x1063c8714 JSC::DFG::Worklist::threadFunction(void*) 12 0x10682bf70 WTF::threadEntryPoint(void*) 13 0x10682cbf8 WTF::wtfThreadEntryPoint(void*) 14 0x7fff8f8d4899 _pthread_body 15 0x7fff8f8d472a _pthread_struct_init 16 0x7fff8f8d8fc9 thread_start 989238 4 mhahnenberg 2014-03-10 22:06:38 -0700 (In reply to comment #3) > In the debug build, we're hitting the following assertion: > > ASSERTION FAILED: node->op() == Phi || node->op() == SetArgument > /Volumes/Data/webkit/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp(262) : void JSC::DFG::DCEPhase::cleanVariables(VariablesVectorType &) [VariablesVectorType = JSC::Operands<JSC::DFG::Node *, JSC::DFG::NodePointerTraits>] > 1 0x1067dc750 WTFCrash > 2 0x1062728e1 void JSC::DFG::DCEPhase::cleanVariables<JSC::Operands<JSC::DFG::Node*, JSC::DFG::NodePointerTraits> >(JSC::Operands<JSC::DFG::Node*, JSC::DFG::NodePointerTraits>&) > 3 0x1062722d0 JSC::DFG::DCEPhase::fixupBlock(JSC::DFG::BasicBlock*) > 4 0x106271e2e JSC::DFG::DCEPhase::run() > 5 0x106271005 bool JSC::DFG::runAndLog<JSC::DFG::DCEPhase>(JSC::DFG::DCEPhase&) > 6 0x106270f8e bool JSC::DFG::runPhase<JSC::DFG::DCEPhase>(JSC::DFG::Graph&) > 7 0x106270f48 JSC::DFG::performDCE(JSC::DFG::Graph&) > 8 0x106326f40 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) > 9 0x106326674 JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) > 10 0x1063c9ac0 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) > 11 0x1063c8714 JSC::DFG::Worklist::threadFunction(void*) > 12 0x10682bf70 WTF::threadEntryPoint(void*) > 13 0x10682cbf8 WTF::wtfThreadEntryPoint(void*) > 14 0x7fff8f8d4899 _pthread_body > 15 0x7fff8f8d472a _pthread_struct_init > 16 0x7fff8f8d8fc9 thread_start Yep, that's what I'm seeing. 989239 5 mhahnenberg 2014-03-10 22:07:25 -0700 Hmm, seems like the DFG assert is just a red herring. Running the benchmark in a release build and disabling the DFG I hit the original issue. 989240 6 mhahnenberg 2014-03-10 22:07:49 -0700 And disabling the baseline JIT avoids the crash entirely. 989241 7 fpizlo 2014-03-10 22:09:36 -0700 I'd like to see the IR at the point of this crash. Any chance you could convert the assertion so that if it fails, it dumps the graph (m_graph.dump()) and the node (dataLog("node = ", node, "\n"))? (In reply to comment #4) > (In reply to comment #3) > > In the debug build, we're hitting the following assertion: > > > > ASSERTION FAILED: node->op() == Phi || node->op() == SetArgument > > /Volumes/Data/webkit/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp(262) : void JSC::DFG::DCEPhase::cleanVariables(VariablesVectorType &) [VariablesVectorType = JSC::Operands<JSC::DFG::Node *, JSC::DFG::NodePointerTraits>] > > 1 0x1067dc750 WTFCrash > > 2 0x1062728e1 void JSC::DFG::DCEPhase::cleanVariables<JSC::Operands<JSC::DFG::Node*, JSC::DFG::NodePointerTraits> >(JSC::Operands<JSC::DFG::Node*, JSC::DFG::NodePointerTraits>&) > > 3 0x1062722d0 JSC::DFG::DCEPhase::fixupBlock(JSC::DFG::BasicBlock*) > > 4 0x106271e2e JSC::DFG::DCEPhase::run() > > 5 0x106271005 bool JSC::DFG::runAndLog<JSC::DFG::DCEPhase>(JSC::DFG::DCEPhase&) > > 6 0x106270f8e bool JSC::DFG::runPhase<JSC::DFG::DCEPhase>(JSC::DFG::Graph&) > > 7 0x106270f48 JSC::DFG::performDCE(JSC::DFG::Graph&) > > 8 0x106326f40 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) > > 9 0x106326674 JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) > > 10 0x1063c9ac0 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) > > 11 0x1063c8714 JSC::DFG::Worklist::threadFunction(void*) > > 12 0x10682bf70 WTF::threadEntryPoint(void*) > > 13 0x10682cbf8 WTF::wtfThreadEntryPoint(void*) > > 14 0x7fff8f8d4899 _pthread_body > > 15 0x7fff8f8d472a _pthread_struct_init > > 16 0x7fff8f8d8fc9 thread_start > > Yep, that's what I'm seeing. 989242 8 mhahnenberg 2014-03-10 22:11:29 -0700 I think I know what the issue is for the baseline JIT. The baseline JIT does a conditional store barrier for the put_by_id, but we need an unconditional store barrier so that we cover the butterfly case as well in emitPutTransitionStub. 989246 9 226387 mhahnenberg 2014-03-10 22:22:22 -0700 Created attachment 226387 Patch 989249 10 rniwa 2014-03-10 22:33:35 -0700 (In reply to comment #5) > Hmm, seems like the DFG assert is just a red herring. Running the benchmark in a release build and disabling the DFG I hit the original issue. Yeah, I hit the same assertion at r165407. 989252 11 rniwa 2014-03-10 22:45:26 -0700 (In reply to comment #7) > I'd like to see the IR at the point of this crash. Any chance you could convert the assertion so that if it fails, it dumps the graph (m_graph.dump()) and the node (dataLog("node = ", node, "\n"))? Since this doesn't seem to be the crash culprit, I've filed https://bugs.webkit.org/show_bug.cgi?id=130069 to track the assertion failure. I've posted the data there. 989260 12 226387 ggaren 2014-03-10 23:05:38 -0700 Comment on attachment 226387 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=226387&action=review r=me > Source/JavaScriptCore/ChangeLog:9 > + The baseline JIT does a conditional store barrier for the put_by_id, but we need > + an unconditional store barrier so that we cover the butterfly case as well in emitPutTransitionStub. I wonder if we should just remove conditional store barriers from the baseline JIT -- to avoid mismatches like this, and because it wasn't a regression in the optimizing JIT. 989265 13 mhahnenberg 2014-03-10 23:22:42 -0700 Just to be sure, I ran benchmarks on this patch, and it's performance neutral. 989274 14 226387 commit-queue 2014-03-10 23:51:51 -0700 Comment on attachment 226387 Patch Clearing flags on attachment: 226387 Committed r165435: <http://trac.webkit.org/changeset/165435> 989275 15 commit-queue 2014-03-10 23:51:55 -0700 All reviewed patches have been landed. Closing bug. 226387 2014-03-10 22:22:22 -0700 2014-03-10 23:51:51 -0700 Patch bug-130066-20140310221833.patch text/plain 3792 mhahnenberg SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTY1NDMzKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBA CisyMDE0LTAzLTEwICBNYXJrIEhhaG5lbmJlcmcgIDxtaGFobmVuYmVyZ0BhcHBsZS5jb20+CisK KyAgICAgICAgUkVHUkVTU0lPTihyMTY1NDA3KTogRG9Zb3VFdmVuQmVuY2ggY3Jhc2hlcyBpbiBE UlQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEzMDA2 NgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRoZSBi YXNlbGluZSBKSVQgZG9lcyBhIGNvbmRpdGlvbmFsIHN0b3JlIGJhcnJpZXIgZm9yIHRoZSBwdXRf YnlfaWQsIGJ1dCB3ZSBuZWVkIAorICAgICAgICBhbiB1bmNvbmRpdGlvbmFsIHN0b3JlIGJhcnJp ZXIgc28gdGhhdCB3ZSBjb3ZlciB0aGUgYnV0dGVyZmx5IGNhc2UgYXMgd2VsbCBpbiBlbWl0UHV0 VHJhbnNpdGlvblN0dWIuCisKKyAgICAgICAgKiBqaXQvSklULmg6CisgICAgICAgICogaml0L0pJ VFByb3BlcnR5QWNjZXNzLmNwcDoKKyAgICAgICAgKEpTQzo6SklUOjplbWl0X29wX3B1dF9ieV9p ZCk6CisgICAgICAgIChKU0M6OkpJVDo6ZW1pdFdyaXRlQmFycmllcik6CisKIDIwMTQtMDMtMTAg IE1hcmsgTGFtICA8bWFyay5sYW1AYXBwbGUuY29tPgogCiAgICAgICAgIFJlc3VycmVjdCBiaXQt cm90dGVkIEpJVDo6cHJvYmUoKSBtZWNoYW5pc20uCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENv cmUvaml0L0pJVC5oCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklU LmgJKHJldmlzaW9uIDE2NTQxMCkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklULmgJ KHdvcmtpbmcgY29weSkKQEAgLTMxMSw3ICszMTEsNyBAQCBuYW1lc3BhY2UgSlNDIHsKICAgICAg ICAgdm9pZCBhZGRTdHJ1Y3R1cmVUcmFuc2l0aW9uQ2hlY2soSlNDZWxsKiwgU3RydWN0dXJlKiwg U3RydWN0dXJlU3R1YkluZm8qLCBKdW1wTGlzdCYgZmFpbHVyZUNhc2VzLCBSZWdpc3RlcklEIHNj cmF0Y2gpOwogICAgICAgICB2b2lkIHRlc3RQcm90b3R5cGUoSlNWYWx1ZSwgSnVtcExpc3QmIGZh aWx1cmVDYXNlcywgU3RydWN0dXJlU3R1YkluZm8qKTsKIAotICAgICAgICBlbnVtIFdyaXRlQmFy cmllck1vZGUgeyBVbmNvbmRpdGlvbmFsV3JpdGVCYXJyaWVyLCBTaG91bGRGaWx0ZXJWYWx1ZSwg U2hvdWxkRmlsdGVyQmFzZUFuZFZhbHVlIH07CisgICAgICAgIGVudW0gV3JpdGVCYXJyaWVyTW9k ZSB7IFVuY29uZGl0aW9uYWxXcml0ZUJhcnJpZXIsIFNob3VsZEZpbHRlckJhc2UsIFNob3VsZEZp bHRlclZhbHVlLCBTaG91bGRGaWx0ZXJCYXNlQW5kVmFsdWUgfTsKICAgICAgICAgLy8gdmFsdWUg cmVnaXN0ZXIgaW4gd3JpdGUgYmFycmllciBpcyB1c2VkIGJlZm9yZSBhbnkgc2NyYXRjaCByZWdp c3RlcnMKICAgICAgICAgLy8gc28gbWF5IHNhZmVseSBiZSB0aGUgc2FtZSBhcyBlaXRoZXIgb2Yg dGhlIHNjcmF0Y2ggcmVnaXN0ZXJzLgogICAgICAgICB2b2lkIGVtaXRXcml0ZUJhcnJpZXIodW5z aWduZWQgb3duZXIsIHVuc2lnbmVkIHZhbHVlLCBXcml0ZUJhcnJpZXJNb2RlKTsKSW5kZXg6IFNv dXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklUUHJvcGVydHlBY2Nlc3MuY3BwCj09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K LS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklUUHJvcGVydHlBY2Nlc3MuY3BwCShyZXZp c2lvbiAxNjU0MTApCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L0pJVFByb3BlcnR5QWNj ZXNzLmNwcAkod29ya2luZyBjb3B5KQpAQCAtNTU0LDcgKzU1NCw3IEBAIHZvaWQgSklUOjplbWl0 X29wX3B1dF9ieV9pZChJbnN0cnVjdGlvbioKICAgICBpbnQgdmFsdWVWUmVnID0gY3VycmVudElu c3RydWN0aW9uWzNdLnUub3BlcmFuZDsKICAgICB1bnNpZ25lZCBkaXJlY3QgPSBjdXJyZW50SW5z dHJ1Y3Rpb25bOF0udS5vcGVyYW5kOwogCi0gICAgZW1pdFdyaXRlQmFycmllcihiYXNlVlJlZywg dmFsdWVWUmVnLCBTaG91bGRGaWx0ZXJCYXNlQW5kVmFsdWUpOworICAgIGVtaXRXcml0ZUJhcnJp ZXIoYmFzZVZSZWcsIHZhbHVlVlJlZywgU2hvdWxkRmlsdGVyQmFzZSk7CiAKICAgICAvLyBJbiBv cmRlciB0byBiZSBhYmxlIHRvIHBhdGNoIGJvdGggdGhlIFN0cnVjdHVyZSwgYW5kIHRoZSBvYmpl Y3Qgb2Zmc2V0LCB3ZSBzdG9yZSBvbmUgcG9pbnRlciwKICAgICAvLyB0byBqdXN0IGFmdGVyIHRo ZSBhcmd1bWVudHMgaGF2ZSBiZWVuIGxvYWRlZCBpbnRvIHJlZ2lzdGVycyAnaG90UGF0aEJlZ2lu JywgYW5kIHdlIGdlbmVyYXRlIGNvZGUKQEAgLTg4MywyMSArODgzLDIyIEBAIHZvaWQgSklUOjpl bWl0X29wX2luaXRfZ2xvYmFsX2NvbnN0KEluc3QKIHZvaWQgSklUOjplbWl0V3JpdGVCYXJyaWVy KHVuc2lnbmVkIG93bmVyLCB1bnNpZ25lZCB2YWx1ZSwgV3JpdGVCYXJyaWVyTW9kZSBtb2RlKQog ewogI2lmIEVOQUJMRShHR0MpCi0gICAgZW1pdEdldFZpcnR1YWxSZWdpc3Rlcih2YWx1ZSwgcmVn VDApOwogICAgIEp1bXAgdmFsdWVOb3RDZWxsOwotICAgIGlmIChtb2RlID09IFNob3VsZEZpbHRl clZhbHVlIHx8IG1vZGUgPT0gU2hvdWxkRmlsdGVyQmFzZUFuZFZhbHVlKQorICAgIGlmIChtb2Rl ID09IFNob3VsZEZpbHRlclZhbHVlIHx8IG1vZGUgPT0gU2hvdWxkRmlsdGVyQmFzZUFuZFZhbHVl KSB7CisgICAgICAgIGVtaXRHZXRWaXJ0dWFsUmVnaXN0ZXIodmFsdWUsIHJlZ1QwKTsKICAgICAg ICAgdmFsdWVOb3RDZWxsID0gYnJhbmNoVGVzdDY0KE5vblplcm8sIHJlZ1QwLCB0YWdNYXNrUmVn aXN0ZXIpOworICAgIH0KICAgICAKICAgICBlbWl0R2V0VmlydHVhbFJlZ2lzdGVyKG93bmVyLCBy ZWdUMCk7CiAgICAgSnVtcCBvd25lck5vdENlbGw7Ci0gICAgaWYgKG1vZGUgPT0gU2hvdWxkRmls dGVyQmFzZUFuZFZhbHVlKQorICAgIGlmIChtb2RlID09IFNob3VsZEZpbHRlckJhc2VBbmRWYWx1 ZSB8fCBtb2RlID09IFNob3VsZEZpbHRlckJhc2UpCiAgICAgICAgIG93bmVyTm90Q2VsbCA9IGJy YW5jaFRlc3Q2NChOb25aZXJvLCByZWdUMCwgdGFnTWFza1JlZ2lzdGVyKTsKIAogICAgIEp1bXAg b3duZXJOb3RNYXJrZWRPckFscmVhZHlSZW1lbWJlcmVkID0gY2hlY2tNYXJrQnl0ZShyZWdUMCk7 CiAgICAgY2FsbE9wZXJhdGlvbihvcGVyYXRpb25VbmNvbmRpdGlvbmFsV3JpdGVCYXJyaWVyLCBy ZWdUMCk7CiAgICAgb3duZXJOb3RNYXJrZWRPckFscmVhZHlSZW1lbWJlcmVkLmxpbmsodGhpcyk7 CiAKLSAgICBpZiAobW9kZSA9PSBTaG91bGRGaWx0ZXJCYXNlQW5kVmFsdWUpCisgICAgaWYgKG1v ZGUgPT0gU2hvdWxkRmlsdGVyQmFzZUFuZFZhbHVlIHx8IG1vZGUgPT0gU2hvdWxkRmlsdGVyQmFz ZSkKICAgICAgICAgb3duZXJOb3RDZWxsLmxpbmsodGhpcyk7CiAgICAgaWYgKG1vZGUgPT0gU2hv dWxkRmlsdGVyVmFsdWUgfHwgbW9kZSA9PSBTaG91bGRGaWx0ZXJCYXNlQW5kVmFsdWUpIAogICAg ICAgICB2YWx1ZU5vdENlbGwubGluayh0aGlzKTsK