<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>132378</bug_id>
          
          <creation_ts>2014-04-29 23:19:04 -0700</creation_ts>
          <short_desc>js/dfg-create-inlined-arguments-in-closure-inline.html flakily crashes under ClosureCallStubRoutine::structure()</short_desc>
          <delta_ts>2014-04-30 11:59:55 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>NEW</bug_status>
          <resolution></resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Alexey Proskuryakov">ap</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>fpizlo</cc>
    
    <cc>ggaren</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1005300</commentid>
    <comment_count>0</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2014-04-29 23:19:04 -0700</bug_when>
    <thetext>Happens on bot, and reproducible locally:

run-webkit-tests js/dfg-create-inlined-arguments-in-closure-inline.html --repeat-each 1000

Thread 10 Crashed:: JSC Compilation Thread
0   com.apple.JavaScriptCore      	0x000000010303e4b0 JSC::WriteBarrierBase&lt;JSC::Structure&gt;::get() const + 16 (WriteBarrier.h:92)
1   com.apple.JavaScriptCore      	0x00000001030c968c JSC::ClosureCallStubRoutine::structure() const + 28 (ClosureCallStubRoutine.h:44)
2   com.apple.JavaScriptCore      	0x00000001030cb827 JSC::CallLinkStatus::computeFor(JSC::ConcurrentJITLocker const&amp;, JSC::CallLinkInfo&amp;) + 151 (CallLinkStatus.cpp:156)
3   com.apple.JavaScriptCore      	0x00000001030cb6bc JSC::CallLinkStatus::computeFor(JSC::CodeBlock*, unsigned int, WTF::HashMap&lt;JSC::CodeOrigin, JSC::CallLinkInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits&lt;JSC::CodeOrigin&gt;, WTF::HashTraits&lt;JSC::CallLinkInfo*&gt; &gt; const&amp;) + 396 (CallLinkStatus.cpp:136)
4   com.apple.JavaScriptCore      	0x00000001030cbcc4 JSC::CallLinkStatus::computeFor(JSC::CodeBlock*, JSC::CodeOrigin, WTF::HashMap&lt;JSC::CodeOrigin, JSC::CallLinkInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits&lt;JSC::CodeOrigin&gt;, WTF::HashTraits&lt;JSC::CallLinkInfo*&gt; &gt; const&amp;, WTF::HashMap&lt;JSC::CodeOrigin, JSC::CallLinkStatus, JSC::CodeOriginApproximateHash, WTF::HashTraits&lt;JSC::CodeOrigin&gt;, WTF::HashTraits&lt;JSC::CallLinkStatus&gt; &gt; const&amp;) + 212 (CallLinkStatus.cpp:238)
5   com.apple.JavaScriptCore      	0x0000000103189e79 JSC::DFG::ByteCodeParser::handleCall(int, JSC::DFG::NodeType, JSC::CodeSpecializationKind, unsigned int, int, int, int) + 441 (DFGByteCodeParser.cpp:1211)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1005301</commentid>
    <comment_count>1</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2014-04-29 23:19:23 -0700</bug_when>
    <thetext>&lt;rdar://problem/16766362&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1005452</commentid>
    <comment_count>2</comment_count>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2014-04-30 11:44:33 -0700</bug_when>
    <thetext>Please don&apos;t use the word &quot;flaky&quot;. It is a cancer on the mind.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1005458</commentid>
    <comment_count>3</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2014-04-30 11:59:55 -0700</bug_when>
    <thetext>Please don&apos;t randomly remove relevant information from bug titles. If you can come up with a better way to describe the situation, let&apos;s discuss that on webkit-dev.

I also don&apos;t agree with your negative characterization of &quot;flakily crashes&quot;. &quot;Flaky test&quot; is a misleading concept, but &quot;flakily crashing&quot; is relevant factual information.</thetext>
  </long_desc>
      
      

    </bug>

</bugzilla>