132581 2014-05-05 14:37:53 -0700 REGRESSION: RELEASE_ASSERT in CodeBlock::baselineVersion @ cnn.com 2014-05-07 13:02:49 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED InRadar P2 Normal --- 1 msaboff msaboff ggaren oldest_to_newest 1006740 0 msaboff 2014-05-05 14:37:53 -0700 We crash with the following traceback: 0 JavaScriptCore 0x00000001005e1ac8 WTFCrash + 72 1 JavaScriptCore 0x0000000100297a88 JSC::CodeBlock::baselineVersion() + 148 2 JavaScriptCore 0x000000010031d684 JSC::DFG::JITFinalizer::finalizeCommon() + 124 3 JavaScriptCore 0x000000010031d784 JSC::DFG::JITFinalizer::finalizeFunction() + 224 4 JavaScriptCore 0x000000010033fe44 JSC::DFG::Plan::finalizeWithoutNotifyingCallback() + 188 5 JavaScriptCore 0x000000010033ff50 JSC::DFG::Plan::finalizeAndNotifyCallback() + 36 6 JavaScriptCore 0x00000001003ac9e8 JSC::DFG::Worklist::completeAllReadyPlansForVM(JSC::VM&, JSC::DFG::CompilationKey) + 340 7 JavaScriptCore 0x0000000100403358 operationOptimize + 552 8 ??? 0x00000001061c40c4 0 + 4397482180 9 JavaScriptCore 0x00000001004c03dc llint_op_call + 180 10 JavaScriptCore 0x00000001004c0440 llint_op_call + 280 11 JavaScriptCore 0x00000001004c0570 llint_op_construct + 236 12 ??? 0x0000000106144c3c 0 + 4396960828 13 JavaScriptCore 0x00000001004bb238 callToJavaScript + 304 14 JavaScriptCore 0x00000001003ee37c JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 44 15 JavaScriptCore 0x00000001003db6f4 JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) + 2940 16 JavaScriptCore 0x00000001002abd48 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 452 17 WebCore 0x000000010145c224 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) + 280 18 WebCore 0x000000010145c42c WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&) + 48 19 WebCore 0x00000001014618f4 WebCore::ScriptElement::executeScript(WebCore::ScriptSourceCode const&) + 592 20 WebCore 0x00000001014604d0 WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport) + 1064 21 WebCore 0x0000000100d74428 WebCore::HTMLScriptRunner::runScript(WebCore::Element*, WTF::TextPosition const&) + 264 22 WebCore 0x0000000100d742c0 WebCore::HTMLScriptRunner::execute(WTF::PassRefPtr<WebCore::Element>, WTF::TextPosition const&) + 60 23 WebCore 0x0000000100d1b164 WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder() + 76 24 WebCore 0x0000000100d1b208 WebCore::HTMLDocumentParser::canTakeNextToken(WebCore::HTMLDocumentParser::SynchronousMode, WebCore::PumpSession&) + 104 25 WebCore 0x0000000100d1aef8 WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) + 360 26 WebCore 0x0000000100d1baa0 WebCore::HTMLDocumentParser::resumeParsingAfterScriptExecution() + 104 27 WebCore 0x0000000100d1bcdc non-virtual thunk to WebCore::HTMLDocumentParser::notifyFinished(WebCore::CachedResource*) + 96 28 WebCore 0x00000001009becd8 WebCore::CachedResource::checkNotify() + 268 29 WebCore 0x00000001015066b8 WebCore::SubresourceLoader::didFinishLoading(double) + 108 30 CFNetwork 0x00000001866ae168 ___ZN27URLConnectionClient_Classic26_delegate_didFinishLoadingEU13block_pointerFvvE_block_invoke + 100 31 CFNetwork 0x0000000186767298 ___ZN27URLConnectionClient_Classic18_withDelegateAsyncEPKcU13block_pointerFvP16_CFURLConnectionPK33CFURLConnectionClientCurrent_VMaxE_block_invoke_2 + 92 32 CoreFoundation 0x0000000186bac000 CFArrayApplyFunction + 64 33 CFNetwork 0x000000018669be0c RunloopBlockContext::perform() + 132 34 CFNetwork 0x000000018669bcc0 MultiplexerSource::perform() + 308 35 CFNetwork 0x000000018669bae4 MultiplexerSource::_perform(void*) + 56 36 CoreFoundation 0x0000000186c80d34 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 20 37 CoreFoundation 0x0000000186c80050 __CFRunLoopDoSources0 + 240 38 CoreFoundation 0x0000000186c7e2c4 __CFRunLoopRun + 696 39 CoreFoundation 0x0000000186bac61c CFRunLoopRunSpecific + 384 40 WebCore 0x00000001015c38c8 RunWebThread(void*) + 468 41 libsystem_pthread.dylib 0x0000000195ea4000 _pthread_body + 160 42 libsystem_pthread.dylib 0x0000000195ea3f5c _pthread_start + 136 43 libsystem_pthread.dylib 0x0000000195ea1430 thread_start + 0 1006746 1 230856 msaboff 2014-05-05 14:59:33 -0700 Created attachment 230856 Patch 1006751 2 msaboff 2014-05-05 15:09:48 -0700 Committed r168319: <http://trac.webkit.org/changeset/168319> 1006776 3 230856 ggaren 2014-05-05 16:34:04 -0700 Comment on attachment 230856 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=230856&action=review > Source/JavaScriptCore/ChangeLog:11 > + (JSC::DFG::Plan::isStillValid): Check that the alternative codeBlock we > + started compiling for is still the same at the end of compilation. > + Also did some minor restructuring. Why might they be different? Please explain. Please add a regression test. 1006781 4 msaboff 2014-05-05 16:43:58 -0700 (In reply to comment #3) > (From update of attachment 230856 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=230856&action=review > > > Source/JavaScriptCore/ChangeLog:11 > > + (JSC::DFG::Plan::isStillValid): Check that the alternative codeBlock we > > + started compiling for is still the same at the end of compilation. > > + Also did some minor restructuring. > > Why might they be different? Please explain. Because we cleared the code blocks of the executable during GC. > Please add a regression test. Given that the issue is the result of a GC while we have compilation(s) queued up or needing finalization, I think it would difficult to write a deterministic test. 1007157 5 msaboff 2014-05-06 17:36:26 -0700 (In reply to comment #3) > (From update of attachment 230856 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=230856&action=review > > > Source/JavaScriptCore/ChangeLog:11 > > + (JSC::DFG::Plan::isStillValid): Check that the alternative codeBlock we > > + started compiling for is still the same at the end of compilation. > > + Also did some minor restructuring. > > Why might they be different? Please explain. > > Please add a regression test. New test tracked in https://bugs.webkit.org/show_bug.cgi?id=132632 and landed in change set r168396: <http://trac.webkit.org/changeset/168396>. 1007405 6 ggaren 2014-05-07 13:02:49 -0700 <rdar://problem/15961859> 230856 2014-05-05 14:59:33 -0700 2014-05-05 16:34:04 -0700 Patch 132581.patch text/plain 1575 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTY4MzE3KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBA CisyMDE0LTA1LTA1ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIFJFR1JFU1NJT046IFJFTEVBU0VfQVNTRVJUIGluIENvZGVCbG9jazo6YmFzZWxpbmVWZXJz aW9uIEAgY25uLmNvbQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j Z2k/aWQ9MTMyNTgxCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg ICAgICAgKiBkZmcvREZHUGxhbi5jcHA6CisgICAgICAgIChKU0M6OkRGRzo6UGxhbjo6aXNTdGls bFZhbGlkKTogQ2hlY2sgdGhhdCB0aGUgYWx0ZXJuYXRpdmUgY29kZUJsb2NrIHdlCisgICAgICAg IHN0YXJ0ZWQgY29tcGlsaW5nIGZvciBpcyBzdGlsbCB0aGUgc2FtZSBhdCB0aGUgZW5kIG9mIGNv bXBpbGF0aW9uLgorICAgICAgICBBbHNvIGRpZCBzb21lIG1pbm9yIHJlc3RydWN0dXJpbmcuCisK IDIwMTQtMDUtMDUgIEFuZHJlYXMgS2xpbmcgIDxha2xpbmdAYXBwbGUuY29tPgogCiAgICAgICAg IE9wdGltaXplIFB1dEJ5VmFsIHdoZW4gc3Vic2NyaXB0IGlzIGEgcm9wZSBzdHJpbmcuCkluZGV4 OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1BsYW4uY3BwCj09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNv dXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHUGxhbi5jcHAJKHJldmlzaW9uIDE2ODMxNykKKysr IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHUGxhbi5jcHAJKHdvcmtpbmcgY29weSkKQEAg LTM4Myw4ICszODMsMTYgQEAgUGxhbjo6Q29tcGlsYXRpb25QYXRoIFBsYW46OmNvbXBpbGVJblRo cgogCiBib29sIFBsYW46OmlzU3RpbGxWYWxpZCgpCiB7Ci0gICAgcmV0dXJuIHdhdGNocG9pbnRz LmFyZVN0aWxsVmFsaWQoKQotICAgICAgICAmJiBjaGFpbnMuYXJlU3RpbGxWYWxpZCgpOworICAg IENvZGVCbG9jayogcmVwbGFjZW1lbnQgPSBjb2RlQmxvY2stPnJlcGxhY2VtZW50KCk7CisgICAg aWYgKCFyZXBsYWNlbWVudCkKKyAgICAgICAgcmV0dXJuIGZhbHNlOworICAgIGlmIChjb2RlQmxv Y2stPmFsdGVybmF0aXZlKCkgIT0gcmVwbGFjZW1lbnQtPmJhc2VsaW5lVmVyc2lvbigpKQorICAg ICAgICByZXR1cm4gZmFsc2U7CisgICAgaWYgKCF3YXRjaHBvaW50cy5hcmVTdGlsbFZhbGlkKCkp CisgICAgICAgIHJldHVybiBmYWxzZTsKKyAgICBpZiAoIWNoYWlucy5hcmVTdGlsbFZhbGlkKCkp CisgICAgICAgIHJldHVybiBmYWxzZTsKKyAgICByZXR1cm4gdHJ1ZTsKIH0KIAogdm9pZCBQbGFu OjpyZWFsbHlBZGQoQ29tbW9uRGF0YSogY29tbW9uRGF0YSkK