135026 2014-07-17 14:41:26 -0700 REGRESSION: New int52 test failures on ARM64, possibly due to r171096 2014-07-19 14:18:14 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED INVALID P2 Normal --- 1 msaboff webkit-unassigned oldest_to_newest 1023113 0 msaboff 2014-07-17 14:41:26 -0700 The test failures below are happening on ARM64 systems. This is possibly due to r171096. stress/dead-fiat-double-to-int52-then-exit-not-int52.js.always-trigger-copy-phase stress/dead-fiat-double-to-int52-then-exit-not-int52.js.default stress/dead-fiat-double-to-int52-then-exit-not-int52.js.dfg-eager stress/dead-fiat-double-to-int52-then-exit-not-int52.js.dfg-eager-no-cjit-validate stress/dead-fiat-double-to-int52-then-exit-not-int52.js.no-cjit-validate-phases stress/dead-fiat-double-to-int52-then-exit-not-int52.js.no-llint stress/dead-fiat-double-to-int52.js.always-trigger-copy-phase stress/dead-fiat-double-to-int52.js.default stress/dead-fiat-double-to-int52.js.dfg-eager stress/dead-fiat-double-to-int52.js.dfg-eager-no-cjit-validate stress/dead-fiat-double-to-int52.js.no-cjit-validate-phases stress/dead-fiat-double-to-int52.js.no-llint stress/dead-fiat-int32-to-int52.js.always-trigger-copy-phase stress/dead-fiat-int32-to-int52.js.default stress/dead-fiat-int32-to-int52.js.dfg-eager stress/dead-fiat-int32-to-int52.js.dfg-eager-no-cjit-validate stress/dead-fiat-int32-to-int52.js.no-cjit-validate-phases stress/dead-fiat-int32-to-int52.js.no-llint stress/dead-fiat-value-to-int52-double-path.js.always-trigger-copy-phase stress/dead-fiat-value-to-int52-double-path.js.default stress/dead-fiat-value-to-int52-double-path.js.dfg-eager stress/dead-fiat-value-to-int52-double-path.js.dfg-eager-no-cjit-validate stress/dead-fiat-value-to-int52-double-path.js.no-cjit-validate-phases stress/dead-fiat-value-to-int52-double-path.js.no-llint stress/dead-fiat-value-to-int52-then-exit-not-double.js.always-trigger-copy-phase stress/dead-fiat-value-to-int52-then-exit-not-double.js.default stress/dead-fiat-value-to-int52-then-exit-not-double.js.dfg-eager stress/dead-fiat-value-to-int52-then-exit-not-double.js.dfg-eager-no-cjit-validate stress/dead-fiat-value-to-int52-then-exit-not-double.js.no-cjit-validate-phases stress/dead-fiat-value-to-int52-then-exit-not-double.js.no-llint stress/dead-fiat-value-to-int52-then-exit-not-int52.js.always-trigger-copy-phase stress/dead-fiat-value-to-int52-then-exit-not-int52.js.default stress/dead-fiat-value-to-int52-then-exit-not-int52.js.dfg-eager stress/dead-fiat-value-to-int52-then-exit-not-int52.js.dfg-eager-no-cjit-validate stress/dead-fiat-value-to-int52-then-exit-not-int52.js.no-cjit-validate-phases stress/dead-fiat-value-to-int52-then-exit-not-int52.js.no-llint stress/dead-fiat-value-to-int52.js.always-trigger-copy-phase stress/dead-fiat-value-to-int52.js.default stress/dead-fiat-value-to-int52.js.dfg-eager stress/dead-fiat-value-to-int52.js.dfg-eager-no-cjit-validate stress/dead-fiat-value-to-int52.js.no-cjit-validate-phases stress/dead-fiat-value-to-int52.js.no-llint stress/fiat-double-to-int52-then-exit-not-int52.js.always-trigger-copy-phase stress/fiat-double-to-int52-then-exit-not-int52.js.default stress/fiat-double-to-int52-then-exit-not-int52.js.dfg-eager stress/fiat-double-to-int52-then-exit-not-int52.js.dfg-eager-no-cjit-validate stress/fiat-double-to-int52-then-exit-not-int52.js.no-cjit-validate-phases stress/fiat-double-to-int52-then-exit-not-int52.js.no-llint stress/fiat-double-to-int52-then-fail-to-fold.js.always-trigger-copy-phase stress/fiat-double-to-int52-then-fail-to-fold.js.default stress/fiat-double-to-int52-then-fail-to-fold.js.dfg-eager stress/fiat-double-to-int52-then-fail-to-fold.js.dfg-eager-no-cjit-validate stress/fiat-double-to-int52-then-fail-to-fold.js.no-cjit-validate-phases stress/fiat-double-to-int52-then-fail-to-fold.js.no-llint stress/fiat-double-to-int52-then-fold.js.always-trigger-copy-phase stress/fiat-double-to-int52-then-fold.js.default stress/fiat-double-to-int52-then-fold.js.dfg-eager stress/fiat-double-to-int52-then-fold.js.dfg-eager-no-cjit-validate stress/fiat-double-to-int52-then-fold.js.no-cjit-validate-phases stress/fiat-double-to-int52-then-fold.js.no-llint stress/fiat-double-to-int52.js.always-trigger-copy-phase stress/fiat-double-to-int52.js.default stress/fiat-double-to-int52.js.dfg-eager stress/fiat-double-to-int52.js.dfg-eager-no-cjit-validate stress/fiat-double-to-int52.js.no-cjit-validate-phases stress/fiat-double-to-int52.js.no-llint stress/fiat-int32-to-int52.js.always-trigger-copy-phase stress/fiat-int32-to-int52.js.default stress/fiat-int32-to-int52.js.dfg-eager stress/fiat-int32-to-int52.js.dfg-eager-no-cjit-validate stress/fiat-int32-to-int52.js.no-cjit-validate-phases stress/fiat-int32-to-int52.js.no-llint stress/fiat-value-to-int52-double-path.js.always-trigger-copy-phase stress/fiat-value-to-int52-double-path.js.default stress/fiat-value-to-int52-double-path.js.dfg-eager stress/fiat-value-to-int52-double-path.js.dfg-eager-no-cjit-validate stress/fiat-value-to-int52-double-path.js.no-cjit-validate-phases stress/fiat-value-to-int52-double-path.js.no-llint stress/fiat-value-to-int52-then-exit-not-double.js.always-trigger-copy-phase stress/fiat-value-to-int52-then-exit-not-double.js.default stress/fiat-value-to-int52-then-exit-not-double.js.dfg-eager stress/fiat-value-to-int52-then-exit-not-double.js.dfg-eager-no-cjit-validate stress/fiat-value-to-int52-then-exit-not-double.js.no-cjit-validate-phases stress/fiat-value-to-int52-then-exit-not-double.js.no-llint stress/fiat-value-to-int52-then-exit-not-int52.js.always-trigger-copy-phase stress/fiat-value-to-int52-then-exit-not-int52.js.default stress/fiat-value-to-int52-then-exit-not-int52.js.dfg-eager stress/fiat-value-to-int52-then-exit-not-int52.js.dfg-eager-no-cjit-validate stress/fiat-value-to-int52-then-exit-not-int52.js.no-cjit-validate-phases stress/fiat-value-to-int52-then-exit-not-int52.js.no-llint stress/fiat-value-to-int52-then-fail-to-fold.js.always-trigger-copy-phase stress/fiat-value-to-int52-then-fail-to-fold.js.default stress/fiat-value-to-int52-then-fail-to-fold.js.dfg-eager stress/fiat-value-to-int52-then-fail-to-fold.js.dfg-eager-no-cjit-validate stress/fiat-value-to-int52-then-fail-to-fold.js.no-cjit-validate-phases stress/fiat-value-to-int52-then-fail-to-fold.js.no-llint stress/fiat-value-to-int52-then-fold.js.always-trigger-copy-phase stress/fiat-value-to-int52-then-fold.js.default stress/fiat-value-to-int52-then-fold.js.dfg-eager stress/fiat-value-to-int52-then-fold.js.dfg-eager-no-cjit-validate stress/fiat-value-to-int52-then-fold.js.no-cjit-validate-phases stress/fiat-value-to-int52-then-fold.js.no-llint stress/fiat-value-to-int52.js.always-trigger-copy-phase stress/fiat-value-to-int52.js.default stress/fiat-value-to-int52.js.dfg-eager stress/fiat-value-to-int52.js.dfg-eager-no-cjit-validate stress/fiat-value-to-int52.js.no-cjit-validate-phases stress/fiat-value-to-int52.js.no-llint stress/int52-force-osr-exit-path.js.always-trigger-copy-phase stress/int52-force-osr-exit-path.js.default stress/int52-force-osr-exit-path.js.dfg-eager stress/int52-force-osr-exit-path.js.dfg-eager-no-cjit-validate stress/int52-force-osr-exit-path.js.no-cjit-validate-phases 1023115 1 msaboff 2014-07-17 14:49:37 -0700 Here is the output from one failure, stress/int52-force-osr-exit-path.js.dfg-eager-no-cjit-validate: Found an Int52RepUse to a double result: @27 -> Check:Int52Rep:@23<Double> DFG for foo#BW9ZEJ:[0x10048af40->0x10048b3c0->0x1007cfb70, DFGFunctionCall, 36 (NeverInline)]: Fixpoint state: BeforeFixpoint; Form: ThreadedCPS; Unification state: GloballyUnified; Ref count state: EverythingIsLive Block #0 (bc#0): (OSR target) Execution count: 1.000000 Predecessors: Dominated by: #0 Dominates: #0 #1 #2 vars before: <empty> var links: arg4:@4 arg3:@3 arg2:@2 arg1:@1 arg0:@0 0: < 1:-> SetArgument(arg0(a), W:SideState, bc#0) predicting Otherobj 1: < 1:-> SetArgument(IsFlushed, arg1(B<Int32>/FlushedInt32), W:SideState, bc#0) predicting Int32 2: < 1:-> SetArgument(IsFlushed, arg2(C<Int32>/FlushedInt32), W:SideState, bc#0) predicting Int32 3: < 1:-> SetArgument(IsFlushed, arg3(D<Boolean>/FlushedBoolean), W:SideState, bc#0) predicting Bool 4: < 1:-> SetArgument(IsFlushed, arg4(E<Final>/FlushedCell), W:SideState, bc#0) predicting Final 5: < 1:-> JSConstant(JS|PureInt, Other, $1 = Undefined, bc#0) 6: < 1:-> MovHint(@5, loc0, W:SideState, bc#0) 7: < 1:-> SetLocal(@5, CanExit, loc0(F~<Other>/FlushedJSValue), W:Variables(-1), bc#0) predicting Other 8: < 1:-> GetLocal(@1, JS|PureNum|UseAsOther|CanExit, Int32, arg1(B<Int32>/FlushedInt32), R:Variables(7), bc#1) predicting Int32 9: < 1:-> GetLocal(@2, JS|PureNum|UseAsOther|CanExit, Int32, arg2(C<Int32>/FlushedInt32), R:Variables(8), bc#1) predicting Int32 49: < 1:-> Int52Rep(Check:Int32:@8, Int52|PureInt|CanExit, Int32, bc#1) 50: < 1:-> Int52Rep(Check:Int32:@9, Int52|PureInt|CanExit, Int32, bc#1) 10: < 1:-> ArithAdd(Check:Int52Rep:@49<Int52>, Check:Int52Rep:@50<Int52>, Int52|PureNum|UseAsOther|MayOverflowInBaseline|MayOverflowInDFG|CanExit, Int52, CheckOverflow, bc#1) 51: <!0:-> Phantom(@9, MustGen|CanExit, bc#1) 52: <!0:-> Phantom(@8, MustGen|CanExit, bc#1) 11: < 1:-> MovHint(Check:Int52Rep:@10<Int52>, loc0, W:SideState, bc#1) 12: < 1:-> SetLocal(Check:Int52Rep:@10<Int52>, CanExit, loc0(G<Int52>/FlushedInt52), W:Variables(-1), bc#6) predicting Int52 13: < 1:-> GetLocal(@3, JS|UseAsOther|CanExit, Bool, arg3(D<Boolean>/FlushedBoolean), R:Variables(9), bc#6) predicting Bool 14: <!0:-> Branch(Check:Boolean:@13, MustGen|CanExit, T:#1/w:1.000000, F:#2/w:1.000000, W:SideState, bc#6) vars after: <empty> var links: arg4:@4 arg3:@13 arg2:@9 arg1:@8 arg0:@0 loc0:@12 Block #1 (bc#9): Execution count: 1.000000 Predecessors: #0 Dominated by: #0 #1 Dominates: #1 Phi Nodes: @44<1>->(@12), @45<1>->(@4), @46<1>->(@1), @47<1>->(@2), @48<1>->(@3) vars before: <empty> var links: arg4:@45 arg3:@48 arg2:@47 arg1:@46 loc0:@44 15: < 1:-> GetLocal(@44, Int52|PureNum|UseAsOther|CanExit, Int52, loc0(G<Int52>/FlushedInt52), R:Variables(-1), bc#9) predicting Int52 16: < 1:-> MovHint(Check:Int52Rep:@15<Int52>, loc1, W:SideState, bc#9) 17: < 1:-> SetLocal(@53, CanExit, loc1(I~<Int52>/FlushedJSValue), W:Variables(-2), bc#12) predicting Int52 18: <!0:-> ForceOSRExit(MustGen|CanExit, W:SideState, bc#12) 19: < 1:-> GetLocal(@45, JS|UseAsOther|CanExit, Final, arg4(E<Final>/FlushedCell), R:Variables(10), bc#12) predicting Final 20: <!0:-> GetById(Check:Cell:@19, JS|MustGen|Clobbers|PureNum|UseAsOther|CanExit, id0{f}, R:World, W:World, bc#12) predicting None 21: < 1:-> MovHint(@20, loc2, W:SideState, bc#12) 22: < 1:-> SetLocal(@20, CanExit, loc2(K~/FlushedJSValue), W:Variables(-3), bc#21) predicting None 23: < 1:-> ArithSub(Check:DoubleRep:@55<Double>, Check:DoubleRep:@56<Double>, Double|PureNum|UseAsOther|CanExit, NotSet, bc#21) 24: < 1:-> MovHint(Check:DoubleRep:@23<Double>, loc1, W:SideState, bc#21) 25: < 1:-> SetLocal(@59, CanExit, loc1(L~/FlushedJSValue), W:Variables(-2), bc#26) predicting None 26: < 1:-> MovHint(Check:DoubleRep:@23<Double>, loc0, W:SideState, bc#26) 27: < 1:-> SetLocal(Check:Int52Rep:@23<Double>, CanExit, loc0(G<Int52>/FlushedInt52), W:Variables(-1), bc#29) predicting Int52 28: <!0:-> Jump(MustGen|CanExit, T:#2, W:SideState, bc#29) vars after: <empty> var links: arg4:@19 arg3:@48 arg2:@47 arg1:@46 loc0:@27 loc1:@25 loc2:@22 Block #2 (bc#29): Execution count: 1.000000 Predecessors: #0 #1 Dominated by: #0 #2 Dominates: #2 Phi Nodes: @39<1>->(@27, @12), @40<1>->(@45, @4), @41<1>->(@48, @3), @42<1>->(@47, @2), @43<1>->(@46, @1) vars before: <empty> var links: arg4:@34 arg3:@35 arg2:@36 arg1:@37 loc0:@39 29: < 1:-> GetLocal(@39, Int52|PureNum|UseAsOther|CanExit, Int52, loc0(G<Int52>/FlushedInt52), R:Variables(-1), bc#29) predicting Int52 30: < 1:-> JSConstant(JS|PureNum|UseAsOther, Int32, $0 = Int32: 1, bc#29) 31: < 1:-> ArithAdd(Check:Int52Rep:@29<Int52>, Check:Int52Rep:@30, Int52|UseAsOther|MayOverflowInBaseline|CanExit, Int52, CheckOverflow, bc#29) 32: < 1:-> MovHint(@31<Int52>, loc1, W:SideState, bc#29) 33: < 1:-> SetLocal(@31<Int52>, CanExit, loc1(O~<Int52>/FlushedJSValue), W:Variables(-2), bc#34) predicting Int52 34: <!0:-> Flush(@40, MustGen|IsFlushed, arg4(E<Final>/FlushedCell), W:SideState, bc#34) predicting Final 35: <!0:-> Flush(@41, MustGen|IsFlushed, arg3(D<Boolean>/FlushedBoolean), W:SideState, bc#34) predicting Bool 36: <!0:-> Flush(@42, MustGen|IsFlushed, arg2(C<Int32>/FlushedInt32), W:SideState, bc#34) predicting Int32 37: <!0:-> Flush(@43, MustGen|IsFlushed, arg1(B<Int32>/FlushedInt32), W:SideState, bc#34) predicting Int32 38: <!0:-> Return(@31<Int52>, MustGen|CanExit, W:SideState, bc#34) vars after: <empty> var links: arg4:@34 arg3:@35 arg2:@36 arg1:@37 loc0:@29<Int52> loc1:@33 1 0x186a02224 <redacted> 2 0x1868b3f74 <redacted> 3 0x1868b3c98 <redacted> 4 0x1868b3c30 <redacted> 5 0x186a3d6b0 <redacted> 6 0x186a3d308 <redacted> 7 0x186a0120c <redacted> 8 0x186b1a014 <redacted> 9 0x1432c8c5c 10 0x1432ca200 11 0x186ba3454 <redacted> 12 0x186b10c3c <redacted> 13 0x186852d84 <rRunning regress/script-tests/constant-test.js.no-llint [2014-07-15 12:49:48] INFO: edacted> 14 0x186850e30 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) 15 0x1000f7cb8 16 0x1000f7648 17 0x196772a08 <redacted> ./test_script_1950: line 2: 16616 Segmentation fault: 11 "$@" /System/Library/Frameworks/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --validateGraph\=true --thresholdForJITAfterWarmUp\=10 --thresholdForJITSoon\=10 --thresholdForOptimizeAfterWarmUp\=20 --thresholdForOptimizeAfterLongWarmUp\=20 --thresholdForOptimizeSoon\=20 --thresholdForFTLOptimizeAfterWarmUp\=20 --thresholdForFTLOptimizeSoon\=20 --enableConcurrentJIT\=false --thresholdForJITAfterWarmUp\=100 int52-force-osr-exit-path.js ERROR: Unexpected exit code: 139 1023482 2 msaboff 2014-07-19 14:18:14 -0700 The test failures were due to running new tests on builds that didn't include the corresponding changes.