<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>139865</bug_id>
          
          <creation_ts>2014-12-22 09:26:37 -0800</creation_ts>
          <short_desc>js/promises-tests/promises-tests-2-3-3.html sometimes crashes under DFG::SpeculativeJIT::compile</short_desc>
          <delta_ts>2015-03-26 10:05:19 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Alexey Proskuryakov">ap</reporter>
          <assigned_to name="Michael Saboff">msaboff</assigned_to>
          <cc>fpizlo</cc>
    
    <cc>ggaren</cc>
    
    <cc>mark.lam</cc>
    
    <cc>msaboff</cc>
    
    <cc>webkit-bug-importer</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1057388</commentid>
    <comment_count>0</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2014-12-22 09:26:37 -0800</bug_when>
    <thetext>run-webkit-tests js/promises-tests/promises-tests-2-3-3.html -f --repeat 1000

Thread 13 Crashed:: DFG Worklist Worker Thread
0   com.apple.JavaScriptCore      	0x0000000103d62c8a WTFCrash + 42 (Assertions.cpp:321)
1   com.apple.JavaScriptCore      	0x00000001037acc31 JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node*) + 79505 (DFGSpeculativeJIT64.cpp:4540)
2   com.apple.JavaScriptCore      	0x000000010374e17a JSC::DFG::SpeculativeJIT::compileCurrentBlock() + 1754 (DFGSpeculativeJIT.cpp:1463)
3   com.apple.JavaScriptCore      	0x000000010374e946 JSC::DFG::SpeculativeJIT::compile() + 182 (DFGSpeculativeJIT.cpp:1568)
4   com.apple.JavaScriptCore      	0x00000001036d72a7 JSC::DFG::JITCompiler::compileBody() + 55 (DFGJITCompiler.cpp:113)
5   com.apple.JavaScriptCore      	0x00000001036d9d73 JSC::DFG::JITCompiler::compileFunction() + 1187 (DFGJITCompiler.cpp:354)
6   com.apple.JavaScriptCore      	0x000000010373b040 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&amp;) + 3184 (DFGPlan.cpp:302)
7   com.apple.JavaScriptCore      	0x000000010373a041 JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&amp;, JSC::DFG::ThreadData*) + 417 (DFGPlan.cpp:164)
8   com.apple.JavaScriptCore      	0x00000001038049c9 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) + 745 (DFGWorklist.cpp:358)
9   com.apple.JavaScriptCore      	0x0000000103802ef4 JSC::DFG::Worklist::threadFunction(void*) + 36 (DFGWorklist.cpp:401)
10  com.apple.JavaScriptCore      	0x0000000103db8ed9 WTF::createThread(void (*)(void*), void*, char const*)::$_0::operator()() const + 25 (Threading.cpp:82)

rdar://problem/19326058</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1057390</commentid>
    <comment_count>1</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2014-12-22 09:39:26 -0800</bug_when>
    <thetext>Skipped the test in r177633.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1057398</commentid>
    <comment_count>2</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2014-12-22 10:41:08 -0800</bug_when>
    <thetext>This test used to have a Slow expectation, which will need to be reinstated once the crash is fixed.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1080305</commentid>
    <comment_count>3</comment_count>
      <attachid>249493</attachid>
    <who name="Michael Saboff">msaboff</who>
    <bug_when>2015-03-26 09:54:30 -0700</bug_when>
    <thetext>Created attachment 249493
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1080308</commentid>
    <comment_count>4</comment_count>
    <who name="Michael Saboff">msaboff</who>
    <bug_when>2015-03-26 10:05:19 -0700</bug_when>
    <thetext>Committed r182013: &lt;http://trac.webkit.org/changeset/182013&gt;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>249493</attachid>
            <date>2015-03-26 09:54:30 -0700</date>
            <delta_ts>2015-03-26 10:02:30 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>139865.patch</filename>
            <type>text/plain</type>
            <size>2026</size>
            <attacher name="Michael Saboff">msaboff</attacher>
            
              <data encoding="base64">SW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9D
aGFuZ2VMb2cJKHJldmlzaW9uIDE4MjAxMikKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwkod29y
a2luZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBACisyMDE1LTAzLTI2ICBNaWNoYWVsIFNhYm9mZiAg
PG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAgICAgIGpzL3Byb21pc2VzLXRlc3RzL3Byb21pc2Vz
LXRlc3RzLTItMy0zLmh0bWwgc29tZXRpbWVzIGNyYXNoZXMgdW5kZXIgREZHOjpTcGVjdWxhdGl2
ZUpJVDo6Y29tcGlsZQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j
Z2k/aWQ9MTM5ODY1CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg
ICAgICAgSXQgYXBwZWFycyB0aGF0IHIxODE5OTMgZml4ZWQgdGhpcyB0ZXN0IGFzIGl0IHJlbW92
ZWQgdGhlIGNvZGUgd2hlcmUgdGhlIGNyYXNoIG9jY3VycmVkLgorCisgICAgICAgICogVGVzdEV4
cGVjdGF0aW9uczogUmUtZW5hYmxlZCBqcy9wcm9taXNlcy10ZXN0cy9wcm9taXNlcy10ZXN0cy0y
LTMtMyBpbmNsdWRpbmcgbWFya2luZyBpdCBhcyBTbG93LgorCiAyMDE1LTAzLTI2ICBDaHJpcyBG
bGVpemFjaCAgPGNmbGVpemFjaEBhcHBsZS5jb20+CiAKICAgICAgICAgQVg6IFtyb2xlPSJidXR0
b24iXVthcmlhLXByZXNzZWRdIHNob3VsZCBiZSBleHBvc2VkIGFzIEFYQ2hlY2tib3g6QVhUb2dn
bGVCdXR0b24sIHdpdGggcm9sZSBkZXNjcmlwdGlvbiBvZiAidG9nZ2xlIGJ1dHRvbiIKSW5kZXg6
IExheW91dFRlc3RzL1Rlc3RFeHBlY3RhdGlvbnMKPT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMv
VGVzdEV4cGVjdGF0aW9ucwkocmV2aXNpb24gMTgyMDA4KQorKysgTGF5b3V0VGVzdHMvVGVzdEV4
cGVjdGF0aW9ucwkod29ya2luZyBjb3B5KQpAQCAtMTgwLDYgKzE4MCw5IEBAIHdlYmtpdC5vcmcv
Yi8xMzY3NTQgY3NzMy9mbGV4Ym94L2Nzc3dnL3QKICMgbnRoLWNoaWxkIHRlc3RzIHRha2VzIGxv
bmcgdGltZSBhbmQgRGVidWcgYnVpbGQgc29tZXRpbWVzIHRpbWVvdXRzIGJlY2F1c2UgdGhlcmUg
YXJlIG1hbnkgdGVzdCBjYXNlcy4KIHdlYmtpdC5vcmcvYi8xMzcxNDkgZmFzdC9zZWxlY3RvcnMv
bnRoLWNoaWxkLW9mLWJhc2ljcy5odG1sIFsgU2xvdyBdCiAKKyMgUHJvbWlzZXMvQSsgMi4zLjMg
aGFzIG1hbnkgdGVzdHMgYW5kIGl0IHNvbWV0aW1lcyBleGNlZWRzIHRoZSB0aW1lIGxpbWl0LiAK
K3dlYmtpdC5vcmcvYi8xMzY4NzgganMvcHJvbWlzZXMtdGVzdHMvcHJvbWlzZXMtdGVzdHMtMi0z
LTMuaHRtbCBbIFNsb3cgXSAKKwogIyBAc3VwcG9ydHMgVzNDIEZhaWx1cmVzCiB3ZWJraXQub3Jn
L2IvMTM3NTY2IGNzczMvY29uZGl0aW9uYWwvdzNjL2F0LXN1cHBvcnRzLTAxMC5odG1sIFsgSW1h
Z2VPbmx5RmFpbHVyZSBdCiB3ZWJraXQub3JnL2IvMTM3NTY4IGNzczMvY29uZGl0aW9uYWwvdzNj
L2F0LXN1cHBvcnRzLTAxNC5odG1sIFsgSW1hZ2VPbmx5RmFpbHVyZSBdCkBAIC00NjMsNyArNDY2
LDYgQEAgd2Via2l0Lm9yZy9iLzEzNTA1MyBbIERlYnVnIF0gaHRtbDVsaWIvdwogWyBEZWJ1ZyBd
IGZhc3Qvd29ya2Vycy9kZWRpY2F0ZWQtd29ya2VyLWxpZmVjeWNsZS5odG1sIFsgU2xvdyBdCiAK
IHdlYmtpdC5vcmcvYi8xNDIxNzUganMvcHJvbWlzZXMtdGVzdHMvcHJvbWlzZXMtdGVzdHMtMi0x
LTIuaHRtbCBbIFBhc3MgVGltZW91dCBdCi13ZWJraXQub3JnL2IvMTM5ODY1IGpzL3Byb21pc2Vz
LXRlc3RzL3Byb21pc2VzLXRlc3RzLTItMy0zLmh0bWwgWyBTa2lwIF0KIAogd2Via2l0Lm9yZy9i
LzEzOTg0MCBmYXN0L3htbGh0dHByZXF1ZXN0L3htbGh0dHByZXF1ZXN0LXJlY3Vyc2l2ZS1zeW5j
LWV2ZW50Lmh0bWwgWyBQYXNzIEZhaWx1cmUgXQogCg==
</data>
<flag name="review"
          id="274308"
          type_id="1"
          status="+"
          setter="ap"
    />
          </attachment>
      

    </bug>

</bugzilla>