145243 2015-05-20 21:52:18 -0700 JIT bug - fails when inspector closed, works when open 2015-06-16 22:47:42 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED http://rawgit.com/es-shims/es6-shim/master/test/index.html InRadar P1 Blocker --- 1 ljharb webkit-unassigned barraclough fpizlo ggaren msaboff oliver webkit-bug-importer ysuzuki oldest_to_newest 1096472 0 ljharb 2015-05-20 21:52:18 -0700 When accessing http://rawgit.com/es-shims/es6-shim/master/test/index.html on a current Nightly revision, it will fail with a bunch of `obj.__flags` errors (something in mocha/chai). However, when the dev inspector is *open*, they all/mostly pass as expected (some failures in older revisions are fine). This appears to have been introduced by r182007, r182008, or r182009 - http://trac.webkit.org/changeset/182009 looks related perhaps? Obviously this is super critical, and since I have no idea how it's broken I have no idea how many things this could break across the web :-) 1096473 1 ljharb 2015-05-20 21:53:59 -0700 (thanks to yusuke for confirming it's a JIT bug, and yusuke and twitter.com/rosskukulinski for helping me narrow down the problem revisions) 1096489 2 ysuzuki 2015-05-20 22:33:40 -0700 hm, at r182007, it already fails. So there's issue before r182007. The issue looks like that. In chai.js, we call function Assertion(...) { flag(this, '...', ...); flag(this, '...', ...); flag(this, '...', ...); } function flag(obj, ...) { accessing obj.__flags become error (obj is undefined) } function expect(...) { return new Assertion(...); } I guess 1. accidentally accessing incorrect location of arguments (`obj`). 2. accidentally `this` becomes undefined. 1096500 3 ljharb 2015-05-20 23:18:53 -0700 Hm, then it must be between r181893 and r182007 ? 1096505 4 ysuzuki 2015-05-21 00:05:14 -0700 r181993 seems the cause of this failure. In r181993, I've made sure that this issue occurs. http://trac.webkit.org/changeset/181993 1096648 5 webkit-bug-importer 2015-05-21 12:07:11 -0700 <rdar://problem/21061293> 1102023 6 msaboff 2015-06-15 13:38:37 -0700 The failure is manifest in the following code: function Assertion (obj, msg, stack) { flag(this, 'ssfi', stack || arguments.callee); // Eliminate arguments.callee and the bug goes away flag(this, 'object', obj); // The first argument, "this", is undefined in "flag()" flag(this, 'message', msg); } function flag(obj, key, value) { var flags = obj.__flags || (obj.__flags = Object.create(null)); if (arguments.length === 3) { flags[key] = value; } else { return flags[key]; } } The bytecode for Assertion is: Assertion#BsmUKj:[0x10b7dc720->0x10a04ab00, NoneFunctionConstruct, 140]: 140 m_instructions; 1120 bytes; 4 parameter(s); 14 callee register(s); 3 variable(s) [ 0] enter [ 1] get_scope loc0 [ 3] create_direct_arguments loc1 [ 5] create_this this, this, 0, 0 [ 10] mov loc2, loc1 [ 13] resolve_scope loc8, loc0, flag(@id0), 1<ThrowIfNotFound|GlobalVar>, 0 [ 20] get_from_scope loc3, loc8, flag(@id0), 1<ThrowIfNotFound|GlobalVar>, 201294216 predicting None [ 28] mov loc7, this [ 31] mov loc6, String (atomic) (identifier): ssfi, ID: 4(const0) [ 34] get_from_arguments loc5, loc1, 2 predicting None [ 39] jtrue loc5, 12(->51) [ 42] get_by_id loc5, loc2, callee(@id1) predicting None [ 51] call loc3, loc3, 4, 14 status(Could Take Slow Path, maxNumArguments = 1) Original; predicting None [ 60] resolve_scope loc8, loc0, flag(@id0), 1<ThrowIfNotFound|GlobalVar>, 0 [ 67] get_from_scope loc3, loc8, flag(@id0), 1<ThrowIfNotFound|GlobalVar>, 201294216 predicting None [ 75] mov loc7, this [ 78] mov loc6, String (atomic) (identifier): object, ID: 4(const1) [ 81] get_from_arguments loc5, loc1, 0 predicting None [ 86] call loc3, loc3, 4, 14 status(Could Take Slow Path, maxNumArguments = 1) Original; predicting None [ 95] resolve_scope loc8, loc0, flag(@id0), 1<ThrowIfNotFound|GlobalVar>, 0 [ 102] get_from_scope loc3, loc8, flag(@id0), 1<ThrowIfNotFound|GlobalVar>, 201294216 predicting None [ 110] mov loc7, this [ 113] mov loc6, String (atomic) (identifier): message, ID: 4(const2) [ 116] get_from_arguments loc5, loc1, 1 predicting None [ 121] call loc3, loc3, 4, 14 status(Could Take Slow Path, maxNumArguments = 1) Original; predicting None [ 130] is_object loc3, this [ 133] jtrue loc3, 5(->138) [ 136] ret this [ 138] ret this The bytecode for flag is: flag#D14VaO:[0x10b7dc980->0x10a04aa00, NoneFunctionCall, 132]: 132 m_instructions; 1056 bytes; 4 parameter(s); 14 callee register(s); 4 variable(s) [ 0] enter [ 1] get_scope loc0 [ 3] create_direct_arguments loc1 [ 5] mov loc3, loc1 [ 8] get_from_arguments loc5, loc1, 0 predicting None [ 13] get_by_id loc4, loc5, __flags(@id0) predicting None [ 22] jtrue loc4, 56(->78) [ 25] get_from_arguments loc5, loc1, 0 predicting None [ 30] resolve_scope loc8, loc0, Object(@id1), 0<ThrowIfNotFound|GlobalProperty>, 0 [ 37] get_from_scope loc8, loc8, Object(@id1), 0<ThrowIfNotFound|GlobalProperty>, 101 predicting None [ 45] get_by_id loc6, loc8, create(@id2) predicting None [ 54] mov loc7, Null(const0) [ 57] call loc6, loc6, 2, 14 status(Could Take Slow Path, maxNumArguments = 1) Original; predicting None [ 66] put_by_id loc5, __flags(@id0), loc6 [ 75] mov loc4, loc6 [ 78] mov loc2, loc4 [ 81] get_by_id loc4, loc3, length(@id3) predicting None [ 90] stricteq loc4, loc4, Int32: 3(const1) [ 94] jfalse loc4, 23(->117) [ 97] mov loc4, loc2 [ 100] get_from_arguments loc5, loc1, 1 predicting None [ 105] get_from_arguments loc6, loc1, 2 predicting None [ 110] put_by_val loc4, loc5, loc6 Original [ 115] jmp 15(->130) [ 117] get_from_arguments loc4, loc1, 1 predicting None [ 122] get_by_val loc4, loc2, loc4 Original; predicting None [ 128] ret loc4 [ 130] ret Undefined(const2) All three instances of "flag()" are inlined. The problem is during the second call to flag(), we get "undefined" for the base object when executing bc#13, get_by_id. The reason is during local CSE, we replace object we use as the base. Before local CSE: 189:< 1:-> CreateDirectArguments(JS|UseAsOther, Directarguments, R:Stack,HeapObjectCount, W:HeapObjectCount, bc#3) ... 194:< 1:-> GetFromArguments(Check:KnownCell:@189, JS|UseAsOther, Final, capturedArgument0, R:DirectArgumentsProperties(0), bc#8) predicting Final ... 197:<!0:-> GetById(Check:Cell:@194, JS|MustGen|UseAsOther, Final, id2{__flags}, R:World, W:Heap, bc#13) predicting Final After local CSE: 171:<!0:-> GetLocal(@457, JS|MustGen|UseAsOther, Directarguments, loc1(I<DirectArguments>/FlushedCell), R:Stack(-2), bc#81) predicting Directarguments 172:< 1:-> GetFromArguments(Check:KnownCell:@171, JS|UseAsOther, Other, capturedArgument0, R:DirectArgumentsProperties(0), bc#81) predicting Other 197:<!0:-> GetById(Check:Cell:@172, JS|MustGen|UseAsOther, Final, id2{__flags}, R:World, W:Heap, bc#13) predicting Final Where 172 is the GetFromArguments in Assertion. The problem is in DFGClobberize::cloberize() and its handling of GetFromArguments. 1102033 7 254893 msaboff 2015-06-15 14:09:54 -0700 Created attachment 254893 Patch 1102040 8 msaboff 2015-06-15 14:26:44 -0700 Committed r185566: <http://trac.webkit.org/changeset/185566> 1102043 9 254893 fpizlo 2015-06-15 14:33:55 -0700 Comment on attachment 254893 Patch r=me too 1102484 10 ljharb 2015-06-16 22:47:42 -0700 Thanks, this looks great in the latest nightly build! 254893 2015-06-15 14:09:54 -0700 2015-06-15 14:13:33 -0700 Patch 145243.patch text/plain 4534 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTg1NTY1KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE3IEBA CisyMDE1LTA2LTE1ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIEpJVCBidWcgLSBmYWlscyB3aGVuIGluc3BlY3RvciBjbG9zZWQsIHdvcmtzIHdoZW4gb3Bl bgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTQ1MjQz CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgV2UgbmVl ZCB0byBwcm92aWRlIHRoZSBBcmd1bWVudHMgb2JqZWN0IGFzIHRoZSBiYXNlIHdoZW4gY3JlYXRp bmcgdGhlIEhlYXBMb2NhdGlvbiBmb3IKKyAgICAgICAgR2V0RnJvbUFyZ3VtZW50cyBhbmQgUHV0 VG9Bcmd1bWVudHMuICBPdGhlcndpc2Ugd2UgZW5kdXAgY3JlYXRpbmcgYSBIZWFwTG9jYXRpb24g Zm9yCisgICAgICAgIGFueSBhcmd1bWVudHMgb2JqZWN0LCBub3QgdGhlIG9uZSB3ZSBuZWVkLgor CisgICAgICAgICogZGZnL0RGR0Nsb2JiZXJpemUuaDoKKyAgICAgICAgKEpTQzo6REZHOjpjbG9i YmVyaXplKToKKwogMjAxNS0wNi0xMyAgSm9zZXBoIFBlY29yYXJvICA8cGVjb3Jhcm9AYXBwbGUu Y29tPgogCiAgICAgICAgIFdlYiBJbnNwZWN0b3I6IGNvbnNvbGUudGFibGUoKSB3aXRoIGEgbGlz dCBvZiBvYmplY3RzIG5vIGxvbmdlciB3b3JrcwpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3Jl L2RmZy9ERkdDbG9iYmVyaXplLmgKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3Jl L2RmZy9ERkdDbG9iYmVyaXplLmgJKHJldmlzaW9uIDE4NTU2MykKKysrIFNvdXJjZS9KYXZhU2Ny aXB0Q29yZS9kZmcvREZHQ2xvYmJlcml6ZS5oCSh3b3JraW5nIGNvcHkpCkBAIC04MjAsMTQgKzgy MCwxNCBAQCB2b2lkIGNsb2JiZXJpemUoR3JhcGgmIGdyYXBoLCBOb2RlKiBub2RlCiAgICAgY2Fz ZSBHZXRGcm9tQXJndW1lbnRzOiB7CiAgICAgICAgIEFic3RyYWN0SGVhcCBoZWFwKERpcmVjdEFy Z3VtZW50c1Byb3BlcnRpZXMsIG5vZGUtPmNhcHR1cmVkQXJndW1lbnRzT2Zmc2V0KCkub2Zmc2V0 KCkpOwogICAgICAgICByZWFkKGhlYXApOwotICAgICAgICBkZWYoSGVhcExvY2F0aW9uKERpcmVj dEFyZ3VtZW50c0xvYywgaGVhcCksIExhenlOb2RlKG5vZGUpKTsKKyAgICAgICAgZGVmKEhlYXBM b2NhdGlvbihEaXJlY3RBcmd1bWVudHNMb2MsIGhlYXAsIG5vZGUtPmNoaWxkMSgpKSwgTGF6eU5v ZGUobm9kZSkpOwogICAgICAgICByZXR1cm47CiAgICAgfQogICAgICAgICAKICAgICBjYXNlIFB1 dFRvQXJndW1lbnRzOiB7CiAgICAgICAgIEFic3RyYWN0SGVhcCBoZWFwKERpcmVjdEFyZ3VtZW50 c1Byb3BlcnRpZXMsIG5vZGUtPmNhcHR1cmVkQXJndW1lbnRzT2Zmc2V0KCkub2Zmc2V0KCkpOwog ICAgICAgICB3cml0ZShoZWFwKTsKLSAgICAgICAgZGVmKEhlYXBMb2NhdGlvbihEaXJlY3RBcmd1 bWVudHNMb2MsIGhlYXApLCBMYXp5Tm9kZShub2RlLT5jaGlsZDIoKS5ub2RlKCkpKTsKKyAgICAg ICAgZGVmKEhlYXBMb2NhdGlvbihEaXJlY3RBcmd1bWVudHNMb2MsIGhlYXAsIG5vZGUtPmNoaWxk MSgpKSwgTGF6eU5vZGUobm9kZS0+Y2hpbGQyKCkubm9kZSgpKSk7CiAgICAgICAgIHJldHVybjsK ICAgICB9CiAgICAgICAgIApJbmRleDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K LS0tIExheW91dFRlc3RzL0NoYW5nZUxvZwkocmV2aXNpb24gMTg1NTY1KQorKysgTGF5b3V0VGVz dHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTkgQEAKKzIwMTUtMDYtMTUg IE1pY2hhZWwgU2Fib2ZmICA8bXNhYm9mZkBhcHBsZS5jb20+CisKKyAgICAgICAgSklUIGJ1ZyAt IGZhaWxzIHdoZW4gaW5zcGVjdG9yIGNsb3NlZCwgd29ya3Mgd2hlbiBvcGVuCisgICAgICAgIGh0 dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNDUyNDMKKworICAgICAgICBS ZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBOZXcgcmVncmVzc2lvbiB0ZXN0 LgorCisgICAgICAgICoganMvcmVncmVzcy0xNDUyNDMtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAg ICAgICAgKiBqcy9yZWdyZXNzLTE0NTI0My5odG1sOiBBZGRlZC4KKyAgICAgICAgKiBqcy9zY3Jp cHQtdGVzdHMvcmVncmVzcy0xNDUyNDMuanM6IEFkZGVkLgorICAgICAgICAoYmFyKToKKyAgICAg ICAgKGZvbyk6CisgICAgICAgICh0ZXN0KToKKwogMjAxNS0wNi0xNSAgSm9zZXBoIFBlY29yYXJv ICA8cGVjb3Jhcm9AYXBwbGUuY29tPgogCiAgICAgICAgIFVucmV2aWV3ZWQsIGdhcmRlbmluZyBm b3IgV2luZG93cy4KSW5kZXg6IExheW91dFRlc3RzL2pzL3JlZ3Jlc3MtMTQ1MjQzLWV4cGVjdGVk LnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9qcy9yZWdyZXNzLTE0NTI0My1leHBlY3Rl ZC50eHQJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9qcy9yZWdyZXNzLTE0NTI0My1leHBl Y3RlZC50eHQJKHdvcmtpbmcgY29weSkKQEAgLTAsMCArMSwxMCBAQAorVmVyaWZ5IHRoYXQgd2Ug ZG9uJ3QgdXNlIG91ciBjYWxsZXIncyBhcmd1bWVudHMgb2JqZWN0IGluIGFuIGlubGluZWQgZnVu Y3Rpb24uCisKK09uIHN1Y2Nlc3MsIHlvdSB3aWxsIHNlZSBhIHNlcmllcyBvZiAiUEFTUyIgbWVz c2FnZXMsIGZvbGxvd2VkIGJ5ICJURVNUIENPTVBMRVRFIi4KKworCitQQVNTIENvcnJlY3RseSBh Y2Nlc3NlZCBpbmxpbmVkIGNhbGxlZSdzIG93biBhcmd1bWVudHMKK1BBU1Mgc3VjY2Vzc2Z1bGx5 UGFyc2VkIGlzIHRydWUKKworVEVTVCBDT01QTEVURQorCkluZGV4OiBMYXlvdXRUZXN0cy9qcy9y ZWdyZXNzLTE0NTI0My5odG1sCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2pzL3JlZ3Jlc3Mt MTQ1MjQzLmh0bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9qcy9yZWdyZXNzLTE0NTI0 My5odG1sCSh3b3JraW5nIGNvcHkpCkBAIC0wLDAgKzEsMTAgQEAKKzwhRE9DVFlQRSBIVE1MIFBV QkxJQyAiLS8vSUVURi8vRFREIEhUTUwvL0VOIj4KKzxodG1sPgorPGhlYWQ+Cis8c2NyaXB0IHNy Yz0iLi4vcmVzb3VyY2VzL2pzLXRlc3QtcHJlLmpzIj48L3NjcmlwdD4KKzwvaGVhZD4KKzxib2R5 PgorPHNjcmlwdCBzcmM9InNjcmlwdC10ZXN0cy9yZWdyZXNzLTE0NTI0My5qcyI+PC9zY3JpcHQ+ Cis8c2NyaXB0IHNyYz0iLi4vcmVzb3VyY2VzL2pzLXRlc3QtcG9zdC5qcyI+PC9zY3JpcHQ+Cis8 L2JvZHk+Cis8L2h0bWw+CkluZGV4OiBMYXlvdXRUZXN0cy9qcy9zY3JpcHQtdGVzdHMvcmVncmVz cy0xNDUyNDMuanMKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvanMvc2NyaXB0LXRlc3RzL3Jl Z3Jlc3MtMTQ1MjQzLmpzCShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvanMvc2NyaXB0LXRl c3RzL3JlZ3Jlc3MtMTQ1MjQzLmpzCSh3b3JraW5nIGNvcHkpCkBAIC0wLDAgKzEsMjkgQEAKK2Rl c2NyaXB0aW9uKCJWZXJpZnkgdGhhdCB3ZSBkb24ndCB1c2Ugb3VyIGNhbGxlcidzIGFyZ3VtZW50 cyBvYmplY3QgaW4gYW4gaW5saW5lZCBmdW5jdGlvbi4iKTsKKworZnVuY3Rpb24gYmFyKHgpIHsK KyAgICB2YXIgdCA9IGFyZ3VtZW50czsKKyAgICB2YXIgYSA9IHg7CisgICAgcmV0dXJuIGE7Cit9 CisKK2Z1bmN0aW9uIGZvbyh4KSB7CisgICAgdmFyIHQgPSBhcmd1bWVudHM7CisgICAgdmFyIGEg PSB4OworICAgIHJldHVybiBiYXIoMSk7Cit9CisKK25vSW5saW5lKGZvbyk7CisKK2Z1bmN0aW9u IHRlc3QoKSB7CisgICAgZm9yICh2YXIgaSA9IDA7IGkgPCAxMDAwMDsgKytpKSB7CisgICAgICAg IHZhciByZXN1bHQgPSBmb28oNDIpOworICAgICAgICBpZiAocmVzdWx0ICE9IDEpIHsKKyAgICAg ICAgICAgIHRlc3RGYWlsZWQoIkV4cGVjdGVkIDEsIGJ1dCBnb3QgIiArIHJlc3VsdCk7CisgICAg ICAgICAgICByZXR1cm4gZmFsc2U7CisgICAgICAgIH0KKyAgICB9CisgICAgcmV0dXJuIHRydWU7 Cit9CisKK2lmICh0ZXN0KCkpCisgICB0ZXN0UGFzc2VkKCJDb3JyZWN0bHkgYWNjZXNzZWQgaW5s aW5lZCBjYWxsZWUncyBvd24gYXJndW1lbnRzIik7Cg==