151952 2015-12-07 11:35:58 -0800 DFG ASSERTION FAILED: m_plan.weakReferences.contains(structure). 2015-12-07 14:33:19 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 mark.lam fpizlo benjamin fpizlo ggaren keith_miller msaboff ossy saam webkit-bug-importer oldest_to_newest 1146923 0 mark.lam 2015-12-07 11:35:58 -0800 This fails on a debug build of r193635 on x86_64 when running the JSC tests: ** The following JSC stress test failures have been introduced: stress/ftl-has-a-bad-time.js.ftl-eager stress/ftl-has-a-bad-time.js.ftl-eager: DFG ASSERTION FAILED: m_plan.weakReferences.contains(structure) stress/ftl-has-a-bad-time.js.ftl-eager: /Volumes/Data/ws2/OpenSource/Source/JavaScriptCore/dfg/DFGGraph.cpp(1373) : void JSC::DFG::Graph::assertIsRegistered(JSC::Structure *) stress/ftl-has-a-bad-time.js.ftl-eager: stress/ftl-has-a-bad-time.js.ftl-eager: Graph at time of failure: stress/ftl-has-a-bad-time.js.ftl-eager: stress/ftl-has-a-bad-time.js.ftl-eager: DFG for foo#<no-hash>:[0x10ba77400->0x10ba77a00->0x10ba80900, DFGFunctionCall, 21 (NeverInline)]: stress/ftl-has-a-bad-time.js.ftl-eager: Fixpoint state: FixpointConverged; Form: SSA; Unification state: GloballyUnified; Ref count state: ExactRefCount stress/ftl-has-a-bad-time.js.ftl-eager: Argument formats: FlushedJSValue, FlushedBoolean stress/ftl-has-a-bad-time.js.ftl-eager: stress/ftl-has-a-bad-time.js.ftl-eager: Block #0 (bc#0): (OSR target) stress/ftl-has-a-bad-time.js.ftl-eager: Execution count: 1.000000 stress/ftl-has-a-bad-time.js.ftl-eager: Predecessors: stress/ftl-has-a-bad-time.js.ftl-eager: Successors: #1 (ForwardEdge) #2 (ForwardEdge) stress/ftl-has-a-bad-time.js.ftl-eager: Dominated by: #0 stress/ftl-has-a-bad-time.js.ftl-eager: Dominates: #0 #1 #2 #3 stress/ftl-has-a-bad-time.js.ftl-eager: Dominance Frontier: stress/ftl-has-a-bad-time.js.ftl-eager: Iterated Dominance Frontier: stress/ftl-has-a-bad-time.js.ftl-eager: Pre/Post Numbering: 0/3 stress/ftl-has-a-bad-time.js.ftl-eager: States: StructuresAreWatched stress/ftl-has-a-bad-time.js.ftl-eager: Availability: {locals = arg1:arg1:FlushedBoolean/Unavailable arg0:this:FlushedJSValue/Unavailable; heap = } stress/ftl-has-a-bad-time.js.ftl-eager: Live: stress/ftl-has-a-bad-time.js.ftl-eager: Values: stress/ftl-has-a-bad-time.js.ftl-eager: 27:< 2:-> JSConstant(JS|UseAsOther, Other, Null, bc#0) stress/ftl-has-a-bad-time.js.ftl-eager: 41:<!0:-> ExitOK(MustGen, W:SideState, bc#0) stress/ftl-has-a-bad-time.js.ftl-eager: 39:< 1:-> GetStack(JS|PureInt, Bool, arg1, machine:arg1, FlushedBoolean, R:Stack(6), bc#0) stress/ftl-has-a-bad-time.js.ftl-eager: 42:<!0:-> KillStack(MustGen, loc0, W:SideState, ClobbersExit, bc#0) stress/ftl-has-a-bad-time.js.ftl-eager: 3:<!0:-> ZombieHint(MustGen, loc0, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 43:<!0:-> KillStack(MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 5:<!0:-> ZombieHint(MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 44:<!0:-> KillStack(MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 7:<!0:-> ZombieHint(MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 45:<!0:-> KillStack(MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 9:<!0:-> ZombieHint(MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 46:<!0:-> KillStack(MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 11:<!0:-> ZombieHint(MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 47:<!0:-> KillStack(MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 13:<!0:-> ZombieHint(MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 48:<!0:-> KillStack(MustGen, loc3, W:SideState, ClobbersExit, bc#1) stress/ftl-has-a-bad-time.js.ftl-eager: 17:<!0:-> ZombieHint(MustGen, loc3, W:SideState, ClobbersExit, bc#1, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 49:<!0:-> KillStack(MustGen, loc4, W:SideState, ClobbersExit, bc#3) stress/ftl-has-a-bad-time.js.ftl-eager: 19:<!0:-> ZombieHint(MustGen, loc4, W:SideState, ClobbersExit, bc#3, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 22:<!0:-> Branch(Boolean:Kill:@39, MustGen, T:#1/w:1.000000, F:#2/w:1.000000, W:SideState, bc#6) stress/ftl-has-a-bad-time.js.ftl-eager: States: TakeBoth, StructuresAreWatched stress/ftl-has-a-bad-time.js.ftl-eager: Availability: {locals = arg1:arg1:FlushedBoolean/@39 arg0:this:FlushedJSValue/Unavailable; heap = } stress/ftl-has-a-bad-time.js.ftl-eager: Live: @27 stress/ftl-has-a-bad-time.js.ftl-eager: Values: @27=>(Other, Null) stress/ftl-has-a-bad-time.js.ftl-eager: stress/ftl-has-a-bad-time.js.ftl-eager: Block #1 (bc#9): stress/ftl-has-a-bad-time.js.ftl-eager: Execution count: 1.000000 stress/ftl-has-a-bad-time.js.ftl-eager: Predecessors: #0 stress/ftl-has-a-bad-time.js.ftl-eager: Successors: #3 (CrossEdge) stress/ftl-has-a-bad-time.js.ftl-eager: Dominated by: #0 #1 stress/ftl-has-a-bad-time.js.ftl-eager: Dominates: #1 stress/ftl-has-a-bad-time.js.ftl-eager: Dominance Frontier: #3 stress/ftl-has-a-bad-time.js.ftl-eager: Iterated Dominance Frontier: #3 stress/ftl-has-a-bad-time.js.ftl-eager: Pre/Post Numbering: 3/2 stress/ftl-has-a-bad-time.js.ftl-eager: States: StructuresAreWatched stress/ftl-has-a-bad-time.js.ftl-eager: Availability: {locals = arg1:arg1:FlushedBoolean/@39 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided; heap = } stress/ftl-has-a-bad-time.js.ftl-eager: Live: stress/ftl-has-a-bad-time.js.ftl-eager: Values: stress/ftl-has-a-bad-time.js.ftl-eager: 50:<!0:-> ExitOK(MustGen, W:SideState, bc#9) stress/ftl-has-a-bad-time.js.ftl-eager: 23:< 2:-> NewArrayBuffer(JS|UseAsOther, Array, 0:[Int32: 42], ArrayWithInt32, R:HeapObjectCount, W:HeapObjectCount, Exits, ClobbersExit, bc#9) stress/ftl-has-a-bad-time.js.ftl-eager: 51:<!0:-> KillStack(MustGen, loc6, W:SideState, ClobbersExit, bc#9, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 24:<!0:-> MovHint(Untyped:@23, MustGen, loc6, W:SideState, ClobbersExit, bc#9, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 52:< 1:-> Upsilon(Untyped:@23, ^40, W:SideState, bc#14) stress/ftl-has-a-bad-time.js.ftl-eager: 26:<!0:-> Jump(MustGen, T:#3, W:SideState, bc#14) stress/ftl-has-a-bad-time.js.ftl-eager: States: InvalidBranchDirection, StructuresAreWatched stress/ftl-has-a-bad-time.js.ftl-eager: Availability: {locals = arg1:arg1:FlushedBoolean/@39 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc6:ConflictingFlush/@23 loc7:DeadFlush/Undecided; heap = } stress/ftl-has-a-bad-time.js.ftl-eager: Live: @40 stress/ftl-has-a-bad-time.js.ftl-eager: Values: @40=>(Array, ArrayWithInt32, [%Cg:Array]) stress/ftl-has-a-bad-time.js.ftl-eager: stress/ftl-has-a-bad-time.js.ftl-eager: Block #2 (bc#16): stress/ftl-has-a-bad-time.js.ftl-eager: Execution count: 1.000000 stress/ftl-has-a-bad-time.js.ftl-eager: Predecessors: #0 stress/ftl-has-a-bad-time.js.ftl-eager: Successors: #3 (ForwardEdge) stress/ftl-has-a-bad-time.js.ftl-eager: Dominated by: #0 #2 stress/ftl-has-a-bad-time.js.ftl-eager: Dominates: #2 stress/ftl-has-a-bad-time.js.ftl-eager: Dominance Frontier: #3 stress/ftl-has-a-bad-time.js.ftl-eager: Iterated Dominance Frontier: #3 stress/ftl-has-a-bad-time.js.ftl-eager: Pre/Post Numbering: 1/1 stress/ftl-has-a-bad-time.js.ftl-eager: States: StructuresAreWatched stress/ftl-has-a-bad-time.js.ftl-eager: Availability: {locals = arg1:arg1:FlushedBoolean/@39 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided; heap = } stress/ftl-has-a-bad-time.js.ftl-eager: Live: @27 stress/ftl-has-a-bad-time.js.ftl-eager: Values: @27=>(Other, Null) stress/ftl-has-a-bad-time.js.ftl-eager: 55:<!0:-> ExitOK(MustGen, W:SideState, bc#16) stress/ftl-has-a-bad-time.js.ftl-eager: 56:<!0:-> KillStack(MustGen, loc6, W:SideState, ClobbersExit, bc#16) stress/ftl-has-a-bad-time.js.ftl-eager: 28:<!0:-> MovHint(Untyped:@27, MustGen, loc6, W:SideState, ClobbersExit, bc#16, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 57:< 1:-> Upsilon(Untyped:@27, ^40, W:SideState, bc#19) stress/ftl-has-a-bad-time.js.ftl-eager: 30:<!0:-> Jump(MustGen, T:#3, W:SideState, bc#19) stress/ftl-has-a-bad-time.js.ftl-eager: States: InvalidBranchDirection, StructuresAreWatched stress/ftl-has-a-bad-time.js.ftl-eager: Availability: {locals = arg1:arg1:FlushedBoolean/@39 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc6:ConflictingFlush/@27 loc7:DeadFlush/Undecided; heap = } stress/ftl-has-a-bad-time.js.ftl-eager: Live: @40 stress/ftl-has-a-bad-time.js.ftl-eager: Values: @40=>(Other, Null) stress/ftl-has-a-bad-time.js.ftl-eager: stress/ftl-has-a-bad-time.js.ftl-eager: Block #3 (bc#19): stress/ftl-has-a-bad-time.js.ftl-eager: Execution count: 1.000000 stress/ftl-has-a-bad-time.js.ftl-eager: Predecessors: #1 #2 stress/ftl-has-a-bad-time.js.ftl-eager: Successors: stress/ftl-has-a-bad-time.js.ftl-eager: Dominated by: #0 #3 stress/ftl-has-a-bad-time.js.ftl-eager: Dominates: #3 stress/ftl-has-a-bad-time.js.ftl-eager: Dominance Frontier: stress/ftl-has-a-bad-time.js.ftl-eager: Iterated Dominance Frontier: stress/ftl-has-a-bad-time.js.ftl-eager: Pre/Post Numbering: 2/0 stress/ftl-has-a-bad-time.js.ftl-eager: States: StructuresAreWatched stress/ftl-has-a-bad-time.js.ftl-eager: Availability: {locals = arg1:arg1:FlushedBoolean/@39 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc7:DeadFlush/Undecided; heap = } stress/ftl-has-a-bad-time.js.ftl-eager: Live: @40 stress/ftl-has-a-bad-time.js.ftl-eager: Values: @40=>(ArrayOther, ArrayWithInt32, [%Cg:Array]) stress/ftl-has-a-bad-time.js.ftl-eager: 40:< 2:-> Phi(JS|PureInt, ArrayOther, W:SideState, bc#19, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 53:<!0:-> MovHint(Untyped:@40, MustGen, loc6, W:SideState, ClobbersExit, bc#19, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 54:<!0:-> ExitOK(MustGen, W:SideState, bc#19) stress/ftl-has-a-bad-time.js.ftl-eager: 32:<!0:-> Return(Untyped:Kill:@40, MustGen, W:SideState, Exits, bc#19) stress/ftl-has-a-bad-time.js.ftl-eager: States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated stress/ftl-has-a-bad-time.js.ftl-eager: Availability: {locals = arg1:arg1:FlushedBoolean/@39 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc6:ConflictingFlush/@40 loc7:DeadFlush/Undecided; heap = } stress/ftl-has-a-bad-time.js.ftl-eager: Live: stress/ftl-has-a-bad-time.js.ftl-eager: Values: stress/ftl-has-a-bad-time.js.ftl-eager: stress/ftl-has-a-bad-time.js.ftl-eager: GC Values: stress/ftl-has-a-bad-time.js.ftl-eager: Weak:Cell: 0x10ba53fc0 (%CR:JSGlobalLexicalEnvironment), ID: 50 stress/ftl-has-a-bad-time.js.ftl-eager: Weak:Cell: 0x10ba604f0 (%AW:Function), ID: 51 stress/ftl-has-a-bad-time.js.ftl-eager: Desired watchpoints: stress/ftl-has-a-bad-time.js.ftl-eager: Watchpoint sets: stress/ftl-has-a-bad-time.js.ftl-eager: Inline watchpoint sets: 0x10ba3a460, 0x10ba276e0, 0x10ba27fe0, 0x10ba27ce0, 0x10ba26760, 0x10ba27e60 stress/ftl-has-a-bad-time.js.ftl-eager: Inferred values: 0x10ba71380 stress/ftl-has-a-bad-time.js.ftl-eager: Buffer views: stress/ftl-has-a-bad-time.js.ftl-eager: Object property conditions: stress/ftl-has-a-bad-time.js.ftl-eager: Inferred types: stress/ftl-has-a-bad-time.js.ftl-eager: Structures: stress/ftl-has-a-bad-time.js.ftl-eager: %AW:Function = 0x10ba26680:[Function, {}, NonArray, Proto:0x10ba35e00] stress/ftl-has-a-bad-time.js.ftl-eager: %CR:JSGlobalLexicalEnvironment = 0x10ba26700:[JSGlobalLexicalEnvironment, {}, NonArray, Leaf] stress/ftl-has-a-bad-time.js.ftl-eager: %Cg:Array = 0x10ba3a400:[Array, {}, ArrayWithInt32, Proto:0x10ba57f30, Shady leaf] stress/ftl-has-a-bad-time.js.ftl-eager: stress/ftl-has-a-bad-time.js.ftl-eager: stress/ftl-has-a-bad-time.js.ftl-eager: DFG ASSERTION FAILED: m_plan.weakReferences.contains(structure) stress/ftl-has-a-bad-time.js.ftl-eager: /Volumes/Data/ws2/OpenSource/Source/JavaScriptCore/dfg/DFGGraph.cpp(1373) : void JSC::DFG::Graph::assertIsRegistered(JSC::Structure *) stress/ftl-has-a-bad-time.js.ftl-eager: 1 0x1099cc360 WTFCrashWithSecurityImplication stress/ftl-has-a-bad-time.js.ftl-eager: 2 0x1090803df JSC::DFG::crash(JSC::DFG::Graph&, WTF::CString const&, char const*, int, char const*, char const*) stress/ftl-has-a-bad-time.js.ftl-eager: 3 0x1090802e9 JSC::DFG::Graph::handleAssertionFailure(std::nullptr_t, char const*, int, char const*, char const*) stress/ftl-has-a-bad-time.js.ftl-eager: 4 0x10907df67 JSC::DFG::Graph::assertIsRegistered(JSC::Structure*) stress/ftl-has-a-bad-time.js.ftl-eager: 5 0x10926d5ce JSC::DFG::StructureAbstractValue::assertIsRegistered(JSC::DFG::Graph&) const stress/ftl-has-a-bad-time.js.ftl-eager: 6 0x108f2b4bd JSC::DFG::AbstractValue::assertIsRegistered(JSC::DFG::Graph&) const stress/ftl-has-a-bad-time.js.ftl-eager: 7 0x108f2b55d JSC::DFG::AbstractValue::set(JSC::DFG::Graph&, JSC::Structure*) stress/ftl-has-a-bad-time.js.ftl-eager: 8 0x108fb3d4b JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::executeEffects(unsigned int, JSC::DFG::Node*) stress/ftl-has-a-bad-time.js.ftl-eager: 9 0x1091f7243 JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::executeEffects(unsigned int) stress/ftl-has-a-bad-time.js.ftl-eager: 10 0x1093233de JSC::FTL::(anonymous namespace)::LowerDFGToLLVM::compileNode(unsigned int) stress/ftl-has-a-bad-time.js.ftl-eager: 11 0x10932050b JSC::FTL::(anonymous namespace)::LowerDFGToLLVM::compileBlock(JSC::DFG::BasicBlock*) stress/ftl-has-a-bad-time.js.ftl-eager: 12 0x10931f5d9 JSC::FTL::(anonymous namespace)::LowerDFGToLLVM::lower() stress/ftl-has-a-bad-time.js.ftl-eager: 13 0x10931d80e JSC::FTL::lowerDFGToLLVM(JSC::FTL::State&) stress/ftl-has-a-bad-time.js.ftl-eager: 14 0x109193aae JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) stress/ftl-has-a-bad-time.js.ftl-eager: 15 0x109191a9d JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) stress/ftl-has-a-bad-time.js.ftl-eager: 16 0x109298ff0 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) stress/ftl-has-a-bad-time.js.ftl-eager: 17 0x109297514 JSC::DFG::Worklist::threadFunction(void*) stress/ftl-has-a-bad-time.js.ftl-eager: 18 0x109a36619 WTF::createThread(void (*)(void*), void*, char const*)::$_0::operator()() const stress/ftl-has-a-bad-time.js.ftl-eager: 19 0x109a365ed void std::__1::__invoke_void_return_wrapper<void>::__call<WTF::createThread(void (*)(void*), void*, char const*)::$_0&>(WTF::createThread(void (*)(void*), void*, char const*)::$_0&&&) stress/ftl-has-a-bad-time.js.ftl-eager: 20 0x109a3658c std::__1::__function::__func<WTF::createThread(void (*)(void*), void*, char const*)::$_0, std::__1::allocator<WTF::createThread(void (*)(void*), void*, char const*)::$_0>, void ()>::operator()() stress/ftl-has-a-bad-time.js.ftl-eager: 21 0x1093f87ea std::__1::function<void ()>::operator()() const stress/ftl-has-a-bad-time.js.ftl-eager: 22 0x109a352ee WTF::threadEntryPoint(void*) stress/ftl-has-a-bad-time.js.ftl-eager: 23 0x109a36b91 WTF::wtfThreadEntryPoint(void*) stress/ftl-has-a-bad-time.js.ftl-eager: 24 0x7fff9bfdb9b1 _pthread_body stress/ftl-has-a-bad-time.js.ftl-eager: 25 0x7fff9bfdb92e _pthread_body stress/ftl-has-a-bad-time.js.ftl-eager: 26 0x7fff9bfd9385 thread_start stress/ftl-has-a-bad-time.js.ftl-eager: test_script_11303: line 2: 48186 Segmentation fault: 11 ( "$@" ../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --useFunctionDotArguments\=true --useFTLJIT\=true --ftlCrashesIfCantInitializeLLVM\=true --thresholdForJITAfterWarmUp\=10 --thresholdForJITSoon\=10 --thresholdForOptimizeAfterWarmUp\=20 --thresholdForOptimizeAfterLongWarmUp\=20 --thresholdForOptimizeSoon\=20 --thresholdForFTLOptimizeAfterWarmUp\=20 --thresholdForFTLOptimizeSoon\=20 --maximumEvalCacheableSourceLength\=150000 ftl-has-a-bad-time.js ) stress/ftl-has-a-bad-time.js.ftl-eager: ERROR: Unexpected exit code: 139 1146924 1 webkit-bug-importer 2015-12-07 11:36:54 -0800 <rdar://problem/23786949> 1146928 2 mark.lam 2015-12-07 11:48:31 -0800 Looks likes the test has been failing intermittently since Fil landed it in http://trac.webkit.org/changeset/193480 for https://bugs.webkit.org/show_bug.cgi?id=151882. See https://bugs.webkit.org/show_bug.cgi?id=151882#c6. 1146932 3 fpizlo 2015-12-07 12:04:23 -0800 Fix on the way. 1146970 4 fpizlo 2015-12-07 13:07:44 -0800 I'm just checking that I've got the right fix. Sort of hard, given that it doesn't repro very reliably for me. I should have a fix by end of day. 1146971 5 fpizlo 2015-12-07 13:08:21 -0800 This is not a regression. This is a new test that reveals a very old bug. 1146998 6 fpizlo 2015-12-07 13:59:13 -0800 Nope, can't repro. I'll do the blind fix. 1147010 7 266813 fpizlo 2015-12-07 14:17:39 -0800 Created attachment 266813 the patch 1147018 8 266813 mark.lam 2015-12-07 14:30:26 -0800 Comment on attachment 266813 the patch r=me 1147021 9 fpizlo 2015-12-07 14:33:19 -0800 Landed in http://trac.webkit.org/changeset/193653 266813 2015-12-07 14:17:39 -0800 2015-12-07 14:30:26 -0800 the patch blah.patch text/plain 2067 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTkzNjUwKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBA CisyMDE1LTEyLTA3ICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg REZHIEFTU0VSVElPTiBGQUlMRUQ6IG1fcGxhbi53ZWFrUmVmZXJlbmNlcy5jb250YWlucyhzdHJ1 Y3R1cmUpLgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9 MTUxOTUyCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg Rml4IGEgYnVnIHJldmVhbGVkIGJ5IHRoZSBuZXcgZnRsLWhhcy1hLWJhZC10aW1lLmpzIHRlc3Qu IEl0IHR1cm5zIG91dCB0aGF0IG91ciBoYW5kbGluZyBvZgorICAgICAgICBzdHJ1Y3R1cmVzIHJl YWNoYWJsZSBmcm9tIHRoZSBjb21waWxlciB3YXNuJ3QgYWNjb3VudGluZyBmb3IgaGF2aW5nIGEg YmFkIHRpbWUuCisKKyAgICAgICAgKiBkZmcvREZHU3RydWN0dXJlUmVnaXN0cmF0aW9uUGhhc2Uu Y3BwOgorICAgICAgICAoSlNDOjpERkc6OlN0cnVjdHVyZVJlZ2lzdHJhdGlvblBoYXNlOjpydW4p OgorCiAyMDE1LTEyLTA3ICBTYWFtIGJhcmF0aSAgPHNiYXJhdGlAYXBwbGUuY29tPgogCiAgICAg ICAgIEFkZCBvcF93YXRjaGRvZyBvcGNvZGUgdGhhdCBpcyBnZW5lcmF0ZWQgd2hlbiBWTSBoYXMg YSB3YXRjaGRvZwpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdTdHJ1Y3R1cmVS ZWdpc3RyYXRpb25QaGFzZS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3Jl L2RmZy9ERkdTdHJ1Y3R1cmVSZWdpc3RyYXRpb25QaGFzZS5jcHAJKHJldmlzaW9uIDE5MzY0MikK KysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHU3RydWN0dXJlUmVnaXN0cmF0aW9uUGhh c2UuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xMDksOCArMTA5LDEyIEBAIHB1YmxpYzoKICAgICAg ICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgY2FzZSBOZXdBcnJheToKICAgICAgICAg ICAgICAgICBjYXNlIE5ld0FycmF5QnVmZmVyOgotICAgICAgICAgICAgICAgICAgICByZWdpc3Rl clN0cnVjdHVyZShtX2dyYXBoLmdsb2JhbE9iamVjdEZvcihub2RlLT5vcmlnaW4uc2VtYW50aWMp LT5hcnJheVN0cnVjdHVyZUZvckluZGV4aW5nVHlwZUR1cmluZ0FsbG9jYXRpb24obm9kZS0+aW5k ZXhpbmdUeXBlKCkpKTsKKyAgICAgICAgICAgICAgICBjYXNlIE5ld0FycmF5V2l0aFNpemU6IHsK KyAgICAgICAgICAgICAgICAgICAgSlNHbG9iYWxPYmplY3QqIGdsb2JhbE9iamVjdCA9IG1fZ3Jh cGguZ2xvYmFsT2JqZWN0Rm9yKG5vZGUtPm9yaWdpbi5zZW1hbnRpYyk7CisgICAgICAgICAgICAg ICAgICAgIHJlZ2lzdGVyU3RydWN0dXJlKGdsb2JhbE9iamVjdC0+YXJyYXlTdHJ1Y3R1cmVGb3JJ bmRleGluZ1R5cGVEdXJpbmdBbGxvY2F0aW9uKG5vZGUtPmluZGV4aW5nVHlwZSgpKSk7CisgICAg ICAgICAgICAgICAgICAgIHJlZ2lzdGVyU3RydWN0dXJlKGdsb2JhbE9iamVjdC0+b3JpZ2luYWxB cnJheVN0cnVjdHVyZUZvckluZGV4aW5nVHlwZShBcnJheVdpdGhTbG93UHV0QXJyYXlTdG9yYWdl KSk7CiAgICAgICAgICAgICAgICAgICAgIGJyZWFrOworICAgICAgICAgICAgICAgIH0KICAgICAg ICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgY2FzZSBOZXdUeXBlZEFycmF5OgogICAg ICAgICAgICAgICAgICAgICByZWdpc3RlclN0cnVjdHVyZShtX2dyYXBoLmdsb2JhbE9iamVjdEZv cihub2RlLT5vcmlnaW4uc2VtYW50aWMpLT50eXBlZEFycmF5U3RydWN0dXJlKG5vZGUtPnR5cGVk QXJyYXlUeXBlKCkpKTsK