157099 2016-04-27 12:53:56 -0700 REGRESSION(r200117): Crash in lowerDFGToB3::compileStringReplace() 2016-04-27 13:37:20 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 msaboff msaboff commit-queue keith_miller mark.lam saam webkit-bug-importer oldest_to_newest 1187920 0 msaboff 2016-04-27 12:53:56 -0700 Debug build crash in lowerDFGToB3::compileStringReplace() during compilation: Thread 8 Crashed:: FTL Worklist Worker Thread 0 com.apple.JavaScriptCore 0x00000001046942e5 0x103bf6000 + 11133669 1 com.apple.JavaScriptCore 0x0000000103f29bfc JSC::DFG::crash(JSC::DFG::Graph&, WTF::CString const&, char const*, int, char const*, char const*) + 412 2 com.apple.JavaScriptCore 0x0000000103f29c9f JSC::DFG::Graph::handleAssertionFailure(JSC::DFG::Node*, char const*, int, char const*, char const*) + 159 3 com.apple.JavaScriptCore 0x00000001040ee935 JSC::FTL::(anonymous namespace)::LowerDFGToB3::lowJSValue(JSC::DFG::Edge, JSC::DFG::OperandSpeculationMode) + 1237 (FTLLowerDFGToB3.cpp:9455) 4 com.apple.JavaScriptCore 0x00000001040a2ea6 JSC::FTL::(anonymous namespace)::LowerDFGToB3::compileNode(unsigned int) + 5830 (FTLLowerDFGToB3.cpp:6861) 5 com.apple.JavaScriptCore 0x000000010409ef78 JSC::FTL::lowerDFGToB3(JSC::FTL::State&) + 7880 (FTLLowerDFGToB3.cpp:390) 6 com.apple.JavaScriptCore 0x0000000103fc6bb1 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) + 1969 (DFGPlan.cpp:163) 7 com.apple.JavaScriptCore 0x0000000103fc60c1 JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) + 577 (DFGPlan.cpp:182) 8 com.apple.JavaScriptCore 0x000000010407c2e3 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) + 1059 (RefPtr.h:69) 9 com.apple.JavaScriptCore 0x00000001046c8d42 WTF::threadEntryPoint(void*) + 178 (functional:1742) 10 com.apple.JavaScriptCore 0x00000001046c90ef WTF::wtfThreadEntryPoint(void*) + 15 (memory:2657) 11 libsystem_pthread.dylib 0x00007fff995a699d _pthread_body + 131 12 libsystem_pthread.dylib 0x00007fff995a691a _pthread_start + 168 13 libsystem_pthread.dylib 0x00007fff995a4351 thread_start + 13 1187921 1 webkit-bug-importer 2016-04-27 12:54:29 -0700 <rdar://problem/25963453> 1187924 2 277529 msaboff 2016-04-27 12:58:08 -0700 Created attachment 277529 Patch 1187927 3 277529 saam 2016-04-27 13:02:50 -0700 Comment on attachment 277529 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=277529&action=review > Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:6942 > + // The Edge for Child2 may have been fixed up as StringUse. not sure this comment adds much 1187928 4 msaboff 2016-04-27 13:04:23 -0700 (In reply to comment #3) > Comment on attachment 277529 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=277529&action=review > > > Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:6942 > > + // The Edge for Child2 may have been fixed up as StringUse. > > not sure this comment adds much Removed locally. 1187930 5 keith_miller 2016-04-27 13:17:42 -0700 r=me too. Fixes my crash. 1187935 6 msaboff 2016-04-27 13:37:20 -0700 Committed r200147: <http://trac.webkit.org/changeset/200147> 277529 2016-04-27 12:58:08 -0700 2016-04-27 13:02:37 -0700 Patch 157099.patch text/plain 1732 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjAwMTQ1KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBA CisyMDE2LTA0LTI3ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIFJFR1JFU1NJT04ocjIwMDExNyk6IENyYXNoIGluIGxvd2VyREZHVG9CMzo6Y29tcGlsZVN0 cmluZ1JlcGxhY2UoKQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j Z2k/aWQ9MTU3MDk5CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg ICAgICAgR2l2ZW4gdGhhdCB0aGUgREZHRml4dXBQaGFzZSBjb3VsZCBtYXJrIHRoZSBlZGdlIG9m IGNoaWxkMiBhcyBTdHJpbmdVc2UsCisgICAgICAgIHdlIG5lZWQgdG8gbG93ZXIgdGhhdCBlZGdl IGFwcHJvcHJpYXRlbHkuCisKKyAgICAgICAgKiBmdGwvRlRMTG93ZXJERkdUb0IzLmNwcDoKKyAg ICAgICAgKEpTQzo6RlRMOjpERkc6Okxvd2VyREZHVG9CMzo6Y29tcGlsZVN0cmluZ1JlcGxhY2Up OgorCiAyMDE2LTA0LTI3ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KIAogICAgICAg ICBBZGRyZXNzIGZlZWRiYWNrIGZyb20gaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcu Y2dpP2lkPTE1NzA0OCNjNS4KSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9mdGwvRlRMTG93 ZXJERkdUb0IzLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZnRsL0ZU TExvd2VyREZHVG9CMy5jcHAJKHJldmlzaW9uIDIwMDEzNCkKKysrIFNvdXJjZS9KYXZhU2NyaXB0 Q29yZS9mdGwvRlRMTG93ZXJERkdUb0IzLmNwcAkod29ya2luZyBjb3B5KQpAQCAtNjkzOSw5ICs2 OTM5LDE2IEBAIHByaXZhdGU6CiAgICAgICAgICAgICByZXR1cm47CiAgICAgICAgIH0KICAgICAg ICAgCisgICAgICAgIC8vIFRoZSBFZGdlIGZvciBDaGlsZDIgbWF5IGhhdmUgYmVlbiBmaXhlZCB1 cCBhcyBTdHJpbmdVc2UuCisgICAgICAgIExWYWx1ZSBzZWFyY2g7CisgICAgICAgIGlmIChtX25v ZGUtPmNoaWxkMigpLnVzZUtpbmQoKSA9PSBTdHJpbmdVc2UpCisgICAgICAgICAgICBzZWFyY2gg PSBsb3dTdHJpbmcobV9ub2RlLT5jaGlsZDIoKSk7CisgICAgICAgIGVsc2UKKyAgICAgICAgICAg IHNlYXJjaCA9IGxvd0pTVmFsdWUobV9ub2RlLT5jaGlsZDIoKSk7CisKICAgICAgICAgTFZhbHVl IHJlc3VsdCA9IHZtQ2FsbCgKICAgICAgICAgICAgIEludDY0LCBtX291dC5vcGVyYXRpb24ob3Bl cmF0aW9uU3RyaW5nUHJvdG9GdW5jUmVwbGFjZUdlbmVyaWMpLCBtX2NhbGxGcmFtZSwKLSAgICAg ICAgICAgIGxvd0pTVmFsdWUobV9ub2RlLT5jaGlsZDEoKSksIGxvd0pTVmFsdWUobV9ub2RlLT5j aGlsZDIoKSksCisgICAgICAgICAgICBsb3dKU1ZhbHVlKG1fbm9kZS0+Y2hpbGQxKCkpLCBzZWFy Y2gsCiAgICAgICAgICAgICBsb3dKU1ZhbHVlKG1fbm9kZS0+Y2hpbGQzKCkpKTsKIAogICAgICAg ICBzZXRKU1ZhbHVlKHJlc3VsdCk7Cg==