165651 2016-12-09 03:34:07 -0800 REGRESSION(r208791): Assertion in testb3 2016-12-10 01:29:42 -0800 1 1 1 Unclassified WebKit JavaScriptCore Other Unspecified Unspecified RESOLVED FIXED P1 Critical --- 1 ossy keith_miller cgarcia commit-queue fpizlo gyuyoung.kim keith_miller mark.lam msaboff ossy saam ysuzuki oldest_to_newest 1258116 0 ossy 2016-12-09 03:34:07 -0800 ASSERTION FAILED: compileAndRun<uint32_t>(proc, a, b) == a / b (compileAndRun<uint32_t>(proc, a, b) == 1, a / b == 0) ../../Source/JavaScriptCore/b3/testb3.cpp(1775) : void {anonymous}::testUDivArgsInt32(uint32_t, uint32_t) I don't know if it is a regression or not, I haven't run testb3 in the last months. I don't know if it is Linux specific or not, I don't have any chance to test on non Linux environment. 1258117 1 ossy 2016-12-09 03:40:59 -0800 ASSERTION FAILED: compileAndRun<uint64_t>(proc, a, b) == a / b (compileAndRun<uint64_t>(proc, a, b) == 1, a / b == 0) ../../Source/JavaScriptCore/b3/testb3.cpp(1791) : void {anonymous}::testUDivArgsInt64(uint64_t, uint64_t) 1258118 2 ossy 2016-12-09 04:00:31 -0800 Just a note, this test was added by https://trac.webkit.org/changeset/208781 1258119 3 ossy 2016-12-09 04:01:58 -0800 (In reply to comment #2) > Just a note, this test was added by https://trac.webkit.org/changeset/208781 It must be a regression, because it passed when it was added. 1258121 4 ossy 2016-12-09 04:47:25 -0800 I bisected, it is definitely a regression caused by https://trac.webkit.org/changeset/208791 . 1258141 5 keith_miller 2016-12-09 09:01:49 -0800 Hmm, interesting. I definitely ran testb3 before landing maybe I messed up while rebasing or something. 1258631 6 ysuzuki 2016-12-10 00:54:36 -0800 OK, I've found the issue. 1258635 7 296789 ysuzuki 2016-12-10 01:02:22 -0800 Created attachment 296789 Patch 1258648 8 296789 saam 2016-12-10 01:22:57 -0800 Comment on attachment 296789 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=296789&action=review > Source/JavaScriptCore/ChangeLog:9 > + Accidentally we always use edx/rdx for the result of UDiv/UMod. > + But it is incorrect. We should use eax/rax for the result of UDiv. Is there documentation on this? 1258650 9 296789 ysuzuki 2016-12-10 01:28:16 -0800 Comment on attachment 296789 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=296789&action=review >> Source/JavaScriptCore/ChangeLog:9 >> + But it is incorrect. We should use eax/rax for the result of UDiv. > > Is there documentation on this? It's x86's div convension. It should be handled in B3/Air, so that the caller side should not consider about it. 1258651 10 ysuzuki 2016-12-10 01:29:42 -0800 Committed r209658: <http://trac.webkit.org/changeset/209658> 296789 2016-12-10 01:02:22 -0800 2016-12-10 01:22:57 -0800 Patch bug-165651-20161210180139.patch text/plain 1564 ysuzuki U3VidmVyc2lvbiBSZXZpc2lvbjogMjA5NjI0CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCBj NDA2ODg5NGQwYWRiMTNiODgwZGM5ODk5ODQ1NWViZWEzNGZhMjMzLi43NjdhNWI1ZWQ5MWFiNjdl MDhmNDNjOGE4NTIxMjMyZGUxMWUwMGM1IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxNiBAQAorMjAxNi0xMi0xMCAgWXVzdWtlIFN1enVraSAgPHV0YXRhbmUudGVhQGdtYWls LmNvbT4KKworICAgICAgICBSRUdSRVNTSU9OKHIyMDg3OTEpOiBBc3NlcnRpb24gaW4gdGVzdGIz CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNjU2NTEK KworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBBY2NpZGVu dGFsbHkgd2UgYWx3YXlzIHVzZSBlZHgvcmR4IGZvciB0aGUgcmVzdWx0IG9mIFVEaXYvVU1vZC4K KyAgICAgICAgQnV0IGl0IGlzIGluY29ycmVjdC4gV2Ugc2hvdWxkIHVzZSBlYXgvcmF4IGZvciB0 aGUgcmVzdWx0IG9mIFVEaXYuCisKKyAgICAgICAgKiBiMy9CM0xvd2VyVG9BaXIuY3BwOgorICAg ICAgICAoSlNDOjpCMzo6QWlyOjpMb3dlclRvQWlyOjpsb3dlclg4NlVEaXYpOgorCiAyMDE2LTEy LTA5ICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CiAKICAgICAgICAgVW5yZXZpZXdl ZCwgZGlzYWJsZSBjb25jdXJyZW50IEdDIGZvciByZWFsLgpkaWZmIC0tZ2l0IGEvU291cmNlL0ph dmFTY3JpcHRDb3JlL2IzL0IzTG93ZXJUb0Fpci5jcHAgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUv YjMvQjNMb3dlclRvQWlyLmNwcAppbmRleCAwZmJlYTY2MmZmNGM5MTY2ZmJhOWIxNWU5MzgzMTMw NDlkZjBhNWRmLi4xYjI1ODVmNDc3NWM1MWJjNWQxOTg3NDk1ZDZmNjkyYzEwN2UwY2MzIDEwMDY0 NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvYjMvQjNMb3dlclRvQWlyLmNwcAorKysgYi9T b3VyY2UvSmF2YVNjcmlwdENvcmUvYjMvQjNMb3dlclRvQWlyLmNwcApAQCAtMjg0Miw3ICsyODQy LDcgQEAgY2xhc3MgTG93ZXJUb0FpciB7CiAgICAgICAgIEFpcjo6T3Bjb2RlIGRpdiA9IG1fdmFs dWUtPnR5cGUoKSA9PSBJbnQzMiA/IFg4NlVEaXYzMiA6IFg4NlVEaXY2NDsKIAogICAgICAgICBB U1NFUlQob3AgPT0gVURpdiB8fCBvcCA9PSBVTW9kKTsKLSAgICAgICAgWDg2UmVnaXN0ZXJzOjpS ZWdpc3RlcklEIHJlc3VsdCA9IG9wID09IERpdiA/IFg4NlJlZ2lzdGVyczo6ZWF4IDogWDg2UmVn aXN0ZXJzOjplZHg7CisgICAgICAgIFg4NlJlZ2lzdGVyczo6UmVnaXN0ZXJJRCByZXN1bHQgPSBv cCA9PSBVRGl2ID8gWDg2UmVnaXN0ZXJzOjplYXggOiBYODZSZWdpc3RlcnM6OmVkeDsKIAogICAg ICAgICBhcHBlbmQoTW92ZSwgdG1wKG1fdmFsdWUtPmNoaWxkKDApKSwgZWF4KTsKICAgICAgICAg YXBwZW5kKFhvcjY0LCBlZHgsIGVkeCk7Cg==