171786 2017-05-06 21:33:19 -0700 REGRESSION(r206870): ChakraCore.yaml/ChakraCore/test/Strings/HTMLHelpers.js.default intermittently fails 2017-05-08 16:05:34 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 171737 1 mark.lam mark.lam fpizlo jfbastien keith_miller msaboff oliver saam webkit-bug-importer ysuzuki oldest_to_newest 1305685 0 mark.lam 2017-05-06 21:33:19 -0700 After r216301, ChakraCore.yaml/ChakraCore/test/Strings/HTMLHelpers.js.default intermittently fails. Here's how I reproduce the issue: 1. cd JSTests/ChakraCore/test/Strings 2. lldb jsc -- --useFunctionDotArguments\=true --maxPerThreadStackUsage\=1572864 --thresholdForJITAfterWarmUp\=10 --thresholdForJITSoon\=10 --thresholdForOptimizeAfterWarmUp\=20 --thresholdForOptimizeAfterLongWarmUp\=20 --thresholdForOptimizeSoon\=20 --thresholdForFTLOptimizeAfterWarmUp\=20 --thresholdForFTLOptimizeSoon\=20 --maximumEvalCacheableSourceLength\=150000 --useEagerCodeBlockJettisonTiming\=true ../jsc-lib.js HTMLHelpers.js The stack trace: (lldb) bt 15 * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xbbadbeef) frame #0: 0x0000000101499cb4 JavaScriptCore`::WTFCrash() at Assertions.cpp:292 * frame #1: 0x00000001005dce07 JavaScriptCore`::slow_path_throw_static_error(exec=0x00007fff5fbfb620, pc=0x00000001093f0780) at CommonSlowPaths.cpp:993 frame #2: 0x00003047ef803323 frame #3: 0x0000000100ff9e71 JavaScriptCore`llint_entry at LowLevelInterpreter.asm:795 frame #4: 0x0000000100ff272e JavaScriptCore`vmEntryToJavaScript at LowLevelInterpreter64.asm:254 frame #5: 0x0000000100dc5d0e JavaScriptCore`JSC::JITCode::execute(this=0x00000001044ec898, vm=0x0000000109000000, protoCallFrame=0x00007fff5fbfb990) at JITCode.cpp:81 frame #6: 0x0000000100d71c41 JavaScriptCore`JSC::Interpreter::execute(this=0x00000001045f4040, eval=0x000000010977f8a0, callFrame=0x00007fff5fbfd150, thisValue=JSValue @ 0x00007fff5fbfbd40, scope=0x00000001097a4de0) at Interpreter.cpp:1223 frame #7: 0x0000000100d70594 JavaScriptCore`JSC::eval(callFrame=0x00007fff5fbfd150) at Interpreter.cpp:170 frame #8: 0x0000000100ddadc1 JavaScriptCore`::operationCallEval(exec=0x00007fff5fbfd1e0, execCallee=0x00007fff5fbfd150) at JITOperations.cpp:845 frame #9: 0x00003047ef821627 frame #10: 0x00003047ef8272dd frame #11: 0x0000000100ff9df7 JavaScriptCore`llint_entry at LowLevelInterpreter.asm:795 frame #12: 0x0000000100ff9e71 JavaScriptCore`llint_entry at LowLevelInterpreter.asm:795 frame #13: 0x0000000100ff9e71 JavaScriptCore`llint_entry at LowLevelInterpreter.asm:795 frame #14: 0x0000000100ff9e71 JavaScriptCore`llint_entry at LowLevelInterpreter.asm:795 (lldb) up frame #1: 0x00000001005dce07 JavaScriptCore`::slow_path_throw_static_error(exec=0x00007fff5fbfb620, pc=0x00000001093f0780) at CommonSlowPaths.cpp:993 990 { 991 BEGIN(); 992 JSValue errorMessageValue = OP_C(1).jsValue(); -> 993 RELEASE_ASSERT(errorMessageValue.isString()); 994 String errorMessage = asString(errorMessageValue)->value(exec); 995 ErrorType errorType = static_cast<ErrorType>(pc[2].u.unsignedValue); 996 THROW(createError(exec, errorType, errorMessage)); (lldb) p errorMessageValue (JSC::JSValue) $0 = { u = { asInt64 = 10 ptr = 0x000000000000000a asBits = (payload = 10, tag = 0) } } i.e. errorMessageValue is undefined. AFAICT, this issue only manifests if the DFG is enabled (FTL not required). Needless to say, it also manifests on a release build. 1305879 1 webkit-bug-importer 2017-05-08 09:21:58 -0700 <rdar://problem/32051023> 1305940 2 mark.lam 2017-05-08 10:45:02 -0700 I've created a reduced test case. Still investigating the root cause. 1305982 3 oliver 2017-05-08 12:12:25 -0700 fails during these calls: assert.throws(function () { eval("String.prototype." + wrappers[i] + ".call(null);") }, TypeError); assert.throws(function () { eval("String.prototype." + wrappers[i] + ".call(undefined);") }, TypeError); Specifically at: frame #6: 0x00000001002f4e3e JavaScriptCore`::slow_path_throw_static_error(exec=0x00007fff5fbfd920, pc=0x0000000103ff0780) at CommonSlowPaths.cpp:992 [opt] 989 SLOW_PATH_DECL(slow_path_throw_static_error) 990 { 991 BEGIN(); -> 992 JSValue errorMessageValue = OP_C(1).jsValue(); OP_C(1) goes to: frame #5: 0x00000001002f4e3e JavaScriptCore`::slow_path_throw_static_error(JSC::ExecState *, JSC::Instruction *) [inlined] JSC::ExecState::r(this=0x00007fff5fbfd920) at CodeBlock.h:1044 [opt] 1041 { 1042 CodeBlock* codeBlock = this->codeBlock(); 1043 if (codeBlock->isConstantRegisterIndex(index)) -> 1044 return *reinterpret_cast<Register*>(&codeBlock->constantRegister(index)); (where lldb won't show me the value index) I think something is going wrong with: @throwTypeError(`${func} requires that |this| not be null or undefined`); I can fix this by switching to func + " ... " 1305983 4 oliver 2017-05-08 12:12:35 -0700 (In reply to Mark Lam from comment #2) > I've created a reduced test case. Still investigating the root cause. Can you attach it? 1306003 5 309397 mark.lam 2017-05-08 12:56:53 -0700 Created attachment 309397 reduced repro test case. Run with JSC_useConcurrentJIT=0. 1306069 6 mark.lam 2017-05-08 14:49:00 -0700 This is actually a regression due to r206870. r206870 changed op_throw_static_error to use a variable, but did not reflect this in DFGBytecodeUseDef. The fix is also to reflect the change in DFGBytecodeUseDef. There's also a parallel bug in BytecodeDumper where the dumper for op_throw_static_error was expecting op1 to be a constant. But r206870 changed op1 to be a variable. I'll also apply the fix for the dumper. 1306076 7 309418 mark.lam 2017-05-08 15:01:45 -0700 Created attachment 309418 proposed patch. 1306089 8 mark.lam 2017-05-08 15:25:27 -0700 Thanks for the review. Landed in r216459: <http://trac.webkit.org/r216459>. 1306113 9 ysuzuki 2017-05-08 16:05:34 -0700 Oops, right. It's my fault. Thanks for fixing this :) 309397 2017-05-08 12:56:53 -0700 2017-05-08 15:01:45 -0700 reduced repro test case. Run with JSC_useConcurrentJIT=0. bug-171786.js application/x-javascript 350 mark.lam CmZ1bmN0aW9uIGZvbyhpLCB4KSB7CiAgICBwcmludCgiWyIgKyBpICsgIl06ICIgKyAoREZHVHJ1 ZSgpID8gIkRGRyIgOiAiTm90IERGRyIpKTsKICAgIHJldHVybiBTdHJpbmcucHJvdG90eXBlLmJp Zy5jYWxsKHgpOwp9Cm5vSW5saW5lKGZvbyk7Cgpmb3IgKHZhciBpID0gMDsgaSA8IDEwMDA7IGkr KykgewogICAgdHJ5IHsKICAgICAgICBpZiAoaSA8IDIwMCkKICAgICAgICAgICAgZm9vKGksICJo ZWxsbyIpOwogICAgICAgIGVsc2UKICAgICAgICAgICAgZm9vKGksIHVuZGVmaW5lZCk7CiAgICB9 IGNhdGNoKGUpIHsKICAgICAgICBwcmludCgiQ2F1Z2h0IEAgWyIgKyBpICsgIl06ICIgKyBlKTsK ICAgIH0KfQo= 309418 2017-05-08 15:01:45 -0700 2017-05-08 15:15:34 -0700 proposed patch. bug-171786.patch text/plain 5043 mark.lam SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyMTY0NTQpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDEzIEBACisyMDE3LTA1LTA4ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNv bT4KKworICAgICAgICBvcF90aHJvd19zdGF0aWNfZXJyb3IncyB1c2Ugb2YgaXRzIGZpcnN0IG9w ZXJhbmQgc2hvdWxkIGJlIHJlZmxlY3RlZCBpbiBERkcgQnl0ZWNvZGVVc2VEZWYgYXMgd2VsbC4K KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE3MTc4Ngor ICAgICAgICA8cmRhcjovL3Byb2JsZW0vMzIwNTEwMjM+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkg Tk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBzdHJlc3MvYnVnLTE3MTc4Ni5qczogQWRkZWQu CisKIDIwMTctMDUtMDYgIE9sZWtzYW5kciBTa2FjaGtvdiAgPGdza2FjaGtvdkBnbWFpbC5jb20+ CiAKICAgICAgICAgW0VTNl0gQXJyb3cgZnVuY3Rpb24uIElzc3VlIGluIGFjY2VzcyB0byB0aGlz IGFmdGVyIGV2YWwoJ3N1cGVyKCknKSB3aXRoaW4gY29uc3RydWN0b3IKSW5kZXg6IEpTVGVzdHMv c3RyZXNzL2J1Zy0xNzE3ODYuanMKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gSlNUZXN0cy9zdHJlc3MvYnVnLTE3 MTc4Ni5qcwkobm9uZXhpc3RlbnQpCisrKyBKU1Rlc3RzL3N0cmVzcy9idWctMTcxNzg2LmpzCSh3 b3JraW5nIGNvcHkpCkBAIC0wLDAgKzEsMTUgQEAKKworZnVuY3Rpb24gZm9vKGksIHgpIHsKKyAg ICByZXR1cm4gU3RyaW5nLnByb3RvdHlwZS5iaWcuY2FsbCh4KTsKK30KK25vSW5saW5lKGZvbyk7 CisKK2ZvciAodmFyIGkgPSAwOyBpIDwgMTAwMDsgaSsrKSB7CisgICAgdHJ5IHsKKyAgICAgICAg aWYgKGkgPCAyMDApCisgICAgICAgICAgICBmb28oaSwgImhlbGxvIik7CisgICAgICAgIGVsc2UK KyAgICAgICAgICAgIGZvbyhpLCB1bmRlZmluZWQpOworICAgIH0gY2F0Y2goZSkgeworICAgIH0K K30KSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0g U291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjE2NDQzKQorKysgU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI4 IEBACisyMDE3LTA1LTA4ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAg ICBvcF90aHJvd19zdGF0aWNfZXJyb3IncyB1c2Ugb2YgaXRzIGZpcnN0IG9wZXJhbmQgc2hvdWxk IGJlIHJlZmxlY3RlZCBpbiBERkcgQnl0ZWNvZGVVc2VEZWYgYXMgd2VsbC4KKyAgICAgICAgaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE3MTc4NgorICAgICAgICA8cmRh cjovL3Byb2JsZW0vMzIwNTEwMjM+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT ISkuCisKKyAgICAgICAgKiBieXRlY29kZS9CeXRlY29kZUR1bXBlci5jcHA6CisgICAgICAgIChK U0M6OkJ5dGVjb2RlRHVtcGVyPEJsb2NrPjo6ZHVtcEJ5dGVjb2RlKToKKyAgICAgICAgLSBGaXgg Qnl0ZWNvZGVEdW1wZXIgdG8gZHVtcCBvcF90aHJvd19zdGF0aWNfZXJyb3IgY29ycmVjdGx5LiAg UHJldmlvdXNseSwKKyAgICAgICAgICBpdCB3YXMgZXhwZWN0aW5nIG9wMSB0byBhbHdheXMgYmUg YSBjb25zdGFudC4gIHIyMDY4NzAgY2hhbmdlZCBpdCB0byB0YWtlIGEKKyAgICAgICAgICB2YXJp YWJsZSBzdHJpbmcgYXMgd2VsbC4KKworICAgICAgICAqIGJ5dGVjb2RlL0J5dGVjb2RlVXNlRGVm Lmg6CisgICAgICAgIChKU0M6OmNvbXB1dGVVc2VzRm9yQnl0ZWNvZGVPZmZzZXQpOgorICAgICAg ICAtIEZpeCB0aGUgYnVnLgorCisgICAgICAgICogZGZnL0RGR0J5dGVDb2RlUGFyc2VyLmNwcDoK KyAgICAgICAgKEpTQzo6REZHOjpCeXRlQ29kZVBhcnNlcjo6cGFyc2VCbG9jayk6CisgICAgICAg IC0gTW92ZSB0aGUgUGhhbnRvbSBvZiBvcDEgYWZ0ZXIgdGhlIFRocm93U3RhdGljRXJyb3Igbm9k ZSwgYmVjYXVzZSB0ZWNobmljYWxseSwKKyAgICAgICAgICB0aGUgVGhyb3dTdGF0aWNFcnJvciBy ZXByZXNlbnRzIG9wX3Rocm93X3N0YXRpY19lcnJvciwgYW5kIG9wX3Rocm93X3N0YXRpY19lcnJv cgorICAgICAgICAgIHVzZXMgb3AxLiAgSW4gcHJhY3RpY2UsIHRoaXMgcHJvYmFibHkgZG9lc24n dCBtYXR0ZXIsIGJ1dCBsZXQncyBoYXZlIHRoZSBjb2RlCisgICAgICAgICAgYWNjdXJhdGVseSBj b21tdW5pY2F0ZSB0aGUgYmVoYXZpb3Igd2UncmUgZXhwZWN0aW5nLgorCiAyMDE3LTA1LTA4ICBK RiBCYXN0aWVuICA8amZiYXN0aWVuQGFwcGxlLmNvbT4KIAogICAgICAgICBXZWJBc3NlbWJseTog ZG9uJ3QganVzdCBlbWl0IGV4dGVuZGVkIG9mZnNldCBhZGRzIGZvciBwYXRjaApJbmRleDogU291 cmNlL0phdmFTY3JpcHRDb3JlL2J5dGVjb2RlL0J5dGVjb2RlRHVtcGVyLmNwcAo9PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvZGUvQnl0ZWNvZGVEdW1wZXIuY3BwCShy ZXZpc2lvbiAyMTY0NDMpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvZGUvQnl0ZWNv ZGVEdW1wZXIuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xNTQzLDEwICsxNTQzLDEwIEBAIHZvaWQg Qnl0ZWNvZGVEdW1wZXI8QmxvY2s+OjpkdW1wQnl0ZWNvZGUKICAgICAgICAgYnJlYWs7CiAgICAg fQogICAgIGNhc2Ugb3BfdGhyb3dfc3RhdGljX2Vycm9yOiB7Ci0gICAgICAgIGludCBrMCA9ICgr K2l0KS0+dS5vcGVyYW5kOworICAgICAgICBpbnQgcjAgPSAoKytpdCktPnUub3BlcmFuZDsKICAg ICAgICAgRXJyb3JUeXBlIGsxID0gc3RhdGljX2Nhc3Q8RXJyb3JUeXBlPigoKytpdCktPnUudW5z aWduZWRWYWx1ZSk7CiAgICAgICAgIHByaW50TG9jYXRpb25BbmRPcChvdXQsIGxvY2F0aW9uLCBp dCwgInRocm93X3N0YXRpY19lcnJvciIpOwotICAgICAgICBvdXQucHJpbnRmKCIlcywgIiwgY29u c3RhbnROYW1lKGswKS5kYXRhKCkpOworICAgICAgICBvdXQucHJpbnRmKCIlcywgIiwgcmVnaXN0 ZXJOYW1lKHIwKS5kYXRhKCkpOwogICAgICAgICBvdXQucHJpbnQoazEpOwogICAgICAgICBicmVh azsKICAgICB9CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvZGUvQnl0ZWNvZGVV c2VEZWYuaAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvZGUvQnl0 ZWNvZGVVc2VEZWYuaAkocmV2aXNpb24gMjE2NDQzKQorKysgU291cmNlL0phdmFTY3JpcHRDb3Jl L2J5dGVjb2RlL0J5dGVjb2RlVXNlRGVmLmgJKHdvcmtpbmcgY29weSkKQEAgLTQwLDcgKzQwLDYg QEAgdm9pZCBjb21wdXRlVXNlc0ZvckJ5dGVjb2RlT2Zmc2V0KEJsb2NrKgogICAgIC8vIE5vIHVz ZXMuCiAgICAgY2FzZSBvcF9uZXdfcmVnZXhwOgogICAgIGNhc2Ugb3BfbmV3X2FycmF5X2J1ZmZl cjoKLSAgICBjYXNlIG9wX3Rocm93X3N0YXRpY19lcnJvcjoKICAgICBjYXNlIG9wX2RlYnVnOgog ICAgIGNhc2Ugb3Bfam5lcV9wdHI6CiAgICAgY2FzZSBvcF9sb29wX2hpbnQ6CkBAIC03MCw3ICs2 OSw4IEBAIHZvaWQgY29tcHV0ZVVzZXNGb3JCeXRlY29kZU9mZnNldChCbG9jayoKICAgICBjYXNl IG9wX2puZXFfbnVsbDoKICAgICBjYXNlIG9wX2RlYzoKICAgICBjYXNlIG9wX2luYzoKLSAgICBj YXNlIG9wX2xvZ19zaGFkb3dfY2hpY2tlbl9wcm9sb2d1ZTogeworICAgIGNhc2Ugb3BfbG9nX3No YWRvd19jaGlja2VuX3Byb2xvZ3VlOgorICAgIGNhc2Ugb3BfdGhyb3dfc3RhdGljX2Vycm9yOiB7 CiAgICAgICAgIEFTU0VSVChvcGNvZGVMZW5ndGhzW29wY29kZUlEXSA+IDEpOwogICAgICAgICBm dW5jdG9yKGNvZGVCbG9jaywgaW5zdHJ1Y3Rpb24sIG9wY29kZUlELCBpbnN0cnVjdGlvblsxXS51 Lm9wZXJhbmQpOwogICAgICAgICByZXR1cm47CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUv ZGZnL0RGR0J5dGVDb2RlUGFyc2VyLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlw dENvcmUvZGZnL0RGR0J5dGVDb2RlUGFyc2VyLmNwcAkocmV2aXNpb24gMjE2NDQzKQorKysgU291 cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdCeXRlQ29kZVBhcnNlci5jcHAJKHdvcmtpbmcgY29w eSkKQEAgLTUwMzcsOCArNTAzNyw4IEBAIGJvb2wgQnl0ZUNvZGVQYXJzZXI6OnBhcnNlQmxvY2so dW5zaWduZWQKICAgICAgICAgICAgIExBU1RfT1BDT0RFKG9wX3Rocm93KTsKICAgICAgICAgICAg IAogICAgICAgICBjYXNlIG9wX3Rocm93X3N0YXRpY19lcnJvcjoKLSAgICAgICAgICAgIGFkZFRv R3JhcGgoUGhhbnRvbSwgZ2V0KFZpcnR1YWxSZWdpc3RlcihjdXJyZW50SW5zdHJ1Y3Rpb25bMV0u dS5vcGVyYW5kKSkpOyAvLyBLZWVwIGFyZ3VtZW50IGxpdmUuCiAgICAgICAgICAgICBhZGRUb0dy YXBoKFRocm93U3RhdGljRXJyb3IpOworICAgICAgICAgICAgYWRkVG9HcmFwaChQaGFudG9tLCBn ZXQoVmlydHVhbFJlZ2lzdGVyKGN1cnJlbnRJbnN0cnVjdGlvblsxXS51Lm9wZXJhbmQpKSk7IC8v IEtlZXAgYXJndW1lbnQgbGl2ZS4KICAgICAgICAgICAgIGZsdXNoRm9yVGVybWluYWwoKTsKICAg ICAgICAgICAgIGFkZFRvR3JhcGgoVW5yZWFjaGFibGUpOwogICAgICAgICAgICAgTEFTVF9PUENP REUob3BfdGhyb3dfc3RhdGljX2Vycm9yKTsK