187362 2018-07-05 14:10:27 -0700 [32-bit JSC tests] ASSERTION FAILED: !butterfly->propertyStorage()[-I - 1].get() under JSC::ObjectInitializationScope::verifyPropertiesAreInitialized 2018-07-10 13:49:14 -0700 1 1 1 Unclassified WebKit JavaScriptCore Other Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=186692 InRadar P2 Normal --- 1 ryanhaddad mark.lam ap ews-watchlist fpizlo keith_miller mark.lam msaboff realdawei saam tsavell webkit-bug-importer oldest_to_newest 1439549 0 ryanhaddad 2018-07-05 14:10:27 -0700 The following assertion failure is seen with 858 tests on the 32-bit JSC bot: ASSERTION FAILED: !butterfly->propertyStorage()[-i - 1].get() ./runtime/ObjectInitializationScope.cpp(89) : void JSC::ObjectInitializationScope::verifyPropertiesAreInitialized(JSC::JSObject *) 1 0x2a104b WTFCrash 2 0x134540e JSC::ObjectInitializationScope::verifyPropertiesAreInitialized(JSC::JSObject*) 3 0x134501a JSC::ObjectInitializationScope::~ObjectInitializationScope() 4 0x1345537 JSC::ObjectInitializationScope::~ObjectInitializationScope() 5 0x9ce262 JSC::createRegExpMatchesArray(JSC::VM&, JSC::JSGlobalObject*, JSC::JSString*, WTF::String const&, JSC::RegExp*, unsigned int, JSC::MatchResult&) 6 0x9cceb4 JSC::RegExpObject::execInline(JSC::ExecState*, JSC::JSGlobalObject*, JSC::JSString*) 7 0x139354e JSC::RegExpObject::exec(JSC::ExecState*, JSC::JSGlobalObject*, JSC::JSString*) 8 0x1395ebb JSC::regExpProtoFuncExec(JSC::ExecState*) 9 0xdbddb0e1 10 0x3a0238 llint_entry 11 0x3a0238 llint_entry 12 0x3a0238 llint_entry 13 0x39a100 vmEntryToJavaScript 14 0xe46c19 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) 15 0xe460b6 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*) 16 0x1159e12 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 17 0x7309f runWithOptions(GlobalObject*, CommandLine&, bool&) 18 0x43d0a jscmain(int, char**)::$_3::operator()(JSC::VM&, GlobalObject*, bool&) const 19 0x290ea int runJSC<jscmain(int, char**)::$_3>(CommandLine, bool, jscmain(int, char**)::$_3 const&) 20 0x27880 jscmain(int, char**) 21 0x277a7 main 22 0xa73f4611 start https://build.webkit.org/builders/Apple%20High%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/2238 1439552 1 ryanhaddad 2018-07-05 14:12:40 -0700 This assert was added with https://trac.webkit.org/changeset/232951/webkit 1440714 2 ap 2018-07-09 20:46:01 -0700 Is this still happening? 1440867 3 ryanhaddad 2018-07-10 09:21:31 -0700 (In reply to Alexey Proskuryakov from comment #2) > Is this still happening? Yes. 1440873 4 webkit-bug-importer 2018-07-10 09:30:16 -0700 <rdar://problem/42027210> 1440944 5 344717 mark.lam 2018-07-10 13:09:04 -0700 Created attachment 344717 proposed patch. 1440950 6 344717 saam 2018-07-10 13:29:53 -0700 Comment on attachment 344717 proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=344717&action=review > Source/JavaScriptCore/runtime/ObjectInitializationScope.cpp:91 > +#else > + return !value || !JSValue::encode(value); > +#endif Why are we even pretending this assertion does anything on 32-bit? Can't we just always return true, since we don't have a concurrentJIT/concurrentGC? 1440951 7 mark.lam 2018-07-10 13:35:13 -0700 (In reply to Saam Barati from comment #6) > Comment on attachment 344717 [details] > proposed patch. > > View in context: > https://bugs.webkit.org/attachment.cgi?id=344717&action=review > > > Source/JavaScriptCore/runtime/ObjectInitializationScope.cpp:91 > > +#else > > + return !value || !JSValue::encode(value); > > +#endif > > Why are we even pretending this assertion does anything on 32-bit? Can't we > just always return true, since we don't have a concurrentJIT/concurrentGC? Good point. Let me rework the patch. 1440953 8 mark.lam 2018-07-10 13:43:06 -0700 (In reply to Mark Lam from comment #7) > (In reply to Saam Barati from comment #6) > > Comment on attachment 344717 [details] > > proposed patch. > > > > View in context: > > https://bugs.webkit.org/attachment.cgi?id=344717&action=review > > > > > Source/JavaScriptCore/runtime/ObjectInitializationScope.cpp:91 > > > +#else > > > + return !value || !JSValue::encode(value); > > > +#endif > > > > Why are we even pretending this assertion does anything on 32-bit? Can't we > > just always return true, since we don't have a concurrentJIT/concurrentGC? > > Good point. Let me rework the patch. On second thought, I'll leave it as is. Reasons: 1. This way, this code has parity with the 64-bit version (more or less). 2. While it is true that this assertion is a non-issue on 32-bit because it doesn't currently support the concurrent GC, I don't think we need to make it more difficult for anyone to implement / add support for the concurrent GC on 32-bit in the future if they wish. 1440955 9 mark.lam 2018-07-10 13:49:14 -0700 Thanks for the review. Landed in r233697: <http://trac.webkit.org/r233697>. 344717 2018-07-10 13:09:04 -0700 2018-07-10 13:29:53 -0700 proposed patch. bug-187362.patch text/plain 2176 mark.lam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjMzNjk0KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBA CisyMDE4LTA3LTEwICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBb MzItYml0IEpTQyB0ZXN0c10gQVNTRVJUSU9OIEZBSUxFRDogIWJ1dHRlcmZseS0+cHJvcGVydHlT dG9yYWdlKClbLUkgLSAxXS5nZXQoKSB1bmRlciBKU0M6Ok9iamVjdEluaXRpYWxpemF0aW9uU2Nv cGU6OnZlcmlmeVByb3BlcnRpZXNBcmVJbml0aWFsaXplZC4KKyAgICAgICAgaHR0cHM6Ly9idWdz LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE4NzM2MgorICAgICAgICA8cmRhcjovL3Byb2Js ZW0vNDIwMjcyMTA+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg ICAgICAgT24gMzItYml0IHRhcmdldHMsIGEgMCB2YWx1ZWQgSlNWYWx1ZSBpcyBub3QgcmV0cmVh dGVkIGFzIGFuIGVtcHR5IEpTVmFsdWUsIGJ1dAorICAgICAgICBpdCBpcyBhIHZhbGlkIHZhbHVl IHRvIHVzZSBmb3IgaW5pdGlhbGl6aW5nIHVudXNlZCBwcm9wZXJ0aWVzLiAgVXBkYXRlZCBhbgor ICAgICAgICBhc3NlcnRpb24gdG8gYWNjb3VudCBmb3IgdGhpcy4KKworICAgICAgICAqIHJ1bnRp bWUvT2JqZWN0SW5pdGlhbGl6YXRpb25TY29wZS5jcHA6CisgICAgICAgIChKU0M6Ok9iamVjdElu aXRpYWxpemF0aW9uU2NvcGU6OnZlcmlmeVByb3BlcnRpZXNBcmVJbml0aWFsaXplZCk6CisKIDIw MTgtMDctMTAgIE1pY2hhZWwgU2Fib2ZmICA8bXNhYm9mZkBhcHBsZS5jb20+CiAKICAgICAgICAg WUFSUjogLiBkb2Vzbid0IG1hdGNoIG5vbi1CTVAgVW5pY29kZSBjaGFyYWN0ZXJzIGluIHNvbWUg Y2FzZXMKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL09iamVjdEluaXRpYWxp emF0aW9uU2NvcGUuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50 aW1lL09iamVjdEluaXRpYWxpemF0aW9uU2NvcGUuY3BwCShyZXZpc2lvbiAyMzM2OTIpCisrKyBT b3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9PYmplY3RJbml0aWFsaXphdGlvblNjb3BlLmNw cAkod29ya2luZyBjb3B5KQpAQCAtODMsMTAgKzgzLDE4IEBAIHZvaWQgT2JqZWN0SW5pdGlhbGl6 YXRpb25TY29wZTo6dmVyaWZ5UHIKICAgICAgICAgfQogICAgIH0KIAorICAgIGF1dG8gaXNTYWZl RW1wdHlWYWx1ZUZvckdDU2Nhbm5pbmcgPSBbXSAoSlNWYWx1ZSB2YWx1ZSkgeworI2lmIFVTRShK U1ZBTFVFNjQpCisgICAgICAgIHJldHVybiAhdmFsdWU7CisjZWxzZQorICAgICAgICByZXR1cm4g IXZhbHVlIHx8ICFKU1ZhbHVlOjplbmNvZGUodmFsdWUpOworI2VuZGlmCisgICAgfTsKKwogICAg IGZvciAoaW50NjRfdCBpID0gMDsgaSA8IHN0YXRpY19jYXN0PGludDY0X3Q+KHN0cnVjdHVyZS0+ b3V0T2ZMaW5lQ2FwYWNpdHkoKSk7IGkrKykgewogICAgICAgICAvLyBXZSByZWx5IG9uIHByb3Bl cnRpZXMgcGFzdCB0aGUgbGFzdCBvZmZzZXQgYmUgemVybyBmb3IgY29uY3VycmVudCBHQy4KICAg ICAgICAgaWYgKGkgKyBmaXJzdE91dE9mTGluZU9mZnNldCA+IHN0cnVjdHVyZS0+bGFzdE9mZnNl dCgpKQotICAgICAgICAgICAgQVNTRVJUKCFidXR0ZXJmbHktPnByb3BlcnR5U3RvcmFnZSgpWy1p IC0gMV0uZ2V0KCkpOworICAgICAgICAgICAgQVNTRVJUKGlzU2FmZUVtcHR5VmFsdWVGb3JHQ1Nj YW5uaW5nKGJ1dHRlcmZseS0+cHJvcGVydHlTdG9yYWdlKClbLWkgLSAxXS5nZXQoKSkpOwogICAg ICAgICBlbHNlIGlmIChpc1NjcmliYmxlZFZhbHVlKGJ1dHRlcmZseS0+cHJvcGVydHlTdG9yYWdl KClbLWkgLSAxXS5nZXQoKSkpIHsKICAgICAgICAgICAgIGRhdGFMb2dMbigiRm91bmQgc2NyaWJi bGVkIHByb3BlcnR5IGF0IGkgPSAiLCAtaSAtIDEpOwogICAgICAgICAgICAgQVNTRVJUX05PVF9S RUFDSEVEKCk7Cg==