192018 2018-11-27 11:09:21 -0800 ASSERTION FAILED: capacity && isPageAligned(capacity) in JSC::CLoopStack::CLoopStack(JSC::VM&) 2018-11-27 17:49:40 -0800 1 1 1 Unclassified WebKit JavaScriptCore Other Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=191579 InRadar P2 Normal --- 1 ryanhaddad mark.lam commit-queue ews-watchlist jlewis3 keith_miller mark.lam msaboff saam tsavell webkit-bug-importer oldest_to_newest 1481975 0 ryanhaddad 2018-11-27 11:09:21 -0800 The following assertion failure is seen on the 32-bit JSC bot: stress/regress-191579.js.default: ASSERTION FAILED: capacity && isPageAligned(capacity) stress/regress-191579.js.default: ./interpreter/CLoopStack.cpp(59) : JSC::CLoopStack::CLoopStack(JSC::VM &) stress/regress-191579.js.default: 1 0x25d77b WTFCrash stress/regress-191579.js.default: 2 0x25e3a4 WTFCrashWithInfo(int, char const*, char const*, int) stress/regress-191579.js.default: 3 0x8e0c2c JSC::CLoopStack::CLoopStack(JSC::VM&) stress/regress-191579.js.default: 4 0x8e1094 JSC::CLoopStack::CLoopStack(JSC::VM&) stress/regress-191579.js.default: 5 0x8e804e JSC::Interpreter::Interpreter(JSC::VM&) stress/regress-191579.js.default: 6 0x8e8144 JSC::Interpreter::Interpreter(JSC::VM&) stress/regress-191579.js.default: 7 0xeb89d1 JSC::VM::VM(JSC::VM::VMType, JSC::HeapType) stress/regress-191579.js.default: 8 0xebd7d1 JSC::VM::VM(JSC::VM::VMType, JSC::HeapType) stress/regress-191579.js.default: 9 0xec04db JSC::VM::create(JSC::HeapType) stress/regress-191579.js.default: 10 0x2207e int runJSC<jscmain(int, char**)::$_3>(CommandLine, bool, jscmain(int, char**)::$_3 const&) stress/regress-191579.js.default: 11 0x20cb0 jscmain(int, char**) stress/regress-191579.js.default: 12 0x20bd7 main stress/regress-191579.js.default: 13 0xa73f4611 start stress/regress-191579.js.default: test_script_1895: line 2: 36513 Segmentation fault: 11 ( "$@" ../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --useFunctionDotArguments\=true --validateExceptionChecks\=true --useDollarVM\=true --maxPerThreadStackUsage\=1572864 --maxPerThreadStackUsage\=400000 --useTypeProfiler\=true --exceptionStackTraceLimit\=1 --defaultErrorStackTraceLimit\=1 --useFTLJIT\=true regress-191579.js ) stress/regress-191579.js.default: ERROR: Unexpected exit code: 139 https://build.webkit.org/builders/Apple%20High%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/2925 1481976 1 ryanhaddad 2018-11-27 11:09:44 -0800 The test was added with https://trac.webkit.org/changeset/238141 1482184 2 355798 mark.lam 2018-11-27 15:46:02 -0800 Created attachment 355798 proposed patch. 1482288 3 355798 commit-queue 2018-11-27 17:48:43 -0800 Comment on attachment 355798 proposed patch. Clearing flags on attachment: 355798 Committed r238595: <https://trac.webkit.org/changeset/238595> 1482289 4 commit-queue 2018-11-27 17:48:45 -0800 All reviewed patches have been landed. Closing bug. 1482290 5 webkit-bug-importer 2018-11-27 17:49:40 -0800 <rdar://problem/46295971> 355798 2018-11-27 15:46:02 -0800 2018-11-27 17:48:43 -0800 proposed patch. bug-192018.patch text/plain 1728 mark.lam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjM4NTgxKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE5IEBA CisyMDE4LTExLTI3ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBB U1NFUlRJT04gRkFJTEVEOiBjYXBhY2l0eSAmJiBpc1BhZ2VBbGlnbmVkKGNhcGFjaXR5KSBpbiBK U0M6OkNMb29wU3RhY2s6OkNMb29wU3RhY2soSlNDOjpWTSYpLgorICAgICAgICBodHRwczovL2J1 Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTkyMDE4CisKKyAgICAgICAgUmV2aWV3ZWQg YnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVGhpcyBhc3NlcnRpb24gZmFpbGVkIGJlY2F1 c2UgdGhlIHJlZ3Jlc3MtMTkxNTc5LmpzIHRlc3Qgd2FzIHNwZWNpZnlpbmcKKyAgICAgICAgLS1t YXhQZXJUaHJlYWRTdGFja1VzYWdlPTQwMDAwMCBpLmUuIGl0IHdhcyBydW5uaW5nIHdpdGggYSBz dGFjayBzaXplIHRoYXQgaXMgbm90CisgICAgICAgIHBhZ2UgYWxpZ25lZC4gIEdpdmVuIHRoYXQg dGhlIHVzZXIgY2FuIHNwZWNpZnkgYW55IGFyYml0cmFyeSBzdGFjayBzaXplLCBhbmQgdGhlCisg ICAgICAgIENMb29wIHN0YWNrIGV4cGVjdHMgdG8gYmUgcGFnZSBhbGlnbmVkLCB3ZSdsbCBqdXN0 IHJvdW5kIHVwIHRoZSByZXF1ZXN0ZWQgY2FwYWNpdHkKKyAgICAgICAgdG8gdGhlIG5leHQgcGFn ZSBhbGlnbm1lbnQuCisKKyAgICAgICAgKiBpbnRlcnByZXRlci9DTG9vcFN0YWNrLmNwcDoKKyAg ICAgICAgKEpTQzo6Q0xvb3BTdGFjazo6Q0xvb3BTdGFjayk6CisKIDIwMTgtMTEtMjcgIE1hcmsg TGFtICA8bWFyay5sYW1AYXBwbGUuY29tPgogCiAgICAgICAgIFtSZS1sYW5kaW5nXSBOYU5zIHJl YWQgZnJvbSBXYXNtIGNvZGUgbmVlZHMgdG8gYmUgYmUgcHVyaWZpZWQuCkluZGV4OiBTb3VyY2Uv SmF2YVNjcmlwdENvcmUvaW50ZXJwcmV0ZXIvQ0xvb3BTdGFjay5jcHAKPT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0g U291cmNlL0phdmFTY3JpcHRDb3JlL2ludGVycHJldGVyL0NMb29wU3RhY2suY3BwCShyZXZpc2lv biAyMzg1NzYpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaW50ZXJwcmV0ZXIvQ0xvb3BTdGFj ay5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTU2LDYgKzU2LDcgQEAgQ0xvb3BTdGFjazo6Q0xvb3BT dGFjayhWTSYgdm0pCiAgICAgLCBtX3NvZnRSZXNlcnZlZFpvbmVTaXplSW5SZWdpc3RlcnMoMCkK IHsKICAgICBzaXplX3QgY2FwYWNpdHkgPSBPcHRpb25zOjptYXhQZXJUaHJlYWRTdGFja1VzYWdl KCk7CisgICAgY2FwYWNpdHkgPSBXVEY6OnJvdW5kVXBUb011bHRpcGxlT2YocGFnZVNpemUoKSwg Y2FwYWNpdHkpOwogICAgIEFTU0VSVChjYXBhY2l0eSAmJiBpc1BhZ2VBbGlnbmVkKGNhcGFjaXR5 KSk7CiAKICAgICBtX3Jlc2VydmF0aW9uID0gUGFnZVJlc2VydmF0aW9uOjpyZXNlcnZlKFdURjo6 cm91bmRVcFRvTXVsdGlwbGVPZihjb21taXRTaXplKCksIGNhcGFjaXR5KSwgT1NBbGxvY2F0b3I6 OkpTVk1TdGFja1BhZ2VzKTsK