216406 2020-09-11 09:07:40 -0700 REGRESSION(r266770): construct-return-early-from-infinite-loop-for-fuzzer.js loops on x86_64 cloop 2023-06-15 17:02:24 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build PC Linux RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=216289 https://bugs.webkit.org/show_bug.cgi?id=258179 InRadar P2 Normal --- 1 mcatanzaro webkit-unassigned guijemont mcatanzaro webkit-bug-importer ysuzuki oldest_to_newest 1687731 0 mcatanzaro 2020-09-11 09:07:40 -0700 The new construct-return-early-from-infinite-loop-for-fuzzer.js test added in r266770 "[JSC] returnEarlyFromInfiniteLoopsForFuzzing should return object" loops forever on llint, but only on x86_64. Other architectures seems to be fine. (So this doesn't affect any architectures that commonly use llint, but x86_64 is great to have working as a baseline to see when problems occur only on a particular architecture.) 1688238 1 guijemont 2020-09-14 07:28:23 -0700 (In reply to Michael Catanzaro from comment #0) > The new construct-return-early-from-infinite-loop-for-fuzzer.js test added > in r266770 "[JSC] returnEarlyFromInfiniteLoopsForFuzzing should return > object" loops forever on llint, but only on x86_64. Other architectures > seems to be fine. (So this doesn't affect any architectures that commonly > use llint, but x86_64 is great to have working as a baseline to see when > problems occur only on a particular architecture.) Did you mean when using CLoop (JIT disabled at compile time)? Or with LLInt compiled with the x86_64 backend (default) and disabling higher tiers at runtime? FWIW x86_64 does use LLInt as its first tier by default. 1688240 2 mcatanzaro 2020-09-14 08:03:04 -0700 Yes, this is with cloop enabled and JIT disabled. (The point of testing cloop on x86_64 is to distinguish between architecture-specific bugs and general cloop bugs.) 1688920 3 mcatanzaro 2020-09-15 16:47:19 -0700 Is there anything I should try running that could maybe help with debugging this? It hangs our internal Jenkins builder, and I'm starting to get nervous about missing CI coverage since it's now been a week since the regression landed. 1688921 4 ysuzuki 2020-09-15 16:48:44 -0700 I think maybe returnEarlyFromInfiniteLoopsForFuzzing's loop-hint thing is not supported in CLoop...? For now, I'll put `isUseJIT()` check 1688922 5 ysuzuki 2020-09-15 16:51:48 -0700 Committed r267115: <https://trac.webkit.org/changeset/267115> 1688923 6 webkit-bug-importer 2020-09-15 16:52:19 -0700 <rdar://problem/68950461> 1688939 7 mcatanzaro 2020-09-15 17:52:44 -0700 OK, thanks Yusuke! $vm.useJIT() will certainly guarantee the test doesn't run.