230215 2021-09-13 06:16:29 -0700 [JSC][32bit] Crash in stress/has-own-property-name-cache-symbols-and-strings.js, not enough registers 2021-09-14 05:29:52 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED DUPLICATE 230241 P2 Normal --- 1 xan.lopez webkit-unassigned mikhail xan.lopez ysuzuki oldest_to_newest 1792932 0 xan.lopez 2021-09-13 06:16:29 -0700 Starting program: /home/igalia/xlopez/WebKit/WebKitBuild/Debug/bin/jsc -f JSTests/stress/has-own-property-name-cache-symbols-and-strings.js [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/arm-linux-gnueabihf/libthread_db.so.1". [New Thread 0xf3fb8440 (LWP 17334)] Thread 1 "jsc" received signal SIGABRT, Aborted. __libc_do_syscall () at ../sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:47 47 ../sysdeps/unix/sysv/linux/arm/libc-do-syscall.S: No such file or directory. (gdb) bt #0 __libc_do_syscall () at ../sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:47 #1 0xf5e6dea0 in __libc_signal_restore_set (set=0xfffed31c) at ../sysdeps/unix/sysv/linux/internal-signals.h:86 #2 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:48 #3 0xf5e5e7a2 in __GI_abort () at abort.c:79 #4 0xf6cc52ac in JSC::ScratchRegisterAllocator::allocateScratch<JSC::GPRInfo> (this=0xfffed640) at ../../Source/JavaScriptCore/jit/ScratchRegisterAllocator.cpp:97 #5 0xf6cbc10c in JSC::ScratchRegisterAllocator::allocateScratchGPR (this=0xfffed640) at ../../Source/JavaScriptCore/jit/ScratchRegisterAllocator.cpp:102 #6 0xf62d1ce0 in JSC::AccessCase::generateImpl (this=0xf3699300, state=...) at ../../Source/JavaScriptCore/bytecode/AccessCase.cpp:2276 #7 0xf62cfc4a in JSC::AccessCase::generateWithGuard (this=0xf3699300, state=..., fallThrough=...) at ../../Source/JavaScriptCore/bytecode/AccessCase.cpp:1755 #8 0xf63afcea in JSC::PolymorphicAccess::regenerate (this=0xf369cf20, locker=..., vm=..., globalObject=0xf20f9038, codeBlock=0xf1eac000, ecmaMode=..., stubInfo=...) at ../../Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp:672 #9 0xf63d7d34 in operator() (__closure=0xfffeec94) at ../../Source/JavaScriptCore/bytecode/StructureStubInfo.cpp:221 #10 0xf63d7e8e in JSC::StructureStubInfo::addAccessCase (this=0xf36f6948, locker=..., globalObject=0xf20f9038, codeBlock=0xf1eac000, ecmaMode=..., ident=..., accessCase=...) at ../../Source/JavaScriptCore/bytecode/StructureStubInfo.cpp:245 #11 0xf6cb774a in JSC::tryCachePutBy (globalObject=0xf20f9038, codeBlock=0xf1eac000, baseValue=..., oldStructure=0xf1e9caf0, propertyName=..., slot=..., stubInfo=..., putByKind=JSC::PutByKind::ByVal, putKind=JSC::PutKind::NotDirect) at ../../Source/JavaScriptCore/jit/Repatch.cpp:877 #12 0xf6cb790a in JSC::repatchPutBy (globalObject=0xf20f9038, codeBlock=0xf1eac000, baseValue=..., oldStructure=0xf1e9caf0, propertyName=..., slot=..., stubInfo=..., putByKind=JSC::PutByKind::ByVal, putKind=JSC::PutKind::NotDirect) at ../../Source/JavaScriptCore/jit/Repatch.cpp:897 #13 0xf6c5b34c in JSC::putByValOptimize (globalObject=0xf20f9038, codeBlock=0xf1eac000, baseValue=..., subscript=..., value=..., stubInfo=0xf36f6948, profile=0xf20f6e48, ecmaMode=...) at ../../Source/JavaScriptCore/jit/JITOperations.cpp:1055 #14 0xf6c5b4fe in JSC::operationPutByValNonStrictOptimize (globalObject=0xf20f9038, encodedBaseValue=-17416011584, encodedSubscript=-17415806032, encodedValue=-4294967271, stubInfo=0xf36f6948, profile=0xf20f6e48) at ../../Source/JavaScriptCore/jit/JITOperations.cpp:1087 #15 0xf35fd662 in ?? () Backtrace stopped: previous frame identical to this frame (corrupt stack?) (gdb) Probably also introduced by bug #229229. 1793256 1 xan.lopez 2021-09-14 05:29:52 -0700 *** This bug has been marked as a duplicate of bug 230241 ***