69038 2011-09-28 16:05:25 -0700 REGRESSION(r96189): fast/dom/SelectorAPI/resig-SelectorsAPI-test.xhtml, inspector/console/console-format.html, inspector/console/console-dir-global.html failing on SnowLeopard Intel Debug (Tests) 2014-12-17 16:41:55 -0800 1 1 1 Unclassified WebKit Tools / Tests 528+ (Nightly build) Mac OS X 10.6 RESOLVED FIXED http://build.webkit.org/results/SnowLeopard%20Intel%20Debug%20(Tests)/r96189%20(2343)/results.html LayoutTestFailure, MakingBotsRed, Regression P2 Normal --- 1 simon.fraser webkit-unassigned burg fpizlo oliver rniwa oldest_to_newest 475060 0 simon.fraser 2011-09-28 16:05:25 -0700 The following tests started failing on SnowLeopard Intel Debug (Tests) between r96185 and r96189 (inclusive): fast/dom/SelectorAPI/resig-SelectorsAPI-test.xhtml inspector/console/console-format.html inspector/console/console-dir-global.html http://trac.webkit.org/log/trunk?rev=96189&stop_rev=96185&limit=6 http://build.webkit.org/results/SnowLeopard%20Intel%20Debug%20(Tests)/r96184%20(2342)/results.html passed http://build.webkit.org/results/SnowLeopard%20Intel%20Debug%20(Tests)/r96189%20(2343)/results.html failed 475179 1 rniwa 2011-09-28 18:53:15 -0700 Confirmed. The failure of fast/dom/SelectorAPI/resig-SelectorsAPI-test.xhtml is caused by r96189. 475230 2 fpizlo 2011-09-28 22:38:12 -0700 Boy, it sure looks like the world is messed up when you look at fast/dom/SelectorAPI/resig-SelectorsAPI-test.xhtml. And it does not appear to be the fault of r96189 per se; it's just that that patch increases coverage enough that we can start to see some hairy bugs from previous work in DFG. I'm still studying the failure but so far it looks like the following is going wrong: 1) GetMethod sometimes appears to the DFG to have no value profiling even though it has clearly executed at least once. This is evident since other operations in the same basic block have value profiling. 2) The DEBUG_VERBOSE logic for GetScopedVar is totally wrong. This is benign, but still, annoying. 3) This code causes systematic speculation failures because of polymorphic variable reuse, which should be fixed once https://bugs.webkit.org/show_bug.cgi?id=68593 is done. 4) The code that actually fails isn't even running in DFG anyway, though there is plenty of code that runs in DFG outside of what is actually failing. So it's either memory corruption (which I see no other evidence for) or the code that is running in DFG is performing some manner of setup that ends up mattering later. 475234 3 fpizlo 2011-09-28 22:42:41 -0700 Aha - found it. When we predict an argument to be boolean we never check it. https://bugs.webkit.org/show_bug.cgi?id=69059 1056594 4 burg 2014-12-17 16:41:55 -0800 The selector test is no longer skipped on Mac (still EFL and GTK), and inspector tests were removed.