69346 2011-10-04 10:20:01 -0700 Assertion hit in JSC::DFG::SpeculativeJIT::compile on SL bots 2011-10-05 15:59:17 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 rniwa webkit-unassigned fpizlo oliver pfeldman yurys oldest_to_newest 477688 0 rniwa 2011-10-04 10:20:01 -0700 inspector/console/console-format.html is hitting an assertion in JSC::DFG::SpeculativeJIT::compile on Snow Leopard Intel Debug (Tests). crash log: http://build.webkit.org/results/SnowLeopard%20Intel%20Debug%20(Tests)/r96591%20(2432)/inspector/console/console-format-crash-log.txt 478079 1 fpizlo 2011-10-04 17:20:38 -0700 Aha! This looks like a broken assertion. Fix forthcoming. 478716 2 fpizlo 2011-10-05 15:10:05 -0700 Full diagnosis: DFG's OSR machinery assumes that each bytecode operation sets only one bytecode virtual register, and only does so when the operation has completed successfully. But this is not the case for op_post_inc, which supports statements of the form "x = y++" where x and y are different variables. This statement involves setting x to y's old value, then incrementing y (i.e. adding 1 to its old value and then setting it). The assertion being hit in this failure was asserting that a SetLocal constitutes the end of a bytecode statement. In op_post_inc, there are two SetLocals, with an ArithAdd in between. Hence, it appears that OSR's assumptions, as well as the assertion, are wrong. It turns out that the assumptions of OSR are pretty much right, but just need to be restated: in this case, x is dead prior to op_post_inc anyway. So from OSR's standpoint, it's OK to execute the first SetLocal even if the ArithAdd or subsequent SetLocal will fail. This what OSR is really assuming is that either a SetLocal constitutes the end of a bytecode operation, or its effect is harmless if the bytecode operation is executed again. I don't know of an easy way to put this into an ASSERT statement, so I've removed the old ASSERT statement and am now verifying that this fixes the problem. 478720 3 109872 fpizlo 2011-10-05 15:13:27 -0700 Created attachment 109872 the patch 478759 4 fpizlo 2011-10-05 15:59:17 -0700 Landed in r96762. 109872 2011-10-05 15:13:27 -0700 2011-10-05 15:41:51 -0700 the patch fixpostinc_patch_1.diff text/plain 7142 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gOTY3NTYpCisrKyBTb3VyY2Uv SmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMjIgQEAK KzIwMTEtMTAtMDUgIEZpbGlwIFBpemxvICA8ZnBpemxvQGFwcGxlLmNvbT4KKworICAgICAgICBB c3NlcnRpb24gaGl0IGluIEpTQzo6REZHOjpTcGVjdWxhdGl2ZUpJVDo6Y29tcGlsZSBvbiBTTCBi b3RzCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD02OTM0 NgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorICAgICAgICAKKyAgICAg ICAgUmVtb3ZlZCB0aGUgYXNzZXJ0aW9uLCBzaW5jZSBpdCB3YXMgY29tcGxldGVseSB3cm9uZyBm b3Igb3BfcG9zdF9pbmMuCisgICAgICAgIFNob3J0IG9mIGhhdmluZyBzcGVjaWFsaXplZCBQb3N0 SW5jIG5vZGVzIGluIHRoZSBERkcsIHRoZXJlIGlzIG5vCisgICAgICAgIHJvYnVzdCB3YXkgb2Yg YXNzZXJ0aW5nIHdoYXQgdGhpcyBhc3NlcnRpb24gd2FzIHRyeWluZyB0byBhc3NlcnQgd2hpbGUK KyAgICAgICAgYWxzbyBzdXBwb3J0aW5nIG9wX3Bvc3RfaW5jLgorCisgICAgICAgICogZGZnL0RG R0J5dGVDb2RlUGFyc2VyLmNwcDoKKyAgICAgICAgKEpTQzo6REZHOjpCeXRlQ29kZVBhcnNlcjo6 cGFyc2VCbG9jayk6CisgICAgICAgICogZGZnL0RGR1NwZWN1bGF0aXZlSklUNjQuY3BwOgorICAg ICAgICAoSlNDOjpERkc6OlNwZWN1bGF0aXZlSklUOjpjb21waWxlKToKKyAgICAgICAgKiBkZmcv REZHU3BlY3VsYXRpdmVKSVQzMl82NC5jcHA6CisgICAgICAgIChKU0M6OkRGRzo6U3BlY3VsYXRp dmVKSVQ6OmNvbXBpbGUpOgorCiAyMDExLTEwLTA1ICBPbGl2ZXIgSHVudCAgPG9saXZlckBhcHBs ZS5jb20+CiAKICAgICAgICAgUmVtb3ZlIGxhc3QgdmVzdGlnZXMgb2YgYW5vbnltb3VzIHN0b3Jh Z2UuCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0J5dGVDb2RlUGFyc2VyLmNw cAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0J5dGVDb2RlUGFy c2VyLmNwcAkocmV2aXNpb24gOTY3NDcpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RG R0J5dGVDb2RlUGFyc2VyLmNwcAkod29ya2luZyBjb3B5KQpAQCAtOTIyLDYgKzkyMiw3IEBAIGJv b2wgQnl0ZUNvZGVQYXJzZXI6OnBhcnNlQmxvY2sodW5zaWduZWQKICAgICAgICAgY2FzZSBvcF9w b3N0X2luYzogewogICAgICAgICAgICAgdW5zaWduZWQgcmVzdWx0ID0gY3VycmVudEluc3RydWN0 aW9uWzFdLnUub3BlcmFuZDsKICAgICAgICAgICAgIHVuc2lnbmVkIHNyY0RzdCA9IGN1cnJlbnRJ bnN0cnVjdGlvblsyXS51Lm9wZXJhbmQ7CisgICAgICAgICAgICBBU1NFUlQocmVzdWx0ICE9IHNy Y0RzdCk7IC8vIFJlcXVpcmVkIGZvciBhc3N1bXB0aW9ucyB3ZSBtYWtlIGR1cmluZyBPU1IuCiAg ICAgICAgICAgICBOb2RlSW5kZXggb3AgPSBnZXRUb051bWJlcihzcmNEc3QpOwogICAgICAgICAg ICAgc2V0KHJlc3VsdCwgb3ApOwogICAgICAgICAgICAgc2V0KHNyY0RzdCwgbWFrZVNhZmUoYWRk VG9HcmFwaChBcml0aEFkZCwgT3BJbmZvKE5vZGVVc2VCb3R0b20pLCBvcCwgb25lKCkpKSk7Cklu ZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1NwZWN1bGF0aXZlSklUMzJfNjQuY3Bw Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHU3BlY3VsYXRpdmVK SVQzMl82NC5jcHAJKHJldmlzaW9uIDk2NzUwKQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2Rm Zy9ERkdTcGVjdWxhdGl2ZUpJVDMyXzY0LmNwcAkod29ya2luZyBjb3B5KQpAQCAtNjk4LDI3ICs2 OTgsNiBAQCB2b2lkIFNwZWN1bGF0aXZlSklUOjpjb21waWxlKE5vZGUmIG5vZGUpCiAgICAgICAg IEFTU0VSVChtX2J5dGVjb2RlSW5kZXhGb3JPU1IgPT0gbm9kZS5jb2RlT3JpZ2luLmJ5dGVjb2Rl SW5kZXgoKSk7CiAgICAgICAgIE5vZGUmIG5leHROb2RlID0gbV9qaXQuZ3JhcGgoKVttX2NvbXBp bGVJbmRleCsxXTsKICAgICAgICAgCi0gICAgICAgIC8vIFRoaXMgYXNzZXJ0aW9uIHdpbGwgZmFp bCBpZiB3ZSBldmVyIGVtaXQgbXVsdGlwbGUgU2V0TG9jYWwncyBmb3IKLSAgICAgICAgLy8gYSBz aW5nbGUgYnl0ZWNvZGUgaW5zdHJ1Y3Rpb24uIFRoYXQncyB1bmxpa2VseSB0byBoYXBwZW4uIEJ1 dCBpZgotICAgICAgICAvLyBpdCBkb2VzLCB0aGUgc29sdXRpb24gaXMgdG8gdG8gaGF2ZSB0aGlz IHBlcmZvcm0gYSBzZWFyY2ggdW50aWwKLSAgICAgICAgLy8gaXQgZmluZHMgYSBOb2RlIHdpdGgg YSBkaWZmZXJlbnQgYnl0ZWNvZGUgaW5kZXggZnJvbSB0aGUgb25lIHdlJ3ZlCi0gICAgICAgIC8v IGdvdCwgYW5kIHRvIGFic3RyYWN0bHkgZXhlY3V0ZSB0aGUgU2V0TG9jYWwncyBhbG9uZyB0aGUg d2F5LiBPciwKLSAgICAgICAgLy8gYmV0dGVyIHlldCwgaGFuZGxlIGFsbCBvZiB0aGUgU2V0TG9j YWwncyBhdCBvbmNlOiBhYnN0cmFjdCBpbnRlcnByZXQKLSAgICAgICAgLy8gYWxsIG9mIHRoZW0s IHRoZW4gZW1pdCBjb2RlIGZvciBhbGwgb2YgdGhlbSwgd2l0aCBPU1IgZXhpdGluZyB0bwotICAg ICAgICAvLyB0aGUgbmV4dCBub24tU2V0TG9jYWwgaW5zdHJ1Y3Rpb24uIE5vdGUgdGhlIHNwZWNp YWwgY2FzZSBmb3Igd2hlbgotICAgICAgICAvLyBib3RoIHRoaXMgU2V0TG9jYWwgYW5kIHRoZSBu ZXh0IG9wIGhhdmUgYSBieXRlY29kZSBpbmRleCBvZiAwOyB0aGlzCi0gICAgICAgIC8vIG9jY3Vy cyBmb3IgU2V0TG9jYWwncyBnZW5lcmF0ZWQgYXQgdGhlIHRvcCBvZiB0aGUgY29kZSBibG9jayB0 bwotICAgICAgICAvLyBpbml0aWFsaXplIGxvY2FscyB0byB1bmRlZmluZWQuIElkZWFsbHksIHdl J2QgaGF2ZSBhIHdheSBvZiBtYXJraW5nCi0gICAgICAgIC8vIGluIHRoZSBDb2RlT3JpZ2luIHRo YXQgYSBTZXRMb2NhbCBpcyBzeW50aGV0aWMuIFRoaXMgd2lsbCBtYWtlIHRoZQotICAgICAgICAv LyBhc3NlcnRpb24gbW9yZSBzZW5zaWJsZS1sb29raW5nLiBXZSBzaG91bGQgdGhlbiBhbHNvIGFz c2VydCB0aGF0Ci0gICAgICAgIC8vIHN5bnRoZXRpYyBTZXRMb2NhbCdzIGRvbid0IGhhdmUgc3Bl Y3VsYXRpb24gY2hlY2tzLCBzaW5jZSB0aGV5Ci0gICAgICAgIC8vIHNob3VsZCBvbmx5IGJlIGRy b3BwaW5nIHZhbHVlcyB0aGF0IHdlIHN0YXRpY2FsbHkga25vdyB3ZSBhcmUKLSAgICAgICAgLy8g YWxsb3dlZCB0byBkcm9wIGludG8gdGhlIHZhcmlhYmxlcy4gREZHUHJvcGFnYXRvciB3aWxsIGd1 YXJhbnRlZQotICAgICAgICAvLyB0aGlzLCBzaW5jZSBpdCBzaG91bGQgaGF2ZSBhdCBsZWFzdCBh biBhcHByb3hpbWF0aW9uIChpZiBub3QKLSAgICAgICAgLy8gZXhhY3Qga25vd2xlZGdlKSBvZiB0 aGUgdHlwZSBvZiB0aGUgU2V0TG9jYWwncyBjaGlsZCBub2RlLCBhbmQKLSAgICAgICAgLy8gc2hv dWxkIG1lcmdlIHRoYXQgaW5mb3JtYXRpb24gaW50byB0aGUgbG9jYWwgdGhhdCBpcyBiZWluZyBz ZXQuCi0gICAgICAgIEFTU0VSVChtX2J5dGVjb2RlSW5kZXhGb3JPU1IgIT0gbmV4dE5vZGUuY29k ZU9yaWdpbi5ieXRlY29kZUluZGV4KCkKLSAgICAgICAgICAgICAgIHx8ICghbV9ieXRlY29kZUlu ZGV4Rm9yT1NSICYmICFuZXh0Tm9kZS5jb2RlT3JpZ2luLmJ5dGVjb2RlSW5kZXgoKSkpOwogICAg ICAgICBtX2J5dGVjb2RlSW5kZXhGb3JPU1IgPSBuZXh0Tm9kZS5jb2RlT3JpZ2luLmJ5dGVjb2Rl SW5kZXgoKTsKICAgICAgICAgCiAgICAgICAgIFByZWRpY3RlZFR5cGUgcHJlZGljdGVkVHlwZSA9 IG5vZGUudmFyaWFibGVBY2Nlc3NEYXRhKCktPnByZWRpY3Rpb24oKTsKSW5kZXg6IFNvdXJjZS9K YXZhU2NyaXB0Q29yZS9kZmcvREZHU3BlY3VsYXRpdmVKSVQ2NC5jcHAKPT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0g U291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdTcGVjdWxhdGl2ZUpJVDY0LmNwcAkocmV2aXNp b24gOTY3NTApCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1NwZWN1bGF0aXZlSklU NjQuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC04MDYsMjcgKzgwNiwxNiBAQCB2b2lkIFNwZWN1bGF0 aXZlSklUOjpjb21waWxlKE5vZGUmIG5vZGUpCiAgICAgICAgIEFTU0VSVChtX2J5dGVjb2RlSW5k ZXhGb3JPU1IgPT0gbm9kZS5jb2RlT3JpZ2luLmJ5dGVjb2RlSW5kZXgoKSk7CiAgICAgICAgIE5v ZGUmIG5leHROb2RlID0gbV9qaXQuZ3JhcGgoKVttX2NvbXBpbGVJbmRleCsxXTsKICAgICAgICAg Ci0gICAgICAgIC8vIFRoaXMgYXNzZXJ0aW9uIHdpbGwgZmFpbCBpZiB3ZSBldmVyIGVtaXQgbXVs dGlwbGUgU2V0TG9jYWwncyBmb3IKLSAgICAgICAgLy8gYSBzaW5nbGUgYnl0ZWNvZGUgaW5zdHJ1 Y3Rpb24uIFRoYXQncyB1bmxpa2VseSB0byBoYXBwZW4uIEJ1dCBpZgotICAgICAgICAvLyBpdCBk b2VzLCB0aGUgc29sdXRpb24gaXMgdG8gdG8gaGF2ZSB0aGlzIHBlcmZvcm0gYSBzZWFyY2ggdW50 aWwKLSAgICAgICAgLy8gaXQgZmluZHMgYSBOb2RlIHdpdGggYSBkaWZmZXJlbnQgYnl0ZWNvZGUg aW5kZXggZnJvbSB0aGUgb25lIHdlJ3ZlCi0gICAgICAgIC8vIGdvdCwgYW5kIHRvIGFic3RyYWN0 bHkgZXhlY3V0ZSB0aGUgU2V0TG9jYWwncyBhbG9uZyB0aGUgd2F5LiBPciwKLSAgICAgICAgLy8g YmV0dGVyIHlldCwgaGFuZGxlIGFsbCBvZiB0aGUgU2V0TG9jYWwncyBhdCBvbmNlOiBhYnN0cmFj dCBpbnRlcnByZXQKLSAgICAgICAgLy8gYWxsIG9mIHRoZW0sIHRoZW4gZW1pdCBjb2RlIGZvciBh bGwgb2YgdGhlbSwgd2l0aCBPU1IgZXhpdGluZyB0bwotICAgICAgICAvLyB0aGUgbmV4dCBub24t U2V0TG9jYWwgaW5zdHJ1Y3Rpb24uIE5vdGUgdGhlIHNwZWNpYWwgY2FzZSBmb3Igd2hlbgotICAg ICAgICAvLyBib3RoIHRoaXMgU2V0TG9jYWwgYW5kIHRoZSBuZXh0IG9wIGhhdmUgYSBieXRlY29k ZSBpbmRleCBvZiAwOyB0aGlzCi0gICAgICAgIC8vIG9jY3VycyBmb3IgU2V0TG9jYWwncyBnZW5l cmF0ZWQgYXQgdGhlIHRvcCBvZiB0aGUgY29kZSBibG9jayB0bwotICAgICAgICAvLyBpbml0aWFs aXplIGxvY2FscyB0byB1bmRlZmluZWQuIElkZWFsbHksIHdlJ2QgaGF2ZSBhIHdheSBvZiBtYXJr aW5nCi0gICAgICAgIC8vIGluIHRoZSBDb2RlT3JpZ2luIHRoYXQgYSBTZXRMb2NhbCBpcyBzeW50 aGV0aWMuIFRoaXMgd2lsbCBtYWtlIHRoZQotICAgICAgICAvLyBhc3NlcnRpb24gbW9yZSBzZW5z aWJsZS1sb29raW5nLiBXZSBzaG91bGQgdGhlbiBhbHNvIGFzc2VydCB0aGF0Ci0gICAgICAgIC8v IHN5bnRoZXRpYyBTZXRMb2NhbCdzIGRvbid0IGhhdmUgc3BlY3VsYXRpb24gY2hlY2tzLCBzaW5j ZSB0aGV5Ci0gICAgICAgIC8vIHNob3VsZCBvbmx5IGJlIGRyb3BwaW5nIHZhbHVlcyB0aGF0IHdl IHN0YXRpY2FsbHkga25vdyB3ZSBhcmUKLSAgICAgICAgLy8gYWxsb3dlZCB0byBkcm9wIGludG8g dGhlIHZhcmlhYmxlcy4gREZHUHJvcGFnYXRvciB3aWxsIGd1YXJhbnRlZQotICAgICAgICAvLyB0 aGlzLCBzaW5jZSBpdCBzaG91bGQgaGF2ZSBhdCBsZWFzdCBhbiBhcHByb3hpbWF0aW9uIChpZiBu b3QKLSAgICAgICAgLy8gZXhhY3Qga25vd2xlZGdlKSBvZiB0aGUgdHlwZSBvZiB0aGUgU2V0TG9j YWwncyBjaGlsZCBub2RlLCBhbmQKLSAgICAgICAgLy8gc2hvdWxkIG1lcmdlIHRoYXQgaW5mb3Jt YXRpb24gaW50byB0aGUgbG9jYWwgdGhhdCBpcyBiZWluZyBzZXQuCi0gICAgICAgIEFTU0VSVCht X2J5dGVjb2RlSW5kZXhGb3JPU1IgIT0gbmV4dE5vZGUuY29kZU9yaWdpbi5ieXRlY29kZUluZGV4 KCkKLSAgICAgICAgICAgICAgIHx8ICghbV9ieXRlY29kZUluZGV4Rm9yT1NSICYmICFuZXh0Tm9k ZS5jb2RlT3JpZ2luLmJ5dGVjb2RlSW5kZXgoKSkpOworICAgICAgICAvLyBPZGRseSwgaXQncyBw b3NzaWJsZSBmb3IgdGhlIGJ5dGVjb2RlIGluZGV4IGZvciB0aGUgbmV4dCBub2RlIHRvIGJlCisg ICAgICAgIC8vIGVxdWFsIHRvIG91cnMuIFRoaXMgd2lsbCBoYXBwZW4gZm9yIG9wX3Bvc3RfaW5j LiBBbmQsIGV2ZW4gbW9yZSBvZGRseSwKKyAgICAgICAgLy8gdGhpcyBpcyBqdXN0IGZpbmUuIE9y ZGluYXJpbHksIHRoaXMgd291bGRuJ3QgYmUgZmluZSwgc2luY2UgaWYgdGhlCisgICAgICAgIC8v IG5leHQgbm9kZSBmYWlsZWQgT1NSIHRoZW4gd2UnZCBiZSBPU1ItaW5nIHdpdGggdGhpcyBTZXRM b2NhbCdzIGxvY2FsCisgICAgICAgIC8vIHZhcmlhYmxlIGFscmVhZHkgc2V0IGV2ZW4gdGhvdWdo IGZyb20gdGhlIHN0YW5kcG9pbnQgb2YgdGhlIG9sZCBKSVQsCisgICAgICAgIC8vIHRoaXMgU2V0 TG9jYWwgc2hvdWxkIG5vdCBoYXZlIGV4ZWN1dGVkLiBCdXQgZm9yIG9wX3Bvc3RfaW5jLCBpdCdz IGp1c3QKKyAgICAgICAgLy8gZmluZSwgYmVjYXVzZSB0aGlzIFNldExvY2FsJ3MgbG9jYWwgKGku ZS4gdGhlIExIUyBpbiBhIHggPSB5KysKKyAgICAgICAgLy8gc3RhdGVtZW50KSB3b3VsZCBiZSBk ZWFkIGFueXdheSAtIHNvIHRoZSBmYWN0IHRoYXQgREZHIHdvdWxkIGhhdmUKKyAgICAgICAgLy8g YWxyZWFkeSBtYWRlIHRoZSBhc3NpZ25tZW50LCBhbmQgYmFrZWQgaXQgaW50byB0aGUgcmVnaXN0 ZXIgZmlsZSBkdXJpbmcKKyAgICAgICAgLy8gT1NSIGV4aXQsIHdvdWxkIG5vdCBiZSB2aXNpYmxl IHRvIHRoZSBvbGQgSklUIGluIGFueSB3YXkuCiAgICAgICAgIG1fYnl0ZWNvZGVJbmRleEZvck9T UiA9IG5leHROb2RlLmNvZGVPcmlnaW4uYnl0ZWNvZGVJbmRleCgpOwogICAgICAgICAKICAgICAg ICAgUHJlZGljdGVkVHlwZSBwcmVkaWN0ZWRUeXBlID0gbm9kZS52YXJpYWJsZUFjY2Vzc0RhdGEo KS0+cHJlZGljdGlvbigpOwo=