95398 2012-08-29 16:25:24 -0700 ASSERTION FAILURE in JSC::JSGlobalData::float32ArrayDescriptor when running fast/js/dfg-float64array.html 2012-08-30 18:14:52 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 jberlin fpizlo fpizlo jberlin mhahnenberg webkit-bug-importer webkit.review.bot oldest_to_newest 708021 0 jberlin 2012-08-29 16:25:24 -0700 The prime suspect on this one is http://trac.webkit.org/changeset/126387, although current history does not allow me too look that far back to confirm my suspicions. I suspect this the same underlying issue is also affecting fast/js/dfg-int32array.html fast/js/dfg-float32array.html fast/js/dfg-uint8clampedarray.html fast/js/dfg-poison-fuzz.html fast/js/dfg-float64array.html fast/js/dfg-int32array-overflow-values.html fast/js/dfg-inline-function-dot-caller.html because the crash log links for them are all like "no crash log found for WebProcess:31005. Process failed to become responsive before timing out." http://build.webkit.org/results/Apple%20MountainLion%20Debug%20WK2%20(Tests)/r126586%20(192)/fast/js/dfg-float64array-crash-log.txt Process: WebProcess [31395] Path: /Volumes/VOLUME/*/WebKit2.framework/WebProcess.app/Contents/MacOS/WebProcess Identifier: com.apple.WebProcess Version: 537+ (537.6+) Code Type: X86-64 (Native) Parent Process: WebKitTestRunner [31394] User ID: 501 Date/Time: 2012-08-24 08:40:09.699 -0700 OS Version: Mac OS X 10.8 (12A269) Report Version: 10 Crashed Thread: 0 Dispatch queue: com.apple.main-thread Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x00000000bbadbeef VM Regions Near 0xbbadbeef: --> __TEXT 000000010de25000-000000010de26000 [ 4K] r-x/rwx SM=COW /Volumes/VOLUME/*/WebKit2.framework/WebProcess.app/Contents/MacOS/WebProcess Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x000000010efacd5c JSC::JSGlobalData::float32ArrayDescriptor() const + 92 (JSGlobalData.h:430) 1 com.apple.JavaScriptCore 0x000000010ef9c01d JSC::DFG::SpeculativeJIT::typedArrayDescriptor(JSC::DFG::Array::Mode) + 349 (DFGSpeculativeJIT.cpp:292) 2 com.apple.JavaScriptCore 0x000000010ef9c08b JSC::DFG::SpeculativeJIT::speculateArray(JSC::DFG::Array::Mode, JSC::DFG::Edge, JSC::X86Registers::RegisterID) + 43 (DFGSpeculativeJIT.cpp:300) 3 com.apple.JavaScriptCore 0x000000010efd0697 JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node&) + 12727 (DFGSpeculativeJIT64.cpp:2543) 4 com.apple.JavaScriptCore 0x000000010efa0040 JSC::DFG::SpeculativeJIT::compile(JSC::DFG::BasicBlock&) + 2992 (DFGSpeculativeJIT.cpp:1377) 5 com.apple.JavaScriptCore 0x000000010efa1ac8 JSC::DFG::SpeculativeJIT::compile() + 248 (DFGSpeculativeJIT.cpp:1585) 6 com.apple.JavaScriptCore 0x000000010ef6f8c9 JSC::DFG::JITCompiler::compileBody(JSC::DFG::SpeculativeJIT&) + 25 (DFGJITCompiler.cpp:91) 7 com.apple.JavaScriptCore 0x000000010ef70b6a JSC::DFG::JITCompiler::compileFunction(JSC::JITCode&, JSC::MacroAssemblerCodePtr&) + 314 (DFGJITCompiler.cpp:270) 8 com.apple.JavaScriptCore 0x000000010ef61690 JSC::DFG::compile(JSC::DFG::CompileMode, JSC::ExecState*, JSC::CodeBlock*, JSC::JITCode&, JSC::MacroAssemblerCodePtr*, unsigned int) + 1472 (DFGDriver.cpp:154) 9 com.apple.JavaScriptCore 0x000000010ef610bc JSC::DFG::tryCompileFunction(JSC::ExecState*, JSC::CodeBlock*, JSC::JITCode&, JSC::MacroAssemblerCodePtr&, unsigned int) + 60 (DFGDriver.cpp:172) 10 com.apple.JavaScriptCore 0x000000010effaff9 JSC::jitCompileFunctionIfAppropriate(JSC::ExecState*, WTF::OwnPtr<JSC::FunctionCodeBlock>&, JSC::JITCode&, JSC::MacroAssemblerCodePtr&, JSC::SharedSymbolTable*&, JSC::JITCode::JITType, unsigned int, JSC::JITCompilationEffort) + 249 (JITDriver.h:95) 11 com.apple.JavaScriptCore 0x000000010effb992 JSC::prepareFunctionForExecution(JSC::ExecState*, WTF::OwnPtr<JSC::FunctionCodeBlock>&, JSC::JITCode&, JSC::MacroAssemblerCodePtr&, JSC::SharedSymbolTable*&, JSC::JITCode::JITType, unsigned int, JSC::CodeSpecializationKind) + 290 (ExecutionHarness.h:64) 12 com.apple.JavaScriptCore 0x000000010eff789a JSC::FunctionExecutable::compileForCallInternal(JSC::ExecState*, JSC::ScopeChainNode*, JSC::JITCode::JITType, unsigned int) + 810 (Executable.cpp:532) 13 com.apple.JavaScriptCore 0x000000010eff74fb JSC::FunctionExecutable::compileOptimizedForCall(JSC::ExecState*, JSC::ScopeChainNode*, unsigned int) + 331 (Executable.cpp:442) 14 com.apple.JavaScriptCore 0x000000010eee9050 JSC::FunctionExecutable::compileOptimizedFor(JSC::ExecState*, JSC::ScopeChainNode*, unsigned int, JSC::CodeSpecializationKind) + 336 (Executable.h:611) 15 com.apple.JavaScriptCore 0x000000010eee1e3e JSC::FunctionCodeBlock::compileOptimized(JSC::ExecState*, JSC::ScopeChainNode*, unsigned int) + 158 (CodeBlock.cpp:2744) 16 com.apple.JavaScriptCore 0x000000010f0544ec cti_optimize + 284 (JITStubs.cpp:2025) 17 com.apple.JavaScriptCore 0x000000010f05be10 0x10ee66000 + 2055696 18 com.apple.JavaScriptCore 0x000000010f022a24 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*) + 84 (JITCode.h:133) 19 com.apple.JavaScriptCore 0x000000010f01edb2 JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::ScopeChainNode*, JSC::JSObject*) + 4866 (Interpreter.cpp:1250) 20 com.apple.JavaScriptCore 0x000000010ef038cc JSC::evaluate(JSC::ExecState*, JSC::ScopeChainNode*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 492 (Completion.cpp:75) 21 com.apple.WebCore 0x00000001108f943a WebCore::JSMainThreadExecState::evaluate(JSC::ExecState*, JSC::ScopeChainNode*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 90 (JSMainThreadExecState.h:77) 22 com.apple.WebCore 0x00000001110a3192 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld*) + 370 (ScriptController.cpp:148) 23 com.apple.WebCore 0x00000001110a32c4 WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&) + 68 (ScriptController.cpp:165) 24 com.apple.WebCore 0x00000001110bb1f6 WebCore::ScriptElement::executeScript(WebCore::ScriptSourceCode const&) + 742 (ScriptElement.cpp:301) 25 com.apple.WebCore 0x0000000110497999 WebCore::HTMLScriptRunner::executePendingScriptAndDispatchEvent(WebCore::PendingScript&) + 361 (HTMLScriptRunner.cpp:139) 26 com.apple.WebCore 0x0000000110497816 WebCore::HTMLScriptRunner::executeParsingBlockingScript() + 438 (HTMLScriptRunner.cpp:118) 27 com.apple.WebCore 0x0000000110498021 WebCore::HTMLScriptRunner::executeParsingBlockingScripts() + 97 (HTMLScriptRunner.cpp:190) 28 com.apple.WebCore 0x000000011049819d WebCore::HTMLScriptRunner::executeScriptsWaitingForLoad(WebCore::CachedResource*) + 365 (HTMLScriptRunner.cpp:200) 29 com.apple.WebCore 0x000000011040d432 WebCore::HTMLDocumentParser::notifyFinished(WebCore::CachedResource*) + 290 (HTMLDocumentParser.cpp:515) 30 com.apple.WebCore 0x000000011040d4af non-virtual thunk to WebCore::HTMLDocumentParser::notifyFinished(WebCore::CachedResource*) + 47 31 com.apple.WebCore 0x000000010fd7334d WebCore::CachedResource::checkNotify() + 109 (CachedResource.cpp:248) 32 com.apple.WebCore 0x000000010fd8f2bb WebCore::CachedScript::data(WTF::PassRefPtr<WebCore::SharedBuffer>, bool) + 187 (CachedScript.cpp:91) 33 com.apple.WebCore 0x000000011126cd7c WebCore::SubresourceLoader::didFinishLoading(double) + 524 (SubresourceLoader.cpp:298) 34 com.apple.WebCore 0x000000011105f3a5 WebCore::ResourceLoader::didFinishLoading(WebCore::ResourceHandle*, double) + 53 (ResourceLoader.cpp:442) 35 com.apple.WebCore 0x000000011105bfea -[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:] + 186 (ResourceHandleMac.mm:861) 36 com.apple.Foundation 0x00007fff88cd11e8 __65-[NSURLConnectionInternal _withConnectionAndDelegate:onlyActive:]_block_invoke_0 + 28 37 com.apple.Foundation 0x00007fff88cd112c -[NSURLConnectionInternal _withConnectionAndDelegate:onlyActive:] + 227 38 com.apple.Foundation 0x00007fff88cd1028 -[NSURLConnectionInternal _withActiveConnectionAndDelegate:] + 63 39 com.apple.CFNetwork 0x00007fff89450181 ___delegate_didFinishLoading_block_invoke_0 + 40 40 com.apple.CFNetwork 0x00007fff894426fa ___withDelegateAsync_block_invoke_0 + 90 41 com.apple.CFNetwork 0x00007fff894d25ca __block_global_1 + 28 42 com.apple.CoreFoundation 0x00007fff8e2ade44 CFArrayApplyFunction + 68 43 com.apple.CFNetwork 0x00007fff89433894 RunloopBlockContext::perform() + 124 44 com.apple.CFNetwork 0x00007fff8943376b MultiplexerSource::perform() + 221 45 com.apple.CoreFoundation 0x00007fff8e28f841 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 46 com.apple.CoreFoundation 0x00007fff8e28f165 __CFRunLoopDoSources0 + 245 47 com.apple.CoreFoundation 0x00007fff8e2b24e5 __CFRunLoopRun + 789 48 com.apple.CoreFoundation 0x00007fff8e2b1dd2 CFRunLoopRunSpecific + 290 49 com.apple.HIToolbox 0x00007fff896db774 RunCurrentEventLoopInMode + 209 50 com.apple.HIToolbox 0x00007fff896db512 ReceiveNextEventCommon + 356 51 com.apple.HIToolbox 0x00007fff896db3a3 BlockUntilNextEventMatchingListInMode + 62 52 com.apple.AppKit 0x00007fff881dffa3 _DPSNextEvent + 685 53 com.apple.AppKit 0x00007fff881df862 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128 54 com.apple.AppKit 0x00007fff881d6c03 -[NSApplication run] + 517 55 com.apple.WebCore 0x0000000111086dfc WebCore::RunLoop::run() + 92 (RunLoopMac.mm:37) 56 com.apple.WebKit2 0x000000010e15e40a WebKit::WebProcessMain(WebKit::CommandLine const&) + 3386 (WebProcessMainMac.mm:228) 57 com.apple.WebKit2 0x000000010e06f418 WebKitMain(WebKit::CommandLine const&) + 200 (WebKitMain.cpp:50) 58 com.apple.WebKit2 0x000000010e06f334 WebKitMain + 148 (WebKitMain.cpp:74) 59 com.apple.WebProcess 0x000000010de25da2 main + 274 60 libdyld.dylib 0x00007fff89da77e1 start + 1 708022 1 webkit-bug-importer 2012-08-29 16:26:05 -0700 <rdar://problem/12202429> 708204 2 jberlin 2012-08-29 19:00:42 -0700 On the advice of pizlo, skipped a bunch of the affected tests: http://trac.webkit.org/changeset/127080 708327 3 fpizlo 2012-08-29 22:53:51 -0700 (In reply to comment #2) > On the advice of pizlo, skipped a bunch of the affected tests: http://trac.webkit.org/changeset/127080 Thanks Jessie! I am looking at this now. 708636 4 jberlin 2012-08-30 08:22:19 -0700 Looks like skipping those tests only led to others failing: http://build.webkit.org/results/Apple%20MountainLion%20Debug%20WK2%20(Tests)/r127135%20(434)/results.html fast/js/dfg-uint16array.html fast/js/dfg-int8array.html fast/js/dfg-uint32array.html fast/js/dfg-uint8array.html fast/js/dfg-int16array.html fast/js/dfg-uint32array-overflow-values.html Should I skip all the fast/js/dfg tests? 709105 5 fpizlo 2012-08-30 15:33:17 -0700 (In reply to comment #4) > Looks like skipping those tests only led to others failing: http://build.webkit.org/results/Apple%20MountainLion%20Debug%20WK2%20(Tests)/r127135%20(434)/results.html > > fast/js/dfg-uint16array.html > fast/js/dfg-int8array.html > fast/js/dfg-uint32array.html > fast/js/dfg-uint8array.html > fast/js/dfg-int16array.html > fast/js/dfg-uint32array-overflow-values.html > > Should I skip all the fast/js/dfg tests? That's frustrating. Interestingly, I cannot get the tests to fail locally when I unskip them. I'll try harder though... 709163 6 161589 fpizlo 2012-08-30 16:50:04 -0700 Created attachment 161589 attempt to make more sense of the failures 709166 7 161589 mhahnenberg 2012-08-30 16:50:55 -0700 Comment on attachment 161589 attempt to make more sense of the failures rs=me 709214 8 161589 webkit.review.bot 2012-08-30 18:14:49 -0700 Comment on attachment 161589 attempt to make more sense of the failures Clearing flags on attachment: 161589 Committed r127222: <http://trac.webkit.org/changeset/127222> 709215 9 webkit.review.bot 2012-08-30 18:14:52 -0700 All reviewed patches have been landed. Closing bug. 161589 2012-08-30 16:50:04 -0700 2012-08-30 18:14:48 -0700 attempt to make more sense of the failures descriptor_patch_1.diff text/plain 2951 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTI3MjEyKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBA CisyMDEyLTA4LTMwICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg QVNTRVJUSU9OIEZBSUxVUkUgaW4gSlNDOjpKU0dsb2JhbERhdGE6OmZsb2F0MzJBcnJheURlc2Ny aXB0b3Igd2hlbiBydW5uaW5nIGZhc3QvanMvZGZnLWZsb2F0NjRhcnJheS5odG1sCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD05NTM5OAorCisgICAgICAg IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRyeWluZyB0byBnZXQgdGhl IGJ1aWxkIGZhaWx1cmUgdG8gYmUgYSBiaXQgbW9yZSBpbmZvcm1hdGl2ZS4KKworICAgICAgICAq IHJ1bnRpbWUvSlNHbG9iYWxEYXRhLmg6CisgICAgICAgIChKU0dsb2JhbERhdGEpOgorCiAyMDEy LTA4LTMwICBCZW5qYW1pbiBQb3VsYWluICA8YnBvdWxhaW5AYXBwbGUuY29tPgogCiAgICAgICAg IEFtYmlndW91cyBvcGVyYXRvcltdICBhZnRlciByMTI3MTkxIG9uIHNvbWUgY29tcGlsZXIKSW5k ZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0pTR2xvYmFsRGF0YS5oCj09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0pTR2xvYmFsRGF0YS5oCShyZXZp c2lvbiAxMjcxOTgpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9KU0dsb2JhbERh dGEuaAkod29ya2luZyBjb3B5KQpAQCAtNDIwLDYgKzQyMCw3IEBAIG5hbWVzcGFjZSBKU0Mgewog ICAgICAgICB7IFwKICAgICAgICAgICAgIEFTU0VSVCghbV8jI3R5cGUjI0FycmF5RGVzY3JpcHRv ci5tX2NsYXNzSW5mbyB8fCBtXyMjdHlwZSMjQXJyYXlEZXNjcmlwdG9yLm1fY2xhc3NJbmZvID09 IGRlc2NyaXB0b3IubV9jbGFzc0luZm8pOyBcCiAgICAgICAgICAgICBtXyMjdHlwZSMjQXJyYXlE ZXNjcmlwdG9yID0gZGVzY3JpcHRvcjsgXAorICAgICAgICAgICAgQVNTRVJUKG1fIyN0eXBlIyNB cnJheURlc2NyaXB0b3IubV9jbGFzc0luZm8pOyBcCiAgICAgICAgIH0gXAogICAgICAgICBjb25z dCBUeXBlZEFycmF5RGVzY3JpcHRvciYgdHlwZSMjQXJyYXlEZXNjcmlwdG9yKCkgY29uc3QgeyBB U1NFUlQobV8jI3R5cGUjI0FycmF5RGVzY3JpcHRvci5tX2NsYXNzSW5mbyk7IHJldHVybiBtXyMj dHlwZSMjQXJyYXlEZXNjcmlwdG9yOyB9CiAKSW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDEyNzIxMikKKysr IExheW91dFRlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBACisy MDEyLTA4LTMwICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAgQVNT RVJUSU9OIEZBSUxVUkUgaW4gSlNDOjpKU0dsb2JhbERhdGE6OmZsb2F0MzJBcnJheURlc2NyaXB0 b3Igd2hlbiBydW5uaW5nIGZhc3QvanMvZGZnLWZsb2F0NjRhcnJheS5odG1sCisgICAgICAgIGh0 dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD05NTM5OAorCisgICAgICAgIFJl dmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRlbXBvcmFyaWx5IHVuc2tpcHBp bmcgdGVzdHMgdG8gZmlndXJlIG91dCB3aGF0IGlzIGdvaW5nLgorCisgICAgICAgICogcGxhdGZv cm0vbWFjLXdrMi9Ta2lwcGVkOgorCiAyMDEyLTA4LTMwICBKZXNzaWUgQmVybGluICA8amJlcmxp bkBhcHBsZS5jb20+CiAKICAgICAgICAgQ1NTIDIuMSBmYWlsdXJlOiBtYXJnaW4tY29sbGFwc2Ut Y2xlYXItMDEyIGZhaWxzCkluZGV4OiBMYXlvdXRUZXN0cy9wbGF0Zm9ybS9tYWMtd2syL1NraXBw ZWQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvcGxhdGZvcm0vbWFjLXdrMi9Ta2lwcGVkCShy ZXZpc2lvbiAxMjcxOTgpCisrKyBMYXlvdXRUZXN0cy9wbGF0Zm9ybS9tYWMtd2syL1NraXBwZWQJ KHdvcmtpbmcgY29weSkKQEAgLTM3NSwxNiArMzc1LDYgQEAgc3ZnL3RyYW5zZm9ybXMvY2hhbmdl LXRyYW5zZm9ybS1vcmlnaW4tYwogc3B1dG5pay9Vbmljb2RlL1VuaWNvZGVfMjE4L1M3LjZfQTIu NC5odG1sCiBzcHV0bmlrL1VuaWNvZGUvVW5pY29kZV8yMTgvUzcuNl9BNS4yX1QxLmh0bWwKIAot IyBBc3NlcnRzIHVuZGVyIEpTQzo6REZHOjpTcGVjdWxhdGl2ZUpJVDo6dHlwZWRBcnJheURlc2Ny aXB0b3IKLSMgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTk1Mzk4Ci1m YXN0L2pzL2RmZy1pbnQzMmFycmF5Lmh0bWwKLWZhc3QvanMvZGZnLWZsb2F0MzJhcnJheS5odG1s Ci1mYXN0L2pzL2RmZy11aW50OGNsYW1wZWRhcnJheS5odG1sCi1mYXN0L2pzL2RmZy1wb2lzb24t ZnV6ei5odG1sCi1mYXN0L2pzL2RmZy1mbG9hdDY0YXJyYXkuaHRtbAotZmFzdC9qcy9kZmctaW50 MzJhcnJheS1vdmVyZmxvdy12YWx1ZXMuaHRtbAotZmFzdC9qcy9kZmctaW5saW5lLWZ1bmN0aW9u LWRvdC1jYWxsZXIuaHRtbAotCiAjIyMgRU5EIE9GICgzKSBVbmNsYXNzaWZpZWQgZmFpbHVyZXMK ICMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIAo=