<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>97088</bug_id>
          
          <creation_ts>2012-09-19 02:20:05 -0700</creation_ts>
          <short_desc>DFG should not assume that a ByVal access is generic just because it was unprofiled</short_desc>
          <delta_ts>2012-09-20 11:05:58 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Filip Pizlo">fpizlo</reporter>
          <assigned_to name="Filip Pizlo">fpizlo</assigned_to>
          <cc>barraclough</cc>
    
    <cc>fpizlo</cc>
    
    <cc>ggaren</cc>
    
    <cc>mark.lam</cc>
    
    <cc>mhahnenberg</cc>
    
    <cc>msaboff</cc>
    
    <cc>oliver</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>723402</commentid>
    <comment_count>0</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2012-09-19 02:20:05 -0700</bug_when>
    <thetext>This is a rare situation, but we may have a ByVal access where:

1) Value profiling has live information for the operands to the ByVal access, because for each operand there is at least one executed operation that has a data flow arc to the operand.

2) Array profiling has no live profiling, because it never executed.

3) The ByVal access was to some manner of array storage.

In that case, we currently assume Generic rather than using ForceExit.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>723406</commentid>
    <comment_count>1</comment_count>
      <attachid>164694</attachid>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2012-09-19 02:32:13 -0700</bug_when>
    <thetext>Created attachment 164694
the patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>723588</commentid>
    <comment_count>2</comment_count>
      <attachid>164694</attachid>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2012-09-19 08:41:12 -0700</bug_when>
    <thetext>Comment on attachment 164694
the patch

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>723893</commentid>
    <comment_count>3</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2012-09-19 15:47:38 -0700</bug_when>
    <thetext>Landed in http://trac.webkit.org/changeset/129053</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>724125</commentid>
    <comment_count>4</comment_count>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2012-09-19 21:34:04 -0700</bug_when>
    <thetext>&lt;http://trac.webkit.org/changeset/129053&gt; may have caused lots of js test failures:

http://build.webkit.org/builders/Apple%20Lion%20%28Leaks%29/builds/2022/steps/jscore-test/logs/stdio</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>724127</commentid>
    <comment_count>5</comment_count>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2012-09-19 21:37:31 -0700</bug_when>
    <thetext>15.4.4.4-1 Array.prototype.reverse()&lt;br&gt;
ASSERTION FAILED: !array-&gt;canSetIndexQuickly(index)&lt;br&gt;
/Volumes/Data/slave/lion-leaks/build/Source/JavaScriptCore/dfg/DFGOperations.cpp(577) : void operationPutByValBeyondArrayBoundsNonStrict(JSC::ExecState *, JSC::JSObject *, int32_t, EncodedJSValue)&lt;br&gt;
1   0x105d8be28 operationPutByValBeyondArrayBoundsNonStrict&lt;br&gt;
2   0x4edf7d804cd2&lt;br&gt;
3   0x105e49510 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*)&lt;br&gt;
4   0x105e4540e JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*)&lt;br&gt;
5   0x105d0c821 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&amp;, JSC::JSValue, JSC::JSValue*)&lt;br&gt;
6   0x105be038c _ZL14runWithScriptsP12GlobalObjectRKN3WTF6VectorI6ScriptLm0EEEb&lt;br&gt;
7   0x105bdf9d2 jscmain(int, char**)&lt;br&gt;
8   0x105bdf87e main&lt;br&gt;
9   0x105bd7704 start&lt;br&gt;
10  0x6&lt;br&gt;
&lt;/tt&gt;&lt;br&gt;
&lt;a name=&apos;failure2&apos;&gt;&lt;/a&gt;&lt;dd&gt;&lt;b&gt;Testcase &lt;a target=&apos;other_window&apos; href=&apos;./ecma/ExecutionContexts/10.2.2-1.js&apos;&gt;ecma/ExecutionContexts/10.2.2-1.js&lt;/a&gt; failed&lt;/b&gt; &lt;br&gt;
 [ &lt;a href=&apos;#failure1&apos;&gt;Previous Failure&lt;/a&gt; | &lt;a href=&apos;#failure3&apos;&gt;Next Failure&lt;/a&gt; | &lt;a href=&apos;#tippy_top&apos;&gt;Top of Page&lt;/a&gt; ]&lt;br&gt;
&lt;tt&gt;Expected exit code 0, got 11&lt;br&gt;
Testcase terminated with signal 0&lt;br&gt;
Complete testcase output was:&lt;br&gt;
10.2.2-1 Eval Code&lt;br&gt;
ASSERTION FAILED: isSet()&lt;br&gt;
/Volumes/Data/slave/lion-leaks/build/Source/JavaScriptCore/dfg/DFGEdge.h(59) : NodeIndex JSC::DFG::Edge::index() const&lt;br&gt;
1   0x1041ba7f3 JSC::DFG::Edge::index() const&lt;br&gt;
2   0x104265cce JSC::DFG::StorageOperand::StorageOperand(JSC::DFG::SpeculativeJIT*, JSC::DFG::Edge)&lt;br&gt;
3   0x104256133 JSC::DFG::StorageOperand::StorageOperand(JSC::DFG::SpeculativeJIT*, JSC::DFG::Edge)&lt;br&gt;
4   0x104245e22 JSC::DFG::SpeculativeJIT::compileGetByValOnString(JSC::DFG::Node&amp;)&lt;br&gt;
5   0x10427d0fc JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node&amp;)&lt;br&gt;
6   0x104244942 JSC::DFG::SpeculativeJIT::compile(JSC::DFG::BasicBlock&amp;)&lt;br&gt;
7   0x104245405 JSC::DFG::SpeculativeJIT::compile()&lt;br&gt;
8   0x10420e8e9 JSC::DFG::JITCompiler::compileBody(JSC::DFG::SpeculativeJIT&amp;)&lt;br&gt;
9   0x10420f9cb JSC::DFG::JITCompiler::compile(JSC::JITCode&amp;)&lt;br&gt;
10  0x1041ff4b2 JSC::DFG::compile(JSC::DFG::CompileMode, JSC::ExecState*, JSC::CodeBlock*, JSC::JITCode&amp;, JSC::MacroAssemblerCodePtr*, unsigned int)&lt;br&gt;
11  0x1041fecdd JSC::DFG::tryCompile(JSC::ExecState*, JSC::CodeBlock*, JSC::JITCode&amp;, unsigned int)&lt;br&gt;
12  0x1042ac167 bool JSC::jitCompileIfAppropriate&lt;JSC::EvalCodeBlock&gt;(JSC::ExecState*, WTF::OwnPtr&lt;JSC::EvalCodeBlock&gt;&amp;, JSC::JITCode&amp;, JSC::JITCode::JITType, unsigned int, JSC::JITCompilationEffort)&lt;br&gt;
13  0x1042acf06 bool JSC::prepareForExecution&lt;JSC::EvalCodeBlock&gt;(JSC::ExecState*, WTF::OwnPtr&lt;JSC::EvalCodeBlock&gt;&amp;, JSC::JITCode&amp;, JSC::JITCode::JITType, unsigned int)&lt;br&gt;
14  0x1042a7ff4 JSC::EvalExecutable::compileInternal(JSC::ExecState*, JSC::JSScope*, JSC::JITCode::JITType, unsigned int)&lt;br&gt;
15  0x1042a7515 JSC::EvalExecutable::compileOptimized(JSC::ExecState*, JSC::JSScope*, unsigned int)&lt;br&gt;
16  0x104175c4d JSC::EvalCodeBlock::compileOptimized(JSC::ExecState*, JSC::JSScope*, unsigned int)&lt;br&gt;
17  0x1043124ff cti_optimize&lt;br&gt;
18  0x10431aad0 jscGeneratedNativeCode&lt;br&gt;
19  0x1042d8510 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*)&lt;br&gt;
20  0x1042cf596 JSC::Interpreter::execute(JSC::EvalExecutable*, JSC::ExecState*, JSC::JSValue, JSC::JSScope*, int)&lt;br&gt;
21  0x1042ceb7f JSC::eval(JSC::ExecState*)&lt;br&gt;
22  0x104317bea cti_op_call_eval&lt;br&gt;
23  0x10431aad0 jscGeneratedNativeCode&lt;br&gt;
24  0x1042d8510 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*)&lt;br&gt;
25  0x1042d440e JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*)&lt;br&gt;
26  0x10419b821 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&amp;, JSC::JSValue, JSC::JSValue*)&lt;br&gt;
27  0x10407238c _ZL14runWithScriptsP12GlobalObjectRKN3WTF6VectorI6ScriptLm0EEEb&lt;br&gt;
28  0x1040719d2 jscmain(int, char**)&lt;br&gt;
29  0x10407187e main&lt;br&gt;
30  0x104069704 start&lt;br&gt;
&lt;/tt&gt;&lt;br&gt;
&lt;a name=&apos;failure3&apos;&gt;&lt;/a&gt;&lt;dd&gt;&lt;b&gt;Testcase &lt;a target=&apos;other_window&apos; href=&apos;./ecma/Expressions/11.4.8.js&apos;&gt;ecma/Expressions/11.4.8.js&lt;/a&gt; failed&lt;/b&gt; &lt;br&gt;
 [ &lt;a href=&apos;#failure2&apos;&gt;Previous Failure&lt;/a&gt; | &lt;a href=&apos;#failure4&apos;&gt;Next Failure&lt;/a&gt; | &lt;a href=&apos;#tippy_top&apos;&gt;Top of Page&lt;/a&gt; ]&lt;br&gt;
&lt;tt&gt;Expected exit code 0, got 11&lt;br&gt;
Testcase terminated with signal 0&lt;br&gt;
Complete testcase output was:&lt;br&gt;
ASSERTION FAILED: descriptor&lt;br&gt;
/Volumes/Data/slave/lion-leaks/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp(3238) : void JSC::DFG::SpeculativeJIT::compileGetArrayLength(JSC::DFG::Node &amp;)&lt;br&gt;
1   0x106166fc3 JSC::DFG::SpeculativeJIT::compileGetArrayLength(JSC::DFG::Node&amp;)&lt;br&gt;
2   0x106199a60 JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node&amp;)&lt;br&gt;
3   0x10615a942 JSC::DFG::SpeculativeJIT::compile(JSC::DFG::BasicBlock&amp;)&lt;br&gt;
4   0x10615b405 JSC::DFG::SpeculativeJIT::compile()&lt;br&gt;
5   0x1061248e9 JSC::DFG::JITCompiler::compileBody(JSC::DFG::SpeculativeJIT&amp;)&lt;br&gt;
6   0x106125e91 JSC::DFG::JITCompiler::compileFunction(JSC::JITCode&amp;, JSC::MacroAssemblerCodePtr&amp;)&lt;br&gt;
7   0x1061153de JSC::DFG::compile(JSC::DFG::CompileMode, JSC::ExecState*, JSC::CodeBlock*, JSC::JITCode&amp;, JSC::MacroAssemblerCodePtr*, unsigned int)&lt;br&gt;
8   0x106114d2c JSC::DFG::tryCompileFunction(JSC::ExecState*, JSC::CodeBlock*, JSC::JITCode&amp;, JSC::MacroAssemblerCodePtr&amp;, unsigned int)&lt;br&gt;
9   0x1061c3dba JSC::jitCompileFunctionIfAppropriate(JSC::ExecState*, WTF::OwnPtr&lt;JSC::FunctionCodeBlock&gt;&amp;, JSC::JITCode&amp;, JSC::MacroAssemblerCodePtr&amp;, JSC::WriteBarrier&lt;JSC::SharedSymbolTable&gt;&amp;, JSC::JITCode::JITType, unsigned int, JSC::JITCompilationEffort)&lt;br&gt;
10  0x1061c4854 JSC::prepareFunctionForExecution(JSC::ExecState*, WTF::OwnPtr&lt;JSC::FunctionCodeBlock&gt;&amp;, JSC::JITCode&amp;, JSC::MacroAssemblerCodePtr&amp;, JSC::WriteBarrier&lt;JSC::SharedSymbolTable&gt;&amp;, JSC::JITCode::JITType, unsigned int, JSC::CodeSpecializationKind)&lt;br&gt;
11  0x1061bfeee JSC::FunctionExecutable::compileForCallInternal(JSC::ExecState*, JSC::JSScope*, JSC::JITCode::JITType, unsigned int)&lt;br&gt;
12  0x1061bfa55 JSC::FunctionExecutable::compileOptimizedForCall(JSC::ExecState*, JSC::JSScope*, unsigned int)&lt;br&gt;
13  0x10609336f JSC::FunctionExecutable::compileOptimizedFor(JSC::ExecState*, JSC::JSScope*, unsigned int, JSC::CodeSpecializationKind)&lt;br&gt;
14  0x10608bd11 JSC::FunctionCodeBlock::compileOptimized(JSC::ExecState*, JSC::JSScope*, unsigned int)&lt;br&gt;
15  0x1062284ff cti_optimize&lt;br&gt;
16  0x106230ad0 jscGeneratedNativeCode&lt;br&gt;
17  0x1061ee510 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*)&lt;br&gt;
18  0x1061ea40e JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*)&lt;br&gt;
19  0x1060b1821 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&amp;, JSC::JSValue, JSC::JSValue*)&lt;br&gt;
20  0x105f8b38c _ZL14runWithScriptsP12GlobalObjectRKN3WTF6VectorI6ScriptLm0EEEb&lt;br&gt;
21  0x105f8a9d2 jscmain(int, char**)&lt;br&gt;
22  0x105f8a87e main&lt;br&gt;
23  0x105f82704 start&lt;br&gt;
24  0x6&lt;br&gt;
&lt;/tt&gt;&lt;br&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>724237</commentid>
    <comment_count>6</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2012-09-20 00:39:08 -0700</bug_when>
    <thetext>(In reply to comment #5)
&gt; 15.4.4.4-1 Array.prototype.reverse()&lt;br&gt;
&gt; ASSERTION FAILED: !array-&gt;canSetIndexQuickly(index)&lt;br&gt;
&gt; /Volumes/Data/slave/lion-leaks/build/Source/JavaScriptCore/dfg/DFGOperations.cpp(577) : void operationPutByValBeyondArrayBoundsNonStrict(JSC::ExecState *, JSC::JSObject *, int32_t, EncodedJSValue)&lt;br&gt;
&gt; 1   0x105d8be28 operationPutByValBeyondArrayBoundsNonStrict&lt;br&gt;
&gt; 2   0x4edf7d804cd2&lt;br&gt;
&gt; 3   0x105e49510 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*)&lt;br&gt;
&gt; 4   0x105e4540e JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*)&lt;br&gt;
&gt; 5   0x105d0c821 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&amp;, JSC::JSValue, JSC::JSValue*)&lt;br&gt;
&gt; 6   0x105be038c _ZL14runWithScriptsP12GlobalObjectRKN3WTF6VectorI6ScriptLm0EEEb&lt;br&gt;
&gt; 7   0x105bdf9d2 jscmain(int, char**)&lt;br&gt;
&gt; 8   0x105bdf87e main&lt;br&gt;
&gt; 9   0x105bd7704 start&lt;br&gt;
&gt; 10  0x6&lt;br&gt;
&gt; &lt;/tt&gt;&lt;br&gt;
&gt; &lt;a name=&apos;failure2&apos;&gt;&lt;/a&gt;&lt;dd&gt;&lt;b&gt;Testcase &lt;a target=&apos;other_window&apos; href=&apos;./ecma/ExecutionContexts/10.2.2-1.js&apos;&gt;ecma/ExecutionContexts/10.2.2-1.js&lt;/a&gt; failed&lt;/b&gt; &lt;br&gt;
&gt;  [ &lt;a href=&apos;#failure1&apos;&gt;Previous Failure&lt;/a&gt; | &lt;a href=&apos;#failure3&apos;&gt;Next Failure&lt;/a&gt; | &lt;a href=&apos;#tippy_top&apos;&gt;Top of Page&lt;/a&gt; ]&lt;br&gt;
&gt; &lt;tt&gt;Expected exit code 0, got 11&lt;br&gt;
&gt; Testcase terminated with signal 0&lt;br&gt;
&gt; Complete testcase output was:&lt;br&gt;
&gt; 10.2.2-1 Eval Code&lt;br&gt;
&gt; ASSERTION FAILED: isSet()&lt;br&gt;
&gt; /Volumes/Data/slave/lion-leaks/build/Source/JavaScriptCore/dfg/DFGEdge.h(59) : NodeIndex JSC::DFG::Edge::index() const&lt;br&gt;
&gt; 1   0x1041ba7f3 JSC::DFG::Edge::index() const&lt;br&gt;
&gt; 2   0x104265cce JSC::DFG::StorageOperand::StorageOperand(JSC::DFG::SpeculativeJIT*, JSC::DFG::Edge)&lt;br&gt;
&gt; 3   0x104256133 JSC::DFG::StorageOperand::StorageOperand(JSC::DFG::SpeculativeJIT*, JSC::DFG::Edge)&lt;br&gt;
&gt; 4   0x104245e22 JSC::DFG::SpeculativeJIT::compileGetByValOnString(JSC::DFG::Node&amp;)&lt;br&gt;
&gt; 5   0x10427d0fc JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node&amp;)&lt;br&gt;
&gt; 6   0x104244942 JSC::DFG::SpeculativeJIT::compile(JSC::DFG::BasicBlock&amp;)&lt;br&gt;
&gt; 7   0x104245405 JSC::DFG::SpeculativeJIT::compile()&lt;br&gt;
&gt; 8   0x10420e8e9 JSC::DFG::JITCompiler::compileBody(JSC::DFG::SpeculativeJIT&amp;)&lt;br&gt;
&gt; 9   0x10420f9cb JSC::DFG::JITCompiler::compile(JSC::JITCode&amp;)&lt;br&gt;
&gt; 10  0x1041ff4b2 JSC::DFG::compile(JSC::DFG::CompileMode, JSC::ExecState*, JSC::CodeBlock*, JSC::JITCode&amp;, JSC::MacroAssemblerCodePtr*, unsigned int)&lt;br&gt;
&gt; 11  0x1041fecdd JSC::DFG::tryCompile(JSC::ExecState*, JSC::CodeBlock*, JSC::JITCode&amp;, unsigned int)&lt;br&gt;
&gt; 12  0x1042ac167 bool JSC::jitCompileIfAppropriate&lt;JSC::EvalCodeBlock&gt;(JSC::ExecState*, WTF::OwnPtr&lt;JSC::EvalCodeBlock&gt;&amp;, JSC::JITCode&amp;, JSC::JITCode::JITType, unsigned int, JSC::JITCompilationEffort)&lt;br&gt;
&gt; 13  0x1042acf06 bool JSC::prepareForExecution&lt;JSC::EvalCodeBlock&gt;(JSC::ExecState*, WTF::OwnPtr&lt;JSC::EvalCodeBlock&gt;&amp;, JSC::JITCode&amp;, JSC::JITCode::JITType, unsigned int)&lt;br&gt;
&gt; 14  0x1042a7ff4 JSC::EvalExecutable::compileInternal(JSC::ExecState*, JSC::JSScope*, JSC::JITCode::JITType, unsigned int)&lt;br&gt;
&gt; 15  0x1042a7515 JSC::EvalExecutable::compileOptimized(JSC::ExecState*, JSC::JSScope*, unsigned int)&lt;br&gt;
&gt; 16  0x104175c4d JSC::EvalCodeBlock::compileOptimized(JSC::ExecState*, JSC::JSScope*, unsigned int)&lt;br&gt;
&gt; 17  0x1043124ff cti_optimize&lt;br&gt;
&gt; 18  0x10431aad0 jscGeneratedNativeCode&lt;br&gt;
&gt; 19  0x1042d8510 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*)&lt;br&gt;
&gt; 20  0x1042cf596 JSC::Interpreter::execute(JSC::EvalExecutable*, JSC::ExecState*, JSC::JSValue, JSC::JSScope*, int)&lt;br&gt;
&gt; 21  0x1042ceb7f JSC::eval(JSC::ExecState*)&lt;br&gt;
&gt; 22  0x104317bea cti_op_call_eval&lt;br&gt;
&gt; 23  0x10431aad0 jscGeneratedNativeCode&lt;br&gt;
&gt; 24  0x1042d8510 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*)&lt;br&gt;
&gt; 25  0x1042d440e JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*)&lt;br&gt;
&gt; 26  0x10419b821 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&amp;, JSC::JSValue, JSC::JSValue*)&lt;br&gt;
&gt; 27  0x10407238c _ZL14runWithScriptsP12GlobalObjectRKN3WTF6VectorI6ScriptLm0EEEb&lt;br&gt;
&gt; 28  0x1040719d2 jscmain(int, char**)&lt;br&gt;
&gt; 29  0x10407187e main&lt;br&gt;
&gt; 30  0x104069704 start&lt;br&gt;
&gt; &lt;/tt&gt;&lt;br&gt;
&gt; &lt;a name=&apos;failure3&apos;&gt;&lt;/a&gt;&lt;dd&gt;&lt;b&gt;Testcase &lt;a target=&apos;other_window&apos; href=&apos;./ecma/Expressions/11.4.8.js&apos;&gt;ecma/Expressions/11.4.8.js&lt;/a&gt; failed&lt;/b&gt; &lt;br&gt;
&gt;  [ &lt;a href=&apos;#failure2&apos;&gt;Previous Failure&lt;/a&gt; | &lt;a href=&apos;#failure4&apos;&gt;Next Failure&lt;/a&gt; | &lt;a href=&apos;#tippy_top&apos;&gt;Top of Page&lt;/a&gt; ]&lt;br&gt;
&gt; &lt;tt&gt;Expected exit code 0, got 11&lt;br&gt;
&gt; Testcase terminated with signal 0&lt;br&gt;
&gt; Complete testcase output was:&lt;br&gt;
&gt; ASSERTION FAILED: descriptor&lt;br&gt;
&gt; /Volumes/Data/slave/lion-leaks/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp(3238) : void JSC::DFG::SpeculativeJIT::compileGetArrayLength(JSC::DFG::Node &amp;)&lt;br&gt;
&gt; 1   0x106166fc3 JSC::DFG::SpeculativeJIT::compileGetArrayLength(JSC::DFG::Node&amp;)&lt;br&gt;
&gt; 2   0x106199a60 JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node&amp;)&lt;br&gt;
&gt; 3   0x10615a942 JSC::DFG::SpeculativeJIT::compile(JSC::DFG::BasicBlock&amp;)&lt;br&gt;
&gt; 4   0x10615b405 JSC::DFG::SpeculativeJIT::compile()&lt;br&gt;
&gt; 5   0x1061248e9 JSC::DFG::JITCompiler::compileBody(JSC::DFG::SpeculativeJIT&amp;)&lt;br&gt;
&gt; 6   0x106125e91 JSC::DFG::JITCompiler::compileFunction(JSC::JITCode&amp;, JSC::MacroAssemblerCodePtr&amp;)&lt;br&gt;
&gt; 7   0x1061153de JSC::DFG::compile(JSC::DFG::CompileMode, JSC::ExecState*, JSC::CodeBlock*, JSC::JITCode&amp;, JSC::MacroAssemblerCodePtr*, unsigned int)&lt;br&gt;
&gt; 8   0x106114d2c JSC::DFG::tryCompileFunction(JSC::ExecState*, JSC::CodeBlock*, JSC::JITCode&amp;, JSC::MacroAssemblerCodePtr&amp;, unsigned int)&lt;br&gt;
&gt; 9   0x1061c3dba JSC::jitCompileFunctionIfAppropriate(JSC::ExecState*, WTF::OwnPtr&lt;JSC::FunctionCodeBlock&gt;&amp;, JSC::JITCode&amp;, JSC::MacroAssemblerCodePtr&amp;, JSC::WriteBarrier&lt;JSC::SharedSymbolTable&gt;&amp;, JSC::JITCode::JITType, unsigned int, JSC::JITCompilationEffort)&lt;br&gt;
&gt; 10  0x1061c4854 JSC::prepareFunctionForExecution(JSC::ExecState*, WTF::OwnPtr&lt;JSC::FunctionCodeBlock&gt;&amp;, JSC::JITCode&amp;, JSC::MacroAssemblerCodePtr&amp;, JSC::WriteBarrier&lt;JSC::SharedSymbolTable&gt;&amp;, JSC::JITCode::JITType, unsigned int, JSC::CodeSpecializationKind)&lt;br&gt;
&gt; 11  0x1061bfeee JSC::FunctionExecutable::compileForCallInternal(JSC::ExecState*, JSC::JSScope*, JSC::JITCode::JITType, unsigned int)&lt;br&gt;
&gt; 12  0x1061bfa55 JSC::FunctionExecutable::compileOptimizedForCall(JSC::ExecState*, JSC::JSScope*, unsigned int)&lt;br&gt;
&gt; 13  0x10609336f JSC::FunctionExecutable::compileOptimizedFor(JSC::ExecState*, JSC::JSScope*, unsigned int, JSC::CodeSpecializationKind)&lt;br&gt;
&gt; 14  0x10608bd11 JSC::FunctionCodeBlock::compileOptimized(JSC::ExecState*, JSC::JSScope*, unsigned int)&lt;br&gt;
&gt; 15  0x1062284ff cti_optimize&lt;br&gt;
&gt; 16  0x106230ad0 jscGeneratedNativeCode&lt;br&gt;
&gt; 17  0x1061ee510 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*)&lt;br&gt;
&gt; 18  0x1061ea40e JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*)&lt;br&gt;
&gt; 19  0x1060b1821 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&amp;, JSC::JSValue, JSC::JSValue*)&lt;br&gt;
&gt; 20  0x105f8b38c _ZL14runWithScriptsP12GlobalObjectRKN3WTF6VectorI6ScriptLm0EEEb&lt;br&gt;
&gt; 21  0x105f8a9d2 jscmain(int, char**)&lt;br&gt;
&gt; 22  0x105f8a87e main&lt;br&gt;
&gt; 23  0x105f82704 start&lt;br&gt;
&gt; 24  0x6&lt;br&gt;
&gt; &lt;/tt&gt;&lt;br&gt;

That&apos;s bizarre!  I didn&apos;t get these before committing, but then again, I made the mistake of not testing before rebasing against https://bugs.webkit.org/show_bug.cgi?id=97080</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>724664</commentid>
    <comment_count>7</comment_count>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2012-09-20 11:05:58 -0700</bug_when>
    <thetext>I don&apos;t see these failures on other bots or locally. But they are reproducible on the Lion leaks bot. I&apos;m not sure what&apos;s unique about that bot.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>164694</attachid>
            <date>2012-09-19 02:32:13 -0700</date>
            <delta_ts>2012-09-19 08:41:12 -0700</delta_ts>
            <desc>the patch</desc>
            <filename>byvalgeneric_patch_1.diff</filename>
            <type>text/plain</type>
            <size>5581</size>
            <attacher name="Filip Pizlo">fpizlo</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291
cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTI4OTgwKQorKysgU291cmNl
L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDMwIEBA
CisyMDEyLTA5LTE5ICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg
REZHIHNob3VsZCBubyBhc3N1bWUgdGhhdCBhIEJ5VmFsIGFjY2VzcyBpcyBnZW5lcmljIGp1c3Qg
YmVjYXVzZSBpdCB3YXMgdW5wcm9maWxlZAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9y
Zy9zaG93X2J1Zy5jZ2k/aWQ9OTcwODgKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P
UFMhKS4KKyAgICAgICAgCisgICAgICAgIFdlIHdlcmUgbm90IGRpc2FtYmlndWF0aW5nIGJldHdl
ZW4gIlVuZGVjaWRlZCIgaW4gdGhlIHNlbnNlIHRoYXQgdGhlIGFycmF5IHByb2ZpbGUKKyAgICAg
ICAgaGFzIG5vIHVzZWZ1bCBpbmZvcm1hdGlvbiB2ZXJzdXMgIlVuZGVjaWRlZCIgaW4gdGhlIHNl
bnNlIHRoYXQgdGhlIGFycmF5IHByb2ZpbGUKKyAgICAgICAga25vd3MgdGhhdCB0aGUgYWNjZXNz
IGhhcyBub3QgZXhlY3V0ZWQuIFRoYXQncyBhbiBpbXBvcnRhbnQgZGlzdGluY3Rpb24sIHNpbmNl
CisgICAgICAgIHRoZSBmb3JtZXIgZm9ybSBvZiAiVW5kZWNpZGVkIiBtZWFucyB0aGF0IHdlIHNo
b3VsZCBjb25zdWx0IHZhbHVlIHByb2ZpbGluZywgd2hpbGUKKyAgICAgICAgdGhlIGxhdHRlciBt
ZWFucyB0aGF0IHdlIHNob3VsZCBmb3JjZSBleGl0IHVubGVzcyB0aGUgdmFsdWUgcHJvZmlsaW5n
IGluZGljYXRlcworICAgICAgICB0aGF0IHRoZSBhY2Nlc3MgbXVzdCBiZSBnZW5lcmljIChiYXNl
IGlzIG5vdCBjZWxsIG9yIHByb3BlcnR5IGlzIG5vdCBpbnQpLgorCisgICAgICAgICogZGZnL0RG
R0Fic3RyYWN0U3RhdGUuY3BwOgorICAgICAgICAoSlNDOjpERkc6OkFic3RyYWN0U3RhdGU6OmV4
ZWN1dGUpOgorICAgICAgICAqIGRmZy9ERkdBcnJheU1vZGUuY3BwOgorICAgICAgICAoSlNDOjpE
Rkc6OmZyb21PYnNlcnZlZCk6CisgICAgICAgIChKU0M6OkRGRzo6cmVmaW5lQXJyYXlNb2RlKToK
KyAgICAgICAgKEpTQzo6REZHOjptb2RlQWxyZWFkeUNoZWNrZWQpOgorICAgICAgICAoSlNDOjpE
Rkc6Om1vZGVUb1N0cmluZyk6CisgICAgICAgICogZGZnL0RGR0FycmF5TW9kZS5oOgorICAgICAg
ICAoSlNDOjpERkc6OmNhbkNTRVN0b3JhZ2UpOgorICAgICAgICAoSlNDOjpERkc6Om1vZGVJc1Nw
ZWNpZmljKToKKyAgICAgICAgKEpTQzo6REZHOjptb2RlU3VwcG9ydHNMZW5ndGgpOgorICAgICAg
ICAoSlNDOjpERkc6OmJlbmVmaXRzRnJvbVN0cnVjdHVyZUNoZWNrKToKKwogMjAxMi0wOS0xOCAg
RmlsaXAgUGl6bG8gIDxmcGl6bG9AYXBwbGUuY29tPgogCiAgICAgICAgIERGRyBzaG91bGQgbm90
IGNhbGwgb3V0IHRvIEMrKyBldmVyeSB0aW1lIHRoYXQgaXQgdHJpZXMgdG8gcHV0IHRvIGFuIG9i
amVjdCB0aGF0IGRvZXNuJ3QgeWV0IGhhdmUgYXJyYXkgc3RvcmFnZQpJbmRleDogU291cmNlL0ph
dmFTY3JpcHRDb3JlL2RmZy9ERkdBYnN0cmFjdFN0YXRlLmNwcAo9PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3Vy
Y2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0Fic3RyYWN0U3RhdGUuY3BwCShyZXZpc2lvbiAxMjg5
NzIpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0Fic3RyYWN0U3RhdGUuY3BwCSh3
b3JraW5nIGNvcHkpCkBAIC04NDEsNiArODQxLDcgQEAgYm9vbCBBYnN0cmFjdFN0YXRlOjpleGVj
dXRlKHVuc2lnbmVkIGluZAogICAgICAgICBub2RlLnNldENhbkV4aXQodHJ1ZSk7CiAgICAgICAg
IHN3aXRjaCAobm9kZS5hcnJheU1vZGUoKSkgewogICAgICAgICBjYXNlIEFycmF5OjpVbmRlY2lk
ZWQ6CisgICAgICAgIGNhc2UgQXJyYXk6OlVucHJvZmlsZWQ6CiAgICAgICAgICAgICBBU1NFUlRf
Tk9UX1JFQUNIRUQoKTsKICAgICAgICAgICAgIGJyZWFrOwogICAgICAgICBjYXNlIEFycmF5OjpG
b3JjZUV4aXQ6CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0FycmF5TW9kZS5j
cHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdBcnJheU1vZGUu
Y3BwCShyZXZpc2lvbiAxMjg5NzIpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0Fy
cmF5TW9kZS5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTM2LDcgKzM2LDcgQEAgQXJyYXk6Ok1vZGUg
ZnJvbU9ic2VydmVkKEFycmF5UHJvZmlsZSogcAogewogICAgIHN3aXRjaCAocHJvZmlsZS0+b2Jz
ZXJ2ZWRBcnJheU1vZGVzKCkpIHsKICAgICBjYXNlIDA6Ci0gICAgICAgIHJldHVybiBBcnJheTo6
VW5kZWNpZGVkOworICAgICAgICByZXR1cm4gQXJyYXk6OlVucHJvZmlsZWQ7CiAgICAgY2FzZSBh
c0FycmF5TW9kZXMoTm9uQXJyYXkpOgogICAgICAgICBpZiAoYWN0aW9uID09IEFycmF5OjpXcml0
ZSAmJiAhcHJvZmlsZS0+bWF5SW50ZXJjZXB0SW5kZXhlZEFjY2Vzc2VzKCkpCiAgICAgICAgICAg
ICByZXR1cm4gQXJyYXk6OkJsYW5rVG9BcnJheVN0b3JhZ2U7IC8vIEZJWE1FOiB3ZSBkb24ndCBr
bm93IHdoZXRoZXIgdG8gZ28gdG8gc2xvdyBwdXQgbW9kZSwgb3Igbm90LiBUaGlzIGlzIGEgZGVj
ZW50IGd1ZXNzLgpAQCAtODcsNiArODcsMTIgQEAgQXJyYXk6Ok1vZGUgcmVmaW5lQXJyYXlNb2Rl
KEFycmF5OjpNb2RlIAogICAgIGlmICghaXNJbnQzMlNwZWN1bGF0aW9uKGluZGV4KSB8fCAhaXND
ZWxsU3BlY3VsYXRpb24oYmFzZSkpCiAgICAgICAgIHJldHVybiBBcnJheTo6R2VuZXJpYzsKICAg
ICAKKyAgICBpZiAoYXJyYXlNb2RlID09IEFycmF5OjpVbnByb2ZpbGVkKSB7CisgICAgICAgIC8v
IElmIHRoZSBpbmRleGluZyB0eXBlIHdhc24ndCByZWNvcmRlZCBpbiB0aGUgYXJyYXkgcHJvZmls
ZSBidXQgdGhlIHZhbHVlcyBhcmUKKyAgICAgICAgLy8gYmFzZT1jZWxsIHByb3BlcnR5PWludCwg
dGhlbiB3ZSBrbm93IHRoYXQgdGhpcyBhY2Nlc3MgZGlkbid0IGV4ZWN1dGUuCisgICAgICAgIHJl
dHVybiBBcnJheTo6Rm9yY2VFeGl0OworICAgIH0KKyAgICAKICAgICBpZiAoYXJyYXlNb2RlICE9
IEFycmF5OjpVbmRlY2lkZWQpCiAgICAgICAgIHJldHVybiBhcnJheU1vZGU7CiAgICAgCkBAIC0x
OTUsNiArMjAxLDcgQEAgYm9vbCBtb2RlQWxyZWFkeUNoZWNrZWQoQWJzdHJhY3RWYWx1ZSYgdgog
ICAgICAgICByZXR1cm4gaXNGbG9hdDY0QXJyYXlTcGVjdWxhdGlvbih2YWx1ZS5tX3R5cGUpOwog
ICAgICAgICAKICAgICBjYXNlIEFycmF5OjpVbmRlY2lkZWQ6CisgICAgY2FzZSBBcnJheTo6VW5w
cm9maWxlZDoKICAgICAgICAgYnJlYWs7CiAgICAgfQogICAgIApAQCAtMjA3LDYgKzIxNCw4IEBA
IGNvbnN0IGNoYXIqIG1vZGVUb1N0cmluZyhBcnJheTo6TW9kZSBtb2QKICAgICBzd2l0Y2ggKG1v
ZGUpIHsKICAgICBjYXNlIEFycmF5OjpVbmRlY2lkZWQ6CiAgICAgICAgIHJldHVybiAiVW5kZWNp
ZGVkIjsKKyAgICBjYXNlIEFycmF5OjpVbnByb2ZpbGVkOgorICAgICAgICByZXR1cm4gIlVucHJv
ZmlsZWQiOwogICAgIGNhc2UgQXJyYXk6OkdlbmVyaWM6CiAgICAgICAgIHJldHVybiAiR2VuZXJp
YyI7CiAgICAgY2FzZSBBcnJheTo6Rm9yY2VFeGl0OgpJbmRleDogU291cmNlL0phdmFTY3JpcHRD
b3JlL2RmZy9ERkdBcnJheU1vZGUuaAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENv
cmUvZGZnL0RGR0FycmF5TW9kZS5oCShyZXZpc2lvbiAxMjg5NzIpCisrKyBTb3VyY2UvSmF2YVNj
cmlwdENvcmUvZGZnL0RGR0FycmF5TW9kZS5oCSh3b3JraW5nIGNvcHkpCkBAIC00OCw2ICs0OCw3
IEBAIGVudW0gQWN0aW9uIHsKIAogZW51bSBNb2RlIHsKICAgICBVbmRlY2lkZWQsIC8vIEltcGxp
ZXMgdGhhdCB3ZSBuZWVkIHByZWRpY3Rpb25zIHRvIGRlY2lkZS4gV2Ugd2lsbCBuZXZlciBnZXQg
dG8gdGhlIGJhY2tlbmQgaW4gdGhpcyBtb2RlLgorICAgIFVucHJvZmlsZWQsIC8vIEltcGxpZXMg
dGhhdCBhcnJheSBwcm9maWxpbmcgZGlkbid0IHNlZSBhbnl0aGluZy4gQnV0IHRoYXQgY291bGQg
YmUgYmVjYXVzZSB0aGUgb3BlcmFuZHMgZGlkbid0IGNvbXBseSB3aXRoIGJhc2ljIHR5cGUgYXNz
dW1wdGlvbnMgKGJhc2UgaXMgY2VsbCwgcHJvcGVydHkgaXMgaW50KS4gVGhpcyBlaXRoZXIgYmVj
b21lcyBHZW5lcmljIG9yIEZvcmNlRXhpdCBkZXBlbmRpbmcgb24gdmFsdWUgcHJvZmlsaW5nLgog
ICAgIEZvcmNlRXhpdCwgLy8gSW1wbGllcyB0aGF0IHdlIGhhdmUgbm8gaWRlYSBob3cgdG8gZXhl
Y3V0ZSB0aGlzIG9wZXJhdGlvbiwgc28gd2Ugc2hvdWxkIGp1c3QgZ2l2ZSB1cC4KICAgICBHZW5l
cmljLAogICAgIFN0cmluZywKQEAgLTE3Niw2ICsxNzcsNyBAQCBpbmxpbmUgYm9vbCBjYW5DU0VT
dG9yYWdlKEFycmF5OjpNb2RlIGFyCiB7CiAgICAgc3dpdGNoIChhcnJheU1vZGUpIHsKICAgICBj
YXNlIEFycmF5OjpVbmRlY2lkZWQ6CisgICAgY2FzZSBBcnJheTo6VW5wcm9maWxlZDoKICAgICBj
YXNlIEFycmF5OjpGb3JjZUV4aXQ6CiAgICAgY2FzZSBBcnJheTo6R2VuZXJpYzoKICAgICBjYXNl
IEFycmF5OjpBcmd1bWVudHM6CkBAIC0yMDgsNiArMjEwLDcgQEAgaW5saW5lIGJvb2wgbW9kZUlz
U3BlY2lmaWMoQXJyYXk6Ok1vZGUgbQogewogICAgIHN3aXRjaCAobW9kZSkgewogICAgIGNhc2Ug
QXJyYXk6OlVuZGVjaWRlZDoKKyAgICBjYXNlIEFycmF5OjpVbnByb2ZpbGVkOgogICAgIGNhc2Ug
QXJyYXk6OkZvcmNlRXhpdDoKICAgICBjYXNlIEFycmF5OjpHZW5lcmljOgogICAgICAgICByZXR1
cm4gZmFsc2U7CkBAIC0yMjAsNiArMjIzLDcgQEAgaW5saW5lIGJvb2wgbW9kZVN1cHBvcnRzTGVu
Z3RoKEFycmF5OjpNbwogewogICAgIHN3aXRjaCAobW9kZSkgewogICAgIGNhc2UgQXJyYXk6OlVu
ZGVjaWRlZDoKKyAgICBjYXNlIEFycmF5OjpVbnByb2ZpbGVkOgogICAgIGNhc2UgQXJyYXk6OkZv
cmNlRXhpdDoKICAgICBjYXNlIEFycmF5OjpHZW5lcmljOgogICAgIGNhc2UgTk9OX0FSUkFZX0FS
UkFZX1NUT1JBR0VfTU9ERVM6CkBAIC0yMzQsNiArMjM4LDcgQEAgaW5saW5lIGJvb2wgYmVuZWZp
dHNGcm9tU3RydWN0dXJlQ2hlY2soQQogICAgIHN3aXRjaCAobW9kZSkgewogICAgIGNhc2UgQUxM
X0VGRkVDVEZVTF9BUlJBWV9TVE9SQUdFX01PREVTOgogICAgIGNhc2UgQXJyYXk6OlVuZGVjaWRl
ZDoKKyAgICBjYXNlIEFycmF5OjpVbnByb2ZpbGVkOgogICAgIGNhc2UgQXJyYXk6OkZvcmNlRXhp
dDoKICAgICBjYXNlIEFycmF5OjpHZW5lcmljOgogICAgICAgICByZXR1cm4gZmFsc2U7Cg==
</data>
<flag name="review"
          id="176536"
          type_id="1"
          status="+"
          setter="ggaren"
    />
          </attachment>
      

    </bug>

</bugzilla>