|Summary:||fourthTier: Segfault in jsc with simple test program when running with profile dumping enabled|
|Product:||WebKit||Reporter:||Mark Hahnenberg <mhahnenberg>|
|Version:||528+ (Nightly build)|
Description Mark Hahnenberg 2013-05-13 17:43:32 PDT
If I run the attached test on the latest revision on the dfgFourthTier branch, I get a segfault. I've also attached the crash log.
Comment 1 Mark Hahnenberg 2013-05-13 17:51:30 PDT
Nevermind about the test case, I think this has to do with having the profiling option enabled on the command line.
Comment 2 Mark Hahnenberg 2013-05-13 17:58:26 PDT
Created attachment 201656 [details] test case Steps to repro: 1) build 2) DYLD_FRAMEWORK_PATH=WebKitBuild/Debug/ WebKitBuild/Debug/jsc -f ~/Code/WebKit-svn-03/OpenSource/test.js -p out.profile 3) Crash.
Comment 3 Mark Hahnenberg 2013-05-13 17:58:47 PDT
I tried disabling both the FTL and concurrent compilation, but the crash still happens.
Comment 4 Filip Pizlo 2013-05-13 21:49:20 PDT
(In reply to comment #0) > If I run the attached test on the latest revision on the dfgFourthTier branch, I get a segfault. I've also attached the crash log. Did you attach the crash log?
Comment 6 Mark Hahnenberg 2013-05-13 21:55:39 PDT
Created attachment 201677 [details] crash log 2 The previous crash log isn't where I was seeing the crash. Attaching a better one.
Comment 7 Mark Hahnenberg 2013-05-14 13:11:22 PDT
From email with Phil: "It's crashing because CodeBlock::baselineVersion() doesn't know how to handle the case where 'this' is the baseline version but it hasn't been assigned to the m_blahCodeBlock field in BlahExecutable." Patch coming soon to a theater near you.