| Summary: | REGRESSION(r153612): It made jsc and layout tests crash | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Csaba Osztrogonác <ossy> | ||||
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Critical | CC: | abrhm, barraclough, commit-queue, fpizlo, ggaren, jbriance, kadam, mark.lam, mhahnenberg, msaboff, oliver, ossy, zarvai | ||||
| Priority: | P1 | ||||||
| Version: | 528+ (Nightly build) | ||||||
| Hardware: | All | ||||||
| OS: | All | ||||||
| Bug Depends on: | |||||||
| Bug Blocks: | 119140 | ||||||
| Attachments: |
|
||||||
|
Description
Csaba Osztrogonác
2013-08-02 05:41:36 PDT
r153611: http://build.webkit.sed.hu/builders/x86-64%20Linux%20Qt%20Debug/builds/29901 r153612: http://build.webkit.sed.hu/builders/x86-64%20Linux%20Qt%20Debug/builds/29888 +info: - pass with disabled JIT - fail with enabled JIT + enabled DFG JIT - fail with enabled JIT + disabled DFG JIT Some related disassembly: 00000000006c4023 <cti_vm_throw_slowpath>: 6c4023: 55 push %rbp 6c4024: 48 89 e5 mov %rsp,%rbp 6c4027: 48 83 ec 40 sub $0x40,%rsp 6c402b: 48 89 7d d8 mov %rdi,-0x28(%rbp) 6c402f: 48 8b 45 d8 mov -0x28(%rbp),%rax 6c4033: 48 89 c7 mov %rax,%rdi 6c4036: e8 63 2a d9 ff callq 456a9e <JSC::ExecState::codeBlock() const> 6c403b: 48 89 c7 mov %rax,%rdi 6c403e: e8 ab 02 dc ff callq 4842ee <JSC::CodeBlock::vm()> 6c4043: 48 89 45 f8 mov %rax,-0x8(%rbp) 6c4047: 48 8b 45 f8 mov -0x8(%rbp),%rax 6c404b: 48 8b 55 d8 mov -0x28(%rbp),%rdx 6c404f: 48 89 90 80 90 00 00 mov %rdx,0x9080(%rax) 6c4056: 48 8b 45 f8 mov -0x8(%rbp),%rax 6c405a: 48 8b 90 50 aa 00 00 mov 0xaa50(%rax),%rdx 6c4061: 48 8b 4d d8 mov -0x28(%rbp),%rcx 6c4065: 48 8b 45 f8 mov -0x8(%rbp),%rax 6c4069: 48 89 ce mov %rcx,%rsi 6c406c: 48 89 c7 mov %rax,%rdi 6c406f: e8 4b 5b fe ff callq 6a9bbf <JSC::jitThrowNew(JSC::VM*, JSC::ExecState*, JSC::JSValue)> 6c4074: 48 89 c1 mov %rax,%rcx 6c4077: 48 89 d0 mov %rdx,%rax 6c407a: 48 89 4d c0 mov %rcx,-0x40(%rbp) 6c407e: 48 89 45 c8 mov %rax,-0x38(%rbp) 6c4082: 48 8b 45 c0 mov -0x40(%rbp),%rax 6c4086: 48 89 45 e0 mov %rax,-0x20(%rbp) 6c408a: 48 8b 45 c8 mov -0x38(%rbp),%rax 6c408e: 48 89 45 e8 mov %rax,-0x18(%rbp) 6c4092: 48 8b 55 e0 mov -0x20(%rbp),%rdx 6c4096: 48 8b 45 e8 mov -0x18(%rbp),%rax 6c409a: 48 89 d7 mov %rdx,%rdi 6c409d: 48 89 c6 mov %rax,%rsi 6c40a0: e8 33 59 fe ff callq 6a99d8 <JSC::encode(JSC::ExceptionHandler)> 6c40a5: c9 leaveq 6c40a6: c3 retq 00000000006a99d8 <JSC::encode(JSC::ExceptionHandler)>: 6a99d8: 55 push %rbp 6a99d9: 48 89 e5 mov %rsp,%rbp 6a99dc: 48 89 fa mov %rdi,%rdx 6a99df: 48 89 f0 mov %rsi,%rax 6a99e2: 48 89 55 e0 mov %rdx,-0x20(%rbp) 6a99e6: 48 89 45 e8 mov %rax,-0x18(%rbp) 6a99ea: 48 8b 45 e0 mov -0x20(%rbp),%rax 6a99ee: 48 89 45 f0 mov %rax,-0x10(%rbp) 6a99f2: 48 8b 45 e8 mov -0x18(%rbp),%rax 6a99f6: 48 89 45 f8 mov %rax,-0x8(%rbp) 6a99fa: 48 8b 45 f0 mov -0x10(%rbp),%rax 6a99fe: 5d pop %rbp 6a99ff: c3 retq 00000000006bc3fa <ctiVMThrowTrampolineSlowpath>: 6bc3fa: 4c 89 ef mov %r13,%rdi 6bc3fd: e8 21 7c 00 00 callq 6c4023 <cti_vm_throw_slowpath> 6bc402: ff e2 jmpq *%rdx *** Bug 119441 has been marked as a duplicate of this bug. *** Created attachment 208008 [details]
Patch
LGTM: - run-javascriptcore-tests is OK on X86 64-bit release build - run-javascriptcore-tests is OK on X86 64-bit debug build - run-javascriptcore-tests is OK on X86 32-bit release build - run-javascriptcore-tests is OK on X86 32-bit debug build Comment on attachment 208008 [details]
Patch
LGTM, r=me.
Comment on attachment 208008 [details] Patch Clearing flags on attachment: 208008 Committed r153646: <http://trac.webkit.org/changeset/153646> All reviewed patches have been landed. Closing bug. |