Summary: | We need test coverage for just the Baseline JIT | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Filip Pizlo <fpizlo> | ||||
Component: | JavaScriptCore | Assignee: | Filip Pizlo <fpizlo> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | ap, barraclough, ggaren, mark.lam, mhahnenberg, msaboff, oliver, sam | ||||
Priority: | P2 | ||||||
Version: | 528+ (Nightly build) | ||||||
Hardware: | All | ||||||
OS: | All | ||||||
Bug Depends on: | 122930, 122937, 122938 | ||||||
Bug Blocks: | |||||||
Attachments: |
|
Description
Filip Pizlo
2013-10-16 16:58:42 PDT
Created attachment 214409 [details]
the patch
Note, I will land this after I make sure that all of the tests pass in this configuration. I suspect that I will see failures.
Sure enough this reveals a crash: mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 12.10-1 The with statment mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: ASSERTION FAILED: !Heap::heap(value) || Heap::heap(value) == Heap::heap(thisObject) mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: /Volumes/Data/primary/OpenSource/Source/JavaScriptCore/runtime/JSObject.cpp(347) : static void JSC::JSObject::put(JSC::JSCell *, JSC::ExecState *, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot &) mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 1 0x10098ffd0 WTFCrash mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 2 0x10075c0cc JSC::JSObject::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 3 0x100552cad JSC::JSValue::put(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 4 0x10054df0e operationPutByIdNonStrictOptimizeWithReturnAddress mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 5 0x4e58cb207457 mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 6 0x1006cad77 JSC::JITCode::execute(JSC::JSStack*, JSC::ExecState*, JSC::VM*) mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 7 0x1006adf8b JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 8 0x10047980f JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 9 0x100365827 runWithScripts(GlobalObject*, WTF::Vector<Script, 0ul, WTF::CrashOnOverflow> const&, bool) mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 10 0x100364f1c jscmain(int, char**) mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 11 0x100364cf6 main mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 12 0x7fff845865fd start mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: test_script_2124: line 2: 7580 Segmentation fault: 11 "$@" /Volumes/Data/primary/OpenSource/WebKitBuild/Debug/jsc --useLLInt\=false --useDFGJIT\=false /Volumes/Data/primary/OpenSource/Source/JavaScriptCore/tests/mozilla/ecma/shell.js 12.10-1.js mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: ERROR: Unexpected exit code: 139 And another failure: jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: DIFF FAILURE! jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: --- /Volumes/Data/primary/OpenSource/LayoutTests/js/dictionary-prototype-caching-expected.txt 2013-10-01 11:22:42.000000000 -0700 jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: +++ /Volumes/Data/primary/OpenSource/WebKitBuild/Debug/jsc-stress-results/jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint.out 2013-10-16 17:28:57.000000000 -0700 jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: @@ -9,7 +9,7 @@ jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: PASS protoKeys is [1,2,3] jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: PASS testFunction(subclass1) is true jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: PASS testFunction(subclass2) is true jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: -PASS testFunction(subclass2) is true jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: +FAIL testFunction(subclass2) should be true. Was false. jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: PASS successfullyParsed is true jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: TEST COMPLETE (In reply to comment #2) > Sure enough this reveals a crash: > > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 12.10-1 The with statment > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: ASSERTION FAILED: !Heap::heap(value) || Heap::heap(value) == Heap::heap(thisObject) > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: /Volumes/Data/primary/OpenSource/Source/JavaScriptCore/runtime/JSObject.cpp(347) : static void JSC::JSObject::put(JSC::JSCell *, JSC::ExecState *, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot &) > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 1 0x10098ffd0 WTFCrash > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 2 0x10075c0cc JSC::JSObject::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 3 0x100552cad JSC::JSValue::put(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 4 0x10054df0e operationPutByIdNonStrictOptimizeWithReturnAddress > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 5 0x4e58cb207457 > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 6 0x1006cad77 JSC::JITCode::execute(JSC::JSStack*, JSC::ExecState*, JSC::VM*) > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 7 0x1006adf8b JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 8 0x10047980f JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 9 0x100365827 runWithScripts(GlobalObject*, WTF::Vector<Script, 0ul, WTF::CrashOnOverflow> const&, bool) > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 10 0x100364f1c jscmain(int, char**) > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 11 0x100364cf6 main > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 12 0x7fff845865fd start > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: test_script_2124: line 2: 7580 Segmentation fault: 11 "$@" /Volumes/Data/primary/OpenSource/WebKitBuild/Debug/jsc --useLLInt\=false --useDFGJIT\=false /Volumes/Data/primary/OpenSource/Source/JavaScriptCore/tests/mozilla/ecma/shell.js 12.10-1.js > mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: ERROR: Unexpected exit code: 139 Fix in: https://bugs.webkit.org/show_bug.cgi?id=122937 Landed in http://trac.webkit.org/changeset/157557 |