Bug 128278 – <1/100 probability FTL failure: v8-v6/v8-deltablue.js.ftl-eager: Exception: TypeError: undefined is not an object (evaluating 'c.isInput')

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Filip Pizlo]

...

[Filip Pizlo]

I can get it to repro more frequently if I increase the load on the machine.

[Filip Pizlo]

It's a FTL miscompile on chainTest#BRCzIm, which has 430 bytecode instructions.

[Filip Pizlo]

Reduced test case:


function Foo(a, b) {
    this.f = a.f;
    this.g = b.f + 1;
}

function foo(a, b) {
    return new Foo(a, b);
}

noInline(foo);

for (var i = 0; i < 100000; ++i) {
    var result = foo({f:1}, {f:2});
    if (result.f != 1)
        throw "Error: bad result.f: " + result.f;
    if (result.g != 3)
        throw "Error: bad result.g: " + result.g;
}

var result = foo({f:1}, {f:2.5});
if (result.f != 1)
    throw "Error: bad result.f: " + result.f;
if (result.g != 3.5)
    throw "Error: bad result.f: " + result.g;

[Filip Pizlo]

Created attachment 223681 [details]
the patch

[Build Bot]

Comment on attachment 223681 [details]
the patch

Attachment 223681 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.appspot.com/results/6337216930381824

New failing tests:
http/tests/misc/last-modified-parsing.html

[Build Bot]

Created attachment 223685 [details]
Archive of layout-test-results from webkit-ews-11 for mac-mountainlion-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: webkit-ews-11  Port: mac-mountainlion-wk2  Platform: Mac OS X 10.8.5

[Mark Hahnenberg]

Comment on attachment 223681 [details]
the patch

r=me

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/163789