Bug 128910

Summary:	The new tricky-array-bounds-checks.js fails if DFG JIT is disabled
Product:	WebKit	Reporter:	Csaba Osztrogonác <ossy>
Component:	JavaScriptCore	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	fpizlo, mhahnenberg, ossy
Priority:	P2
Version:	528+ (Nightly build)
Hardware:	Unspecified
OS:	Unspecified
Bug Depends on:
Bug Blocks:	125433

Description Csaba Osztrogonác 2014-02-17 07:14:58 PST

new tricky-array-bounds-checks.js introduced in http://trac.webkit.org/changeset/164059
and fails from the beginning if DFG JIT is disabled. Doesn't matter if DFG is disabled
with compile time or runtime option.

stress/tricky-array-bounds-checks.js.always-trigger-copy-phase: Exception: Error: bad result for trick: ,,,false
stress/tricky-array-bounds-checks.js.default: Exception: Error: bad result for trick: ,,,false
stress/tricky-array-bounds-checks.js.no-llint: Exception: Error: bad result for trick: ,,,false
stress/tricky-array-bounds-checks.js.no-cjit-validate-phases: Exception: Error: bad result for trick: ,,,false
stress/tricky-array-bounds-checks.js.default: ERROR: Unexpected exit code: 3
stress/tricky-array-bounds-checks.js.always-trigger-copy-phase: ERROR: Unexpected exit code: 3
stress/tricky-array-bounds-checks.js.no-llint: ERROR: Unexpected exit code: 3
stress/tricky-array-bounds-checks.js.dfg-eager: Exception: Error: bad result for trick: ,,,false
stress/tricky-array-bounds-checks.js.dfg-eager-no-cjit-validate: Exception: Error: bad result for trick: ,,,false
stress/tricky-array-bounds-checks.js.no-cjit-validate-phases: ERROR: Unexpected exit code: 3
stress/tricky-array-bounds-checks.js.dfg-eager: ERROR: Unexpected exit code: 3
stress/tricky-array-bounds-checks.js.dfg-eager-no-cjit-validate: ERROR: Unexpected exit code: 3
8352/8352 (failed 6)                         

** The following JSC stress test failures have been introduced:
    stress/tricky-array-bounds-checks.js.default
    stress/tricky-array-bounds-checks.js.no-llint
    stress/tricky-array-bounds-checks.js.always-trigger-copy-phase
    stress/tricky-array-bounds-checks.js.no-cjit-validate-phases
    stress/tricky-array-bounds-checks.js.dfg-eager
    stress/tricky-array-bounds-checks.js.dfg-eager-no-cjit-validate

Results for JSC stress tests:
    6 failures found.

Comment 1 Csaba Osztrogonác 2014-02-17 10:48:40 PST

Fixed by http://trac.webkit.org/changeset/164226