Bug 129318

Summary: Fix JSC stress test failures on 32-bit x86 on Mac
Product: WebKit Reporter: Mark Lam <mark.lam>
Component: JavaScriptCoreAssignee: Mark Lam <mark.lam>
Status: RESOLVED FIXED    
Severity: Normal CC: fpizlo, ggaren, mhahnenberg, mmirman, msaboff, oliver, ossy, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on: 129947, 129969    
Bug Blocks:    

Mark Lam
Reported 2014-02-25 11:22:48 PST
The jsc stress test results running on 32-bit x86 Mac: stress/recurse-infinitely-on-getter.js.dfg-eager: test_script_5127: line 2: 24956 Bus error: 10 "$@" ../../.vm/JavaScriptCore.framework/Resources/jsc --thresholdForJITAfterWarmUp\=10 --thresholdForJITSoon\=10 --thresholdForOptimizeAfterWarmUp\=20 --thresholdForOptimizeAfterLongWarmUp\=20 --thresholdForOptimizeSoon\=20 --thresholdForFTLOptimizeAfterWarmUp\=20 --thresholdForFTLOptimizeSoon\=20 recurse-infinitely-on-getter.js stress/recurse-infinitely-on-getter.js.dfg-eager: ERROR: Unexpected exit code: 138 stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate: test_script_5128: line 2: 24966 Bus error: 10 "$@" ../../.vm/JavaScriptCore.framework/Resources/jsc --enableConcurrentJIT\=false --validateGraph\=true --thresholdForJITAfterWarmUp\=10 --thresholdForJITSoon\=10 --thresholdForOptimizeAfterWarmUp\=20 --thresholdForOptimizeAfterLongWarmUp\=20 --thresholdForOptimizeSoon\=20 --thresholdForFTLOptimizeAfterWarmUp\=20 --thresholdForFTLOptimizeSoon\=20 recurse-infinitely-on-getter.js stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate: ERROR: Unexpected exit code: 138 8388/8388 (failed 2) ** The following JSC stress test failures have been introduced: stress/recurse-infinitely-on-getter.js.dfg-eager stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate Results for JSC stress tests: 2 failures found.
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2014-02-25 11:25:01 PST
<rdar://problem/16162647>
Csaba Osztrogonác
Comment 2 2014-02-28 08:43:50 PST
Is this bug still valid? I haven't seen these failures on ToT (r164860) on Mavericks with 32 bit build.
Mark Lam
Comment 3 2014-02-28 09:44:04 PST
(In reply to comment #2) > Is this bug still valid? I haven't seen these failures on ToT (r164860) on > Mavericks with 32 bit build. I just did a build and run with r164862, and still saw these. I also saw 15 other new failures.
Filip Pizlo
Comment 4 2014-02-28 09:48:54 PST
(In reply to comment #3) > (In reply to comment #2) > > Is this bug still valid? I haven't seen these failures on ToT (r164860) on > > Mavericks with 32 bit build. > > I just did a build and run with r164862, and still saw these. I also saw 15 other new failures. Can you post the 15 new ones here? At some point we should whip the 32-bit code into shape. :-/
Mark Lam
Comment 5 2014-02-28 09:50:33 PST
Here's the complete list: ** The following JSC stress test failures have been introduced: stress/recurse-infinitely-on-getter.js.default stress/recurse-infinitely-on-getter.js.always-trigger-copy-phase stress/recurse-infinitely-on-getter.js.no-cjit-validate-phases stress/recurse-infinitely-on-getter.js.dfg-eager stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate regress/script-tests/call-spread-call.js.default regress/script-tests/call-spread-call.js.no-llint regress/script-tests/call-spread-call.js.always-trigger-copy-phase regress/script-tests/call-spread-call.js.no-cjit-validate-phases regress/script-tests/call-spread-call.js.dfg-eager regress/script-tests/call-spread-call.js.dfg-eager-no-cjit-validate regress/script-tests/string-cons-tower.js.dfg-eager regress/script-tests/string-cons-tower.js.dfg-eager-no-cjit-validate jsc-layout-tests.yaml/js/script-tests/dfg-convert-this-dom-window.js.layout-no-llint jsc-layout-tests.yaml/js/script-tests/dfg-convert-this-dom-window.js.layout-dfg-eager-no-cjit jsc-layout-tests.yaml/js/script-tests/function-call-aliased.js.layout-no-llint jsc-layout-tests.yaml/js/script-tests/function-call-aliased.js.layout-dfg-eager-no-cjit Results for JSC stress tests: 17 failures found.
Csaba Osztrogonác
Comment 6 2014-02-28 12:19:02 PST
(In reply to comment #5) > Here's the complete list: > > ** The following JSC stress test failures have been introduced: > stress/recurse-infinitely-on-getter.js.default > stress/recurse-infinitely-on-getter.js.always-trigger-copy-phase > stress/recurse-infinitely-on-getter.js.no-cjit-validate-phases > stress/recurse-infinitely-on-getter.js.dfg-eager > stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate I haven't seen these yet. > jsc-layout-tests.yaml/js/script-tests/dfg-convert-this-dom-window.js.layout-no-llint > jsc-layout-tests.yaml/js/script-tests/dfg-convert-this-dom-window.js.layout-dfg-eager-no-cjit > jsc-layout-tests.yaml/js/script-tests/function-call-aliased.js.layout-no-llint > jsc-layout-tests.yaml/js/script-tests/function-call-aliased.js.layout-dfg-eager-no-cjit > regress/script-tests/call-spread-call.js.default > regress/script-tests/call-spread-call.js.no-llint > regress/script-tests/call-spread-call.js.always-trigger-copy-phase > regress/script-tests/call-spread-call.js.no-cjit-validate-phases > regress/script-tests/call-spread-call.js.dfg-eager > regress/script-tests/call-spread-call.js.dfg-eager-no-cjit-validate New bug about these failures: https://bugs.webkit.org/show_bug.cgi?id=129488 > regress/script-tests/string-cons-tower.js.dfg-eager > regress/script-tests/string-cons-tower.js.dfg-eager-no-cjit-validate New bug about these failures: https://bugs.webkit.org/show_bug.cgi?id=129490
Mark Lam
Comment 7 2014-03-06 23:26:30 PST
The list of failures have changed again. With r165232, I'm getting the following when running on 32-bit x86: ** The following JSC stress test failures have been introduced: stress/equals-masquerader.js.default stress/equals-masquerader.js.no-llint stress/equals-masquerader.js.always-trigger-copy-phase stress/equals-masquerader.js.no-cjit-validate-phases stress/equals-masquerader.js.dfg-eager stress/equals-masquerader.js.dfg-eager-no-cjit-validate stress/recurse-infinitely-on-getter.js.default stress/recurse-infinitely-on-getter.js.always-trigger-copy-phase stress/recurse-infinitely-on-getter.js.no-cjit-validate-phases stress/recurse-infinitely-on-getter.js.dfg-eager stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate Results for JSC stress tests: 11 failures found.
Csaba Osztrogonác
Comment 8 2014-03-07 04:36:49 PST
(In reply to comment #7) > The list of failures have changed again. With r165232, I'm getting the following when running on 32-bit x86: > > ** The following JSC stress test failures have been introduced: > stress/equals-masquerader.js.default > stress/equals-masquerader.js.no-llint > stress/equals-masquerader.js.always-trigger-copy-phase > stress/equals-masquerader.js.no-cjit-validate-phases > stress/equals-masquerader.js.dfg-eager > stress/equals-masquerader.js.dfg-eager-no-cjit-validate I can confirm these failures on r165256, it seems to be a new regression. > stress/recurse-infinitely-on-getter.js.default > stress/recurse-infinitely-on-getter.js.always-trigger-copy-phase > stress/recurse-infinitely-on-getter.js.no-cjit-validate-phases > stress/recurse-infinitely-on-getter.js.dfg-eager > stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate I still haven't see these failures on my Mavericks. but got 2 other failures: jsc-layout-tests.yaml/js/script-tests/reentrant-caching.js.layout-no-llint jsc-layout-tests.yaml/js/script-tests/reentrant-caching.js.layout-dfg-eager-no-cjit
Csaba Osztrogonác
Comment 9 2014-03-07 05:20:43 PST
(In reply to comment #7) > The list of failures have changed again. With r165232, I'm getting the following when running on 32-bit x86: > > ** The following JSC stress test failures have been introduced: > stress/equals-masquerader.js.default > stress/equals-masquerader.js.no-llint > stress/equals-masquerader.js.always-trigger-copy-phase > stress/equals-masquerader.js.no-cjit-validate-phases > stress/equals-masquerader.js.dfg-eager > stress/equals-masquerader.js.dfg-eager-no-cjit-validate It is a new test introduced in http://trac.webkit.org/changeset/165119 and fails from the beginning on 32 bit.
Mark Lam
Comment 10 2014-03-08 00:12:43 PST
The 6 stress/equals-masquerader.js tests now passes with the fix for https://bugs.webkit.org/show_bug.cgi?id=129947. The 5 stress/recurse-infinitely-on-getter.js testa are still failing.
Mark Lam
Comment 11 2014-03-08 21:08:47 PST
With the fix for https://bugs.webkit.org/show_bug.cgi?id=129969, the stress/recurse-infinitely-on-getter.js tests no longer crashes. The jsc stress tests are passing completely for me on 32-bit. I haven't been able to reproduce Ossy's reentrant-caching.js failures. However, that test also exercises stack overflow errors. Hence, it is possible that Ossy saw that on his machine and not the stress/recurse-infinitely-on-getter.js because of difference in the compilers we use generating code with difference amount or stack usage, and also different OS'es with different stack sizes. I think it's reasonable to conclude at this point that the issue has been fixed with https://bugs.webkit.org/show_bug.cgi?id=129969. Ossy, I'll going this bug as resolved since I don't see anymore jsc stress test failures on x86 32-bit. If you the failures manifest still, feel free to file a new bug and assign it to me.
Mark Lam
Comment 12 2014-03-08 21:09:35 PST
(In reply to comment #11) > Ossy, I'll going this bug as resolved since I don't see anymore jsc stress test failures on x86 32-bit. If you the failures manifest still, feel free to file a new bug and assign it to me. typo: "going to mark this bug as resolved".
Csaba Osztrogonác
Comment 13 2014-03-10 02:38:44 PDT
All tests pass for me too now. Thanks for fixing them.
Note You need to log in before you can comment on or make changes to this bug.