Bug 131798

Summary: REGRESSION: ASSERT(!typeInfo().hasImpureGetOwnPropertySlot() || typeInfo().newImpurePropertyFiresWatchpoints()) on jquery tests
Product: WebKit Reporter: Alexey Proskuryakov <ap>
Component: CSSAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: ddkilzer, fpizlo
Priority: P2 Keywords: InRadar, Regression
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 131810    
Attachments:
Description Flags
the patch ap: review+

Alexey Proskuryakov
Reported 2014-04-17 11:37:41 PDT
jquery tests started to fail with assertions very frequently yesterday: http://build.webkit.org/results/Apple%20MountainLion%20(Leaks)/r167385%20(10109)/jquery/attributes-crash-log.txt ASSERT(!typeInfo().hasImpureGetOwnPropertySlot() || typeInfo().newImpurePropertyFiresWatchpoints()) Thread 17 Crashed:: JSC Compilation Thread 0 com.apple.JavaScriptCore 0x000000010e5e544a WTFCrash + 42 (Assertions.cpp:333) 1 com.apple.JavaScriptCore 0x000000010e20453e JSC::Structure::takesSlowPathInDFGForImpureProperty() + 174 (Structure.h:149) 2 com.apple.JavaScriptCore 0x000000010e203172 JSC::GetByIdStatus::computeForStubInfo(JSC::ConcurrentJITLocker const&, JSC::CodeBlock*, JSC::StructureStubInfo*, WTF::StringImpl*) + 1586 (GetByIdStatus.cpp:221) 3 com.apple.JavaScriptCore 0x000000010e2029a3 JSC::GetByIdStatus::computeFor(JSC::CodeBlock*, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, unsigned int, WTF::StringImpl*) + 179 (GetByIdStatus.cpp:151) 4 com.apple.JavaScriptCore 0x000000010e203eef JSC::GetByIdStatus::computeFor(JSC::CodeBlock*, JSC::CodeBlock*, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, JSC::CodeOrigin, WTF::StringImpl*) + 703 (GetByIdStatus.cpp:325) 5 com.apple.JavaScriptCore 0x000000010e019514 JSC::DFG::ByteCodeParser::parseBlock(unsigned int) + 15412 (DFGByteCodeParser.cpp:2660) 6 com.apple.JavaScriptCore 0x000000010e013a02 JSC::DFG::ByteCodeParser::parseCodeBlock() + 1970 (DFGByteCodeParser.cpp:3600) 7 com.apple.JavaScriptCore 0x000000010e01f8d8 JSC::DFG::ByteCodeParser::parse() + 968 (DFGByteCodeParser.cpp:3660) 8 com.apple.JavaScriptCore 0x000000010e01fc0e JSC::DFG::parse(JSC::DFG::Graph&) + 62 (DFGByteCodeParser.cpp:3685) 9 com.apple.JavaScriptCore 0x000000010e13a111 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) + 193 (DFGPlan.cpp:193)
Attachments
the patch (2.62 KB, patch)
2014-04-17 13:48 PDT, Filip Pizlo 		ap: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Alexey Proskuryakov
Comment 1 2014-04-17 11:40:04 PDT
Hmm, looks like most of the tests crashes once, and were good since then, but jquery/attributes.html is not.
Alexey Proskuryakov
Comment 2 2014-04-17 11:40:18 PDT
s/crashes/crashed/
Filip Pizlo
Comment 3 2014-04-17 13:20:43 PDT
OMG I hate this assertion so much. It's time to kill it.
Filip Pizlo
Comment 4 2014-04-17 13:48:14 PDT
Created attachment 229571 [details] the patch
Filip Pizlo
Comment 5 2014-04-17 15:20:54 PDT
Landed in http://trac.webkit.org/changeset/167452
David Kilzer (:ddkilzer)
Comment 6 2014-04-17 20:02:17 PDT
<rdar://problem/15705242>
Note You need to log in before you can comment on or make changes to this bug.