Bug 131798

Summary:

REGRESSION: ASSERT(!typeInfo().hasImpureGetOwnPropertySlot() || typeInfo().newImpurePropertyFiresWatchpoints()) on jquery tests

Product:

WebKit

Reporter:

Alexey Proskuryakov <ap>

Component:

CSS

Assignee:

Filip Pizlo <fpizlo>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

ddkilzer, fpizlo

Priority:

Keywords:

InRadar, Regression

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Bug Depends on:

Bug Blocks:

131810

Attachments:

Description	Flags
the patch	ap: review+

Description Alexey Proskuryakov 2014-04-17 11:37:41 PDT

jquery tests started to fail with assertions very frequently yesterday:

http://build.webkit.org/results/Apple%20MountainLion%20(Leaks)/r167385%20(10109)/jquery/attributes-crash-log.txt

ASSERT(!typeInfo().hasImpureGetOwnPropertySlot() || typeInfo().newImpurePropertyFiresWatchpoints())
Thread 17 Crashed:: JSC Compilation Thread
0   com.apple.JavaScriptCore      	0x000000010e5e544a WTFCrash + 42 (Assertions.cpp:333)
1   com.apple.JavaScriptCore      	0x000000010e20453e JSC::Structure::takesSlowPathInDFGForImpureProperty() + 174 (Structure.h:149)
2   com.apple.JavaScriptCore      	0x000000010e203172 JSC::GetByIdStatus::computeForStubInfo(JSC::ConcurrentJITLocker const&, JSC::CodeBlock*, JSC::StructureStubInfo*, WTF::StringImpl*) + 1586 (GetByIdStatus.cpp:221)
3   com.apple.JavaScriptCore      	0x000000010e2029a3 JSC::GetByIdStatus::computeFor(JSC::CodeBlock*, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, unsigned int, WTF::StringImpl*) + 179 (GetByIdStatus.cpp:151)
4   com.apple.JavaScriptCore      	0x000000010e203eef JSC::GetByIdStatus::computeFor(JSC::CodeBlock*, JSC::CodeBlock*, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, JSC::CodeOrigin, WTF::StringImpl*) + 703 (GetByIdStatus.cpp:325)
5   com.apple.JavaScriptCore      	0x000000010e019514 JSC::DFG::ByteCodeParser::parseBlock(unsigned int) + 15412 (DFGByteCodeParser.cpp:2660)
6   com.apple.JavaScriptCore      	0x000000010e013a02 JSC::DFG::ByteCodeParser::parseCodeBlock() + 1970 (DFGByteCodeParser.cpp:3600)
7   com.apple.JavaScriptCore      	0x000000010e01f8d8 JSC::DFG::ByteCodeParser::parse() + 968 (DFGByteCodeParser.cpp:3660)
8   com.apple.JavaScriptCore      	0x000000010e01fc0e JSC::DFG::parse(JSC::DFG::Graph&) + 62 (DFGByteCodeParser.cpp:3685)
9   com.apple.JavaScriptCore      	0x000000010e13a111 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) + 193 (DFGPlan.cpp:193)

Comment 1 Alexey Proskuryakov 2014-04-17 11:40:04 PDT

Hmm, looks like most of the tests crashes once, and were good since then, but jquery/attributes.html is not.

Comment 2 Alexey Proskuryakov 2014-04-17 11:40:18 PDT

s/crashes/crashed/

Comment 3 Filip Pizlo 2014-04-17 13:20:43 PDT

OMG I hate this assertion so much.  It's time to kill it.

Comment 4 Filip Pizlo 2014-04-17 13:48:14 PDT

Created attachment 229571 [details]
the patch

Comment 5 Filip Pizlo 2014-04-17 15:20:54 PDT

Landed in http://trac.webkit.org/changeset/167452

Comment 6 David Kilzer (:ddkilzer) 2014-04-17 20:02:17 PDT

<rdar://problem/15705242>