Bug 136111

Summary: REGRESSION(r163179): Sporadic crash in js/dom/line-column-numbers.html test
Product: WebKit Reporter: Michael Saboff <msaboff>
Component: JavaScriptCoreAssignee: Michael Saboff <msaboff>
Status: RESOLVED FIXED    
Severity: Normal CC: mark.lam
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
Patch fpizlo: review+

Michael Saboff
Reported 2014-08-20 11:09:15 PDT
Happening on testbots randomly. Process: DumpRenderTree [8018] Path: /Volumes/VOLUME/*/DumpRenderTree Identifier: DumpRenderTree Version: 0 Code Type: X86-64 (Native) Parent Process: Python [8017] User ID: 501 Date/Time: 2014-08-20 08:07:16.341 -0700 OS Version: Mac OS X 10.8.5 (12F45) Report Version: 10 Crashed Thread: 0 Dispatch queue: com.apple.main-thread Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000000 VM Regions Near 0: --> __TEXT 0000000102a81000-0000000102ad4000 [ 332K] r-x/rwx SM=COW /Volumes/VOLUME/* Application Specific Information: CRASHING TEST: js/dom/line-column-numbers.html Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x0000000102c326ed JSC::ExecState::vmEntryGlobalObject() + 13 (StructureIDTable.h:87) 1 com.apple.JavaScriptCore 0x0000000102e470d4 JSC::Interpreter::unwind(JSC::ExecState*&, JSC::JSValue&) + 100 (JSGlobalObject.h:518) 2 com.apple.JavaScriptCore 0x0000000102e61698 JSC::genericUnwind(JSC::VM*, JSC::ExecState*, JSC::JSValue) + 72 (JITExceptions.cpp:65) 3 ??? 0x00002d4b7003360c 0 + 49802025055756 4 com.apple.JavaScriptCore 0x0000000102f49899 vmEntryToJavaScript + 326 5 com.apple.JavaScriptCore 0x0000000102e5fe13 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 35 (VM.h:363) 6 com.apple.JavaScriptCore 0x0000000102e493b6 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 438 (Interpreter.cpp:986) 7 com.apple.JavaScriptCore 0x0000000102c3259e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 (CallData.cpp:39) 8 com.apple.JavaScriptCore 0x0000000102ed8535 JSC::JSObject::defaultValue(JSC::JSObject const*, JSC::ExecState*, JSC::PreferredPrimitiveType) + 1189 (Register.h:116) 9 ??? 0x00002d4b7003350c 0 + 49802025055500 10 com.apple.JavaScriptCore 0x0000000102f49899 vmEntryToJavaScript + 326 11 com.apple.JavaScriptCore 0x0000000102e5fe13 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 35 (VM.h:363) 12 com.apple.JavaScriptCore 0x0000000102e493b6 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 438 (Interpreter.cpp:986) 13 com.apple.JavaScriptCore 0x0000000102c3259e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 (CallData.cpp:39) 14 com.apple.JavaScriptCore 0x0000000102ed8535 JSC::JSObject::defaultValue(JSC::JSObject const*, JSC::ExecState*, JSC::PreferredPrimitiveType) + 1189 (Register.h:116) 15 ??? 0x00002d4b7003350c 0 + 49802025055500 16 com.apple.JavaScriptCore 0x0000000102f49899 vmEntryToJavaScript + 326 17 com.apple.JavaScriptCore 0x0000000102e5fe13 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 35 (VM.h:363) 18 com.apple.JavaScriptCore 0x0000000102e493b6 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 438 (Interpreter.cpp:986) 19 com.apple.JavaScriptCore 0x0000000102c3259e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 (CallData.cpp:39) 20 com.apple.JavaScriptCore 0x0000000102ed8535 JSC::JSObject::defaultValue(JSC::JSObject const*, JSC::ExecState*, JSC::PreferredPrimitiveType) + 1189 (Register.h:116) 21 ??? 0x00002d4b7003350c 0 + 49802025055500 22 com.apple.JavaScriptCore 0x0000000102f49899 vmEntryToJavaScript + 326 23 com.apple.JavaScriptCore 0x0000000102e5fe13 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 35 (VM.h:363) 24 com.apple.JavaScriptCore 0x0000000102e493b6 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 438 (Interpreter.cpp:986) 25 com.apple.JavaScriptCore 0x0000000102c3259e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 (CallData.cpp:39) 26 com.apple.JavaScriptCore 0x0000000102ed8535 JSC::JSObject::defaultValue(JSC::JSObject const*, JSC::ExecState*, JSC::PreferredPrimitiveType) + 1189 (Register.h:116) 27 ??? 0x00002d4b7003350c 0 + 49802025055500 28 com.apple.JavaScriptCore 0x0000000102f49899 vmEntryToJavaScript + 326 29 com.apple.JavaScriptCore 0x0000000102e5fe13 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 35 (VM.h:363) 30 com.apple.JavaScriptCore 0x0000000102e493b6 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 438 (Interpreter.cpp:986) 31 com.apple.JavaScriptCore 0x0000000102c3259e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 (CallData.cpp:39) 32 com.apple.JavaScriptCore 0x0000000102ed8535 JSC::JSObject::defaultValue(JSC::JSObject const*, JSC::ExecState*, JSC::PreferredPrimitiveType) + 1189 (Register.h:116) 33 ??? 0x00002d4b7003350c 0 + 49802025055500 34 com.apple.JavaScriptCore 0x0000000102f49899 vmEntryToJavaScript + 326 35 com.apple.JavaScriptCore 0x0000000102e5fe13 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 35 (VM.h:363) 36 com.apple.JavaScriptCore 0x0000000102e493b6 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 438 (Interpreter.cpp:986) 37 com.apple.JavaScriptCore 0x0000000102c3259e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 (CallData.cpp:39) 38 com.apple.JavaScriptCore 0x0000000102ed8535 JSC::JSObject::defaultValue(JSC::JSObject const*, JSC::ExecState*, JSC::PreferredPrimitiveType) + 1189 (Register.h:116) 39 ??? 0x00002d4b7003350c 0 + 49802025055500 40 com.apple.JavaScriptCore 0x0000000102f49899 vmEntryToJavaScript + 326 41 com.apple.JavaScriptCore 0x0000000102e5fe13 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 35 (VM.h:363) 42 com.apple.JavaScriptCore 0x0000000102e493b6 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 438 (Interpreter.cpp:986) 43 com.apple.JavaScriptCore 0x0000000102c3259e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 (CallData.cpp:39) 44 com.apple.JavaScriptCore 0x0000000102ed8535 JSC::JSObject::defaultValue(JSC::JSObject const*, JSC::ExecState*, JSC::PreferredPrimitiveType) + 1189 (Register.h:116) 45 ??? 0x00002d4b7003350c 0 + 49802025055500 46 com.apple.JavaScriptCore 0x0000000102f49899 vmEntryToJavaScript + 326 47 com.apple.JavaScriptCore 0x0000000102e5fe13 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 35 (VM.h:363) 48 com.apple.JavaScriptCore 0x0000000102e493b6 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 438 (Interpreter.cpp:986) 49 com.apple.JavaScriptCore 0x0000000102c3259e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 (CallData.cpp:39) 50 com.apple.JavaScriptCore 0x0000000102ed8535 JSC::JSObject::defaultValue(JSC::JSObject const*, JSC::ExecState*, JSC::PreferredPrimitiveType) + 1189 (Register.h:116) 51 ??? 0x00002d4b7003350c 0 + 49802025055500 52 com.apple.JavaScriptCore 0x0000000102f49899 vmEntryToJavaScript + 326 53 com.apple.JavaScriptCore 0x0000000102e5fe13 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 35 (VM.h:363) 54 com.apple.JavaScriptCore 0x0000000102e493b6 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 438 (Interpreter.cpp:986) 55 com.apple.JavaScriptCore 0x0000000102c3259e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 (CallData.cpp:39) 56 com.apple.JavaScriptCore 0x0000000102ed8535 JSC::JSObject::defaultValue(JSC::JSObject const*, JSC::ExecState*, JSC::PreferredPrimitiveType) + 1189 (Register.h:116) 57 ??? 0x00002d4b7003350c 0 + 49802025055500 58 com.apple.JavaScriptCore 0x0000000102f49899 vmEntryToJavaScript + 326 59 com.apple.JavaScriptCore 0x0000000102e5fe13 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 35 (VM.h:363) 60 com.apple.JavaScriptCore 0x0000000102e493b6 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 438 (Interpreter.cpp:986) 61 com.apple.JavaScriptCore 0x0000000102c3259e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 (CallData.cpp:39) 62 com.apple.JavaScriptCore 0x0000000102ed8535 JSC::JSObject::defaultValue(JSC::JSObject const*, JSC::ExecState*, JSC::PreferredPrimitiveType) + 1189 (Register.h:116) 63 ??? 0x00002d4b7003350c 0 + 49802025055500 64 com.apple.JavaScriptCore 0x0000000102f49899 vmEntryToJavaScript + 326 65 com.apple.JavaScriptCore 0x0000000102e5fe13 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 35 (VM.h:363) 66 com.apple.JavaScriptCore 0x0000000102e493b6 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 438 (Interpreter.cpp:986) 67 com.apple.JavaScriptCore 0x0000000102c3259e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 (CallData.cpp:39) 68 com.apple.JavaScriptCore 0x0000000102ed8535 JSC::JSObject::defaultValue(JSC::JSObject const*, JSC::ExecState*, JSC::PreferredPrimitiveType) + 1189 (Register.h:116) ...
Attachments
Patch (25.79 KB, patch)
2014-08-21 18:37 PDT, Michael Saboff 		fpizlo: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Mark Lam
Comment 1 2014-08-20 12:35:25 PDT
Here's a debug stack trace of this crash: Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x000000010ba2800b JSC::StructureIDTable::get(unsigned int) + 43 (StructureIDTable.h:86) 1 com.apple.JavaScriptCore 0x000000010ba2ea76 JSC::JSCell::structure(JSC::VM&) const + 54 (JSCellInlines.h:105) 2 com.apple.JavaScriptCore 0x000000010ba362e1 JSC::JSCell::classInfo() const + 97 (JSCellInlines.h:239) 3 com.apple.JavaScriptCore 0x000000010ba2a739 JSC::JSCell::inherits(JSC::ClassInfo const*) const + 25 (JSCellInlines.h:209) 4 com.apple.JavaScriptCore 0x000000010ba32353 JSC::JSScope* JSC::jsCast<JSC::JSScope*>(JSC::JSValue) + 67 (JSCell.h:241) 5 com.apple.JavaScriptCore 0x000000010ba32302 JSC::Register::scope() const + 34 (JSScope.h:236) 6 com.apple.JavaScriptCore 0x000000010ba32255 JSC::ExecState::scope() const + 37 (CallFrame.h:50) 7 com.apple.JavaScriptCore 0x000000010ba2b329 JSC::ExecState::vm() const + 25 (JSScope.h:241) 8 com.apple.JavaScriptCore 0x000000010bed8166 JSC::Interpreter::unwind(JSC::ExecState*&, JSC::JSValue&) + 406 (Interpreter.cpp:698) 9 com.apple.JavaScriptCore 0x000000010bef82e7 JSC::genericUnwind(JSC::VM*, JSC::ExecState*, JSC::JSValue) + 183 (JITExceptions.cpp:51) 10 com.apple.JavaScriptCore 0x000000010bf0a338 lookupExceptionHandler + 136 (JITOperations.cpp:1838) 11 ??? 0x000051d30000a027 0 + 89966679990311 12 com.apple.JavaScriptCore 0x000000010c05f1f9 vmEntryToJavaScript + 361 13 com.apple.JavaScriptCore 0x000000010bef4d7d JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 45 (JITCode.cpp:47) 14 com.apple.JavaScriptCore 0x000000010bed9eba JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 1450 (Interpreter.cpp:986) 15 com.apple.JavaScriptCore 0x000000010bab7f2e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 190 (CallData.cpp:39) 16 com.apple.JavaScriptCore 0x000000010bfafd73 JSC::callDefaultValueFunction(JSC::ExecState*, JSC::JSObject const*, JSC::PropertyName) + 243 (JSObject.cpp:1383) 17 com.apple.JavaScriptCore 0x000000010bfaa147 JSC::JSObject::defaultValue(JSC::JSObject const*, JSC::ExecState*, JSC::PreferredPrimitiveType) + 567 (JSObject.cpp:1418) 18 com.apple.JavaScriptCore 0x000000010bf4cf84 JSC::JSObject::toPrimitive(JSC::ExecState*, JSC::PreferredPrimitiveType) const + 52 (JSObject.h:1465) 19 com.apple.JavaScriptCore 0x000000010bf4c9ef JSC::JSCell::toPrimitive(JSC::ExecState*, JSC::PreferredPrimitiveType) const + 95 (JSCell.cpp:141) 20 com.apple.JavaScriptCore 0x000000010bb1eab8 JSC::JSValue::toPrimitive(JSC::ExecState*, JSC::PreferredPrimitiveType) const + 72 (JSCJSValueInlines.h:609) 21 com.apple.JavaScriptCore 0x000000010bca97fd operationToPrimitive + 77 (DFGOperations.cpp:615) 22 ??? 0x000051d300009ece 0 + 89966679989966 23 com.apple.JavaScriptCore 0x000000010c05f1f9 vmEntryToJavaScript + 361 24 com.apple.JavaScriptCore 0x000000010bef4d7d JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 45 (JITCode.cpp:47) 25 com.apple.JavaScriptCore 0x000000010bed9eba JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 1450 (Interpreter.cpp:986) 26 com.apple.JavaScriptCore 0x000000010bab7f2e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 190 (CallData.cpp:39) 27 com.apple.JavaScriptCore 0x000000010bfafd73 JSC::callDefaultValueFunction(JSC::ExecState*, JSC::JSObject const*, JSC::PropertyName) + 243 (JSObject.cpp:1383) 28 com.apple.JavaScriptCore 0x000000010bfaa147 JSC::JSObject::defaultValue(JSC::JSObject const*, JSC::ExecState*, JSC::PreferredPrimitiveType) + 567 (JSObject.cpp:1418) 29 com.apple.JavaScriptCore 0x000000010bf4cf84 JSC::JSObject::toPrimitive(JSC::ExecState*, JSC::PreferredPrimitiveType) const + 52 (JSObject.h:1465) 30 com.apple.JavaScriptCore 0x000000010bf4c9ef JSC::JSCell::toPrimitive(JSC::ExecState*, JSC::PreferredPrimitiveType) const + 95 (JSCell.cpp:141) 31 com.apple.JavaScriptCore 0x000000010bb1eab8 JSC::JSValue::toPrimitive(JSC::ExecState*, JSC::PreferredPrimitiveType) const + 72 (JSCJSValueInlines.h:609) 32 com.apple.JavaScriptCore 0x000000010bca97fd operationToPrimitive + 77 (DFGOperations.cpp:615) 33 ??? 0x000051d300009ece 0 + 89966679989966 34 com.apple.JavaScriptCore 0x000000010c05f1f9 vmEntryToJavaScript + 361 35 com.apple.JavaScriptCore 0x000000010bef4d7d JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 45 (JITCode.cpp:47) 36 com.apple.JavaScriptCore 0x000000010bed9eba JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 1450 (Interpreter.cpp:986) 37 com.apple.JavaScriptCore 0x000000010bab7f2e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 190 (CallData.cpp:39) 38 com.apple.JavaScriptCore 0x000000010bfafd73 JSC::callDefaultValueFunction(JSC::ExecState*, JSC::JSObject const*, JSC::PropertyName) + 243 (JSObject.cpp:1383) 39 com.apple.JavaScriptCore 0x000000010bfaa147 JSC::JSObject::defaultValue(JSC::JSObject const*, JSC::ExecState*, JSC::PreferredPrimitiveType) + 567 (JSObject.cpp:1418) 40 com.apple.JavaScriptCore 0x000000010bf4cf84 JSC::JSObject::toPrimitive(JSC::ExecState*, JSC::PreferredPrimitiveType) const + 52 (JSObject.h:1465) 41 com.apple.JavaScriptCore 0x000000010bf4c9ef JSC::JSCell::toPrimitive(JSC::ExecState*, JSC::PreferredPrimitiveType) const + 95 (JSCell.cpp:141) 42 com.apple.JavaScriptCore 0x000000010bb1eab8 JSC::JSValue::toPrimitive(JSC::ExecState*, JSC::PreferredPrimitiveType) const + 72 (JSCJSValueInlines.h:609) 43 com.apple.JavaScriptCore 0x000000010bca97fd operationToPrimitive + 77 (DFGOperations.cpp:615) ... // More of the same from 495-505 (cut out for brevity) 495 ??? 0x000051d300009ece 0 + 89966679989966 496 com.apple.JavaScriptCore 0x000000010c05f1f9 vmEntryToJavaScript + 361 497 com.apple.JavaScriptCore 0x000000010bef4d7d JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 45 (JITCode.cpp:47) 498 com.apple.JavaScriptCore 0x000000010bed9eba JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 1450 (Interpreter.cpp:986) 499 com.apple.JavaScriptCore 0x000000010bab7f2e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 190 (CallData.cpp:39) 500 com.apple.JavaScriptCore 0x000000010bfafd73 JSC::callDefaultValueFunction(JSC::ExecState*, JSC::JSObject const*, JSC::PropertyName) + 243 (JSObject.cpp:1383) 501 com.apple.JavaScriptCore 0x000000010bfaa147 JSC::JSObject::defaultValue(JSC::JSObject const*, JSC::ExecState*, JSC::PreferredPrimitiveType) + 567 (JSObject.cpp:1418) 502 com.apple.JavaScriptCore 0x000000010bf4cf84 JSC::JSObject::toPrimitive(JSC::ExecState*, JSC::PreferredPrimitiveType) const + 52 (JSObject.h:1465) 503 com.apple.JavaScriptCore 0x000000010bf4c9ef JSC::JSCell::toPrimitive(JSC::ExecState*, JSC::PreferredPrimitiveType) const + 95 (JSCell.cpp:141) 504 com.apple.JavaScriptCore 0x000000010bb1eab8 JSC::JSValue::toPrimitive(JSC::ExecState*, JSC::PreferredPrimitiveType) const + 72 (JSCJSValueInlines.h:609) 505 com.apple.JavaScriptCore 0x000000010bca97fd operationToPrimitive + 77 (DFGOperations.cpp:615) 506 ??? 0x000051d300009ece 0 + 89966679989966 507 com.apple.JavaScriptCore 0x000000010c05f1f9 vmEntryToJavaScript + 361 508 com.apple.JavaScriptCore 0x000000010bef4d7d JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 45 (JITCode.cpp:47) 509 com.apple.JavaScriptCore 0x000000010bed9eba JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 1450 (Interpreter.cpp:986) 510 com.apple.JavaScriptCore 0x000000010bab7f2e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 190 (CallData.cpp:39) 511 com.apple.JavaScriptCore 0x000000010bfafd73 JSC::callDefaultValueFunction(JSC::ExecState*, JSC::JSObject const*, JSC::PropertyName) + 243 (JSObject.cpp:1383)
Michael Saboff
Comment 2 2014-08-21 18:37:35 PDT
Created attachment 236954 [details] Patch
Filip Pizlo
Comment 3 2014-08-21 18:56:33 PDT
Comment on attachment 236954 [details] Patch Looks like you're increasing JIT code size. Have you run performance numbers?
Michael Saboff
Comment 4 2014-08-21 22:27:49 PDT
(In reply to comment #3) > (From update of attachment 236954 [details]) > Looks like you're increasing JIT code size. Have you run performance numbers? The JIT changes are in exception slow paths or for catch handling. No performance change is expected. Tests show that to be the case. Generating benchmark report at /Volumes/Data/src/webkit/Baseline_FixedUnwind_SunSpiderLongSpiderV8SpiderOctaneKrakenJSRegressAsmBench_msaboff-pro_20140821_2218_report.txt And raw data at /Volumes/Data/src/webkit/Baseline_FixedUnwind_SunSpiderLongSpiderV8SpiderOctaneKrakenJSRegressAsmBench_msaboff-pro_20140821_2218.json Benchmark report for SunSpider, LongSpider, V8Spider, Octane, Kraken, JSRegress, and AsmBench on msaboff-pro (MacPro5,1). VMs tested: "Baseline" at /Volumes/Data/src/webkit.baseline/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/Resources/jsc "FixedUnwind" at /Volumes/Data/src/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/Resources/jsc Collected 4 samples per benchmark/VM, with 4 VM invocations per benchmark. Emitted a call to gc() between sample measurements. Used 1 benchmark iteration per VM invocation for warm-up. Used the jsc-specific preciseTime() function to get microsecond-level timing. Reporting benchmark execution times with 95% confidence intervals in milliseconds. Baseline FixedUnwind SunSpider: 3d-cube 6.5371+-0.1370 ? 6.6799+-0.2305 ? might be 1.0218x slower 3d-morph 8.0674+-0.2461 8.0418+-0.1633 3d-raytrace 8.1614+-0.0762 ? 8.3193+-0.2344 ? might be 1.0193x slower access-binary-trees 2.4340+-0.2262 2.3954+-0.1223 might be 1.0161x faster access-fannkuch 7.8866+-0.5645 7.8595+-0.3617 access-nbody 3.8207+-0.1518 ? 3.9066+-0.1465 ? might be 1.0225x slower access-nsieve 5.0676+-0.1415 4.9650+-0.1213 might be 1.0207x faster bitops-3bit-bits-in-byte 1.6156+-0.0595 1.6095+-0.0393 bitops-bits-in-byte 5.3929+-0.1022 ? 5.4010+-0.0995 ? bitops-bitwise-and 2.7586+-0.0773 2.6375+-0.1207 might be 1.0459x faster bitops-nsieve-bits 4.8136+-0.1190 ? 4.8550+-0.1679 ? controlflow-recursive 2.4907+-0.0819 ? 2.4975+-0.0532 ? crypto-aes 5.3318+-0.2757 ? 5.3840+-0.1823 ? crypto-md5 3.1291+-0.3988 3.0316+-0.0491 might be 1.0322x faster crypto-sha1 2.9803+-0.0282 2.9702+-0.0736 date-format-tofte 11.4772+-0.3959 11.2253+-0.5327 might be 1.0224x faster date-format-xparb 7.0530+-0.1609 7.0515+-0.4824 math-cordic 3.9868+-0.0776 3.9391+-0.0894 might be 1.0121x faster math-partial-sums 8.8286+-0.1274 8.7972+-0.1514 math-spectral-norm 2.6754+-0.0843 2.5958+-0.1184 might be 1.0307x faster regexp-dna 9.6360+-0.2416 ? 9.6411+-0.4236 ? string-base64 5.5358+-0.0898 5.4183+-0.1579 might be 1.0217x faster string-fasta 8.6458+-0.2431 8.5738+-0.2512 string-tagcloud 13.2370+-0.1579 13.0552+-0.0699 might be 1.0139x faster string-unpack-code 26.2498+-0.8301 25.7790+-0.9344 might be 1.0183x faster string-validate-input 6.3775+-0.2930 ? 6.4616+-0.2572 ? might be 1.0132x slower <arithmetic> * 6.6996+-0.0202 6.6574+-0.0607 might be 1.0063x faster <geometric> 5.4996+-0.0201 5.4669+-0.0354 might be 1.0060x faster <harmonic> 4.5967+-0.0124 4.5603+-0.0328 might be 1.0080x faster Baseline FixedUnwind LongSpider: 3d-cube 1127.2210+-15.1547 1125.2634+-5.2167 3d-morph 1856.4345+-7.2340 1856.1772+-5.2133 3d-raytrace 1097.4860+-8.0463 1086.2662+-5.7585 might be 1.0103x faster access-binary-trees 1381.1685+-6.3689 ? 1389.1035+-12.7180 ? access-fannkuch 443.8106+-23.3830 ? 458.8796+-37.5731 ? might be 1.0340x slower access-nbody 1033.5958+-1.7161 1033.1141+-1.9818 access-nsieve 1405.9447+-9.3164 1402.2287+-8.1951 bitops-3bit-bits-in-byte 50.2100+-1.2113 ? 50.2870+-0.8084 ? bitops-bits-in-byte 328.5768+-6.5350 327.9294+-4.7431 bitops-nsieve-bits 995.1011+-16.4101 ? 995.3358+-14.6558 ? controlflow-recursive 733.8998+-1.6630 ? 734.9973+-1.9251 ? crypto-aes 953.2578+-5.2521 ^ 946.2492+-1.7305 ^ definitely 1.0074x faster crypto-md5 801.2684+-9.4732 ? 802.2047+-10.4608 ? crypto-sha1 1037.0539+-12.1901 1027.5987+-21.2147 date-format-tofte 1001.5950+-18.0472 ^ 969.9559+-11.9556 ^ definitely 1.0326x faster date-format-xparb 1051.5508+-20.5372 1027.2820+-17.3542 might be 1.0236x faster math-cordic 671.0780+-2.7223 670.4543+-0.8538 math-partial-sums 1108.4962+-3.1414 1103.9305+-2.4830 math-spectral-norm 1074.4777+-1.3485 ? 1074.7818+-3.2233 ? string-base64 507.1097+-5.3551 506.6840+-2.4985 string-fasta 580.9745+-8.0318 ? 588.1689+-14.1671 ? might be 1.0124x slower string-tagcloud 307.2070+-9.7856 304.5594+-2.3101 <arithmetic> 888.5235+-1.0600 885.5205+-2.5431 might be 1.0034x faster <geometric> * 743.8033+-2.8219 742.1831+-3.9914 might be 1.0022x faster <harmonic> 460.1833+-6.0784 ? 460.2524+-5.0216 ? might be 1.0002x slower Baseline FixedUnwind V8Spider: crypto 69.9836+-1.3128 ? 70.1584+-1.5420 ? deltablue 84.6542+-1.3920 84.6527+-1.1414 earley-boyer 64.0972+-3.4636 62.3998+-3.5972 might be 1.0272x faster raytrace 38.6727+-1.3896 38.1031+-1.1412 might be 1.0149x faster regexp 85.1584+-0.5380 84.8557+-0.3417 richards 94.7000+-4.0153 ? 95.3853+-2.0463 ? splay 42.6380+-0.9615 ? 42.6614+-0.3530 ? <arithmetic> 68.5577+-0.7102 68.3166+-0.6991 might be 1.0035x faster <geometric> * 65.2668+-0.6716 64.9438+-0.6340 might be 1.0050x faster <harmonic> 61.7571+-0.7543 61.3661+-0.5521 might be 1.0064x faster Baseline FixedUnwind Octane: encrypt 0.32880+-0.00181 ? 0.32949+-0.00128 ? decrypt 6.09194+-0.08148 6.05040+-0.00995 deltablue x2 0.36196+-0.00197 ? 0.36522+-0.00364 ? earley 1.03547+-0.00672 ? 1.03594+-0.01736 ? boyer 8.75318+-0.15954 ? 8.80937+-0.13596 ? navier-stokes x2 6.41020+-0.02362 6.39895+-0.00772 raytrace x2 2.21467+-0.01846 ? 2.23093+-0.04545 ? richards x2 0.18938+-0.01181 ? 0.19202+-0.01768 ? might be 1.0140x slower splay x2 0.53893+-0.00859 0.53757+-0.01096 regexp x2 26.78496+-0.67258 26.56133+-0.13539 pdfjs x2 72.07295+-0.42607 ? 72.37482+-0.37761 ? mandreel x2 73.74746+-1.41845 ? 74.40602+-1.17087 ? gbemu x2 56.72822+-1.01508 56.65134+-0.18801 closure 0.77868+-0.00504 ? 0.78152+-0.00280 ? jquery 9.57461+-0.04401 ? 9.65663+-0.06013 ? box2d x2 20.01262+-0.31979 ? 20.14549+-0.25578 ? zlib x2 663.72268+-77.42956 639.83877+-86.02657 might be 1.0373x faster typescript x2 1118.82428+-17.07736 1115.10400+-14.32621 <arithmetic> 136.99264+-4.16948 135.20921+-6.28538 might be 1.0132x faster <geometric> * 9.79260+-0.10236 ? 9.79377+-0.09559 ? might be 1.0001x slower <harmonic> 1.11258+-0.02591 ? 1.12061+-0.03724 ? might be 1.0072x slower Baseline FixedUnwind Kraken: ai-astar 469.787+-2.913 462.498+-12.500 might be 1.0158x faster audio-beat-detection 146.354+-3.531 ? 147.910+-0.764 ? might be 1.0106x slower audio-dft 209.998+-2.735 ? 219.893+-32.969 ? might be 1.0471x slower audio-fft 106.930+-0.626 ? 107.307+-0.950 ? audio-oscillator 306.842+-1.372 306.547+-1.196 imaging-darkroom 240.618+-1.244 ? 240.970+-1.603 ? imaging-desaturate 95.124+-0.619 95.005+-0.682 imaging-gaussian-blur 154.561+-2.478 ? 158.583+-12.433 ? might be 1.0260x slower json-parse-financial 67.906+-1.004 67.128+-0.418 might be 1.0116x faster json-stringify-tinderbox 87.678+-1.229 86.638+-1.340 might be 1.0120x faster stanford-crypto-aes 84.496+-1.673 84.027+-1.343 stanford-crypto-ccm 74.029+-12.534 66.849+-2.671 might be 1.1074x faster stanford-crypto-pbkdf2 226.539+-2.230 ? 227.364+-2.892 ? stanford-crypto-sha256-iterative 69.917+-0.438 ? 70.708+-1.037 ? might be 1.0113x slower <arithmetic> * 167.198+-1.368 ? 167.245+-2.975 ? might be 1.0003x slower <geometric> 138.796+-2.039 138.331+-1.545 might be 1.0034x faster <harmonic> 118.882+-2.571 117.724+-0.754 might be 1.0098x faster Baseline FixedUnwind JSRegress: abs-boolean 3.5898+-0.1675 3.5397+-0.0532 might be 1.0141x faster adapt-to-double-divide 18.0968+-0.3188 18.0454+-0.6951 aliased-arguments-getbyval 1.0230+-0.1104 1.0176+-0.0354 allocate-big-object 2.9845+-0.6197 ? 3.0071+-0.3551 ? arity-mismatch-inlining 0.9432+-0.0747 0.9405+-0.0702 array-access-polymorphic-structure 8.8553+-0.2524 ? 8.8932+-0.2473 ? array-nonarray-polymorhpic-access 50.4728+-0.7223 ? 51.0327+-1.2864 ? might be 1.0111x slower array-prototype-every 102.9694+-0.9484 ? 104.3831+-2.8432 ? might be 1.0137x slower array-prototype-forEach 103.1548+-3.8998 102.4335+-1.3390 array-prototype-map 121.9614+-0.6477 ! 127.2612+-4.5750 ! definitely 1.0435x slower array-prototype-some 101.9738+-0.3465 ? 104.7048+-5.9958 ? might be 1.0268x slower array-splice-contiguous 56.8257+-0.4375 56.8222+-1.6552 array-with-double-add 5.6688+-0.1104 5.6263+-0.1223 array-with-double-increment 3.9822+-0.1098 3.9777+-0.0707 array-with-double-mul-add 6.6016+-0.0400 ? 6.6240+-0.0883 ? array-with-double-sum 4.1357+-0.0662 ? 4.1364+-0.0595 ? array-with-int32-add-sub 9.9257+-0.0875 9.9105+-0.1409 array-with-int32-or-double-sum 4.2415+-0.0929 ? 4.2897+-0.1841 ? might be 1.0114x slower ArrayBuffer-DataView-alloc-large-long-lived 96.3262+-1.3469 ? 96.5345+-1.6032 ? ArrayBuffer-DataView-alloc-long-lived 26.1641+-0.7254 ? 26.6904+-0.4611 ? might be 1.0201x slower ArrayBuffer-Int32Array-byteOffset 4.5125+-0.1185 4.4614+-0.1521 might be 1.0115x faster ArrayBuffer-Int8Array-alloc-large-long-lived 100.3683+-1.1778 ? 101.1020+-1.5217 ? ArrayBuffer-Int8Array-alloc-long-lived-buffer 42.1153+-0.7458 41.5676+-0.6149 might be 1.0132x faster ArrayBuffer-Int8Array-alloc-long-lived 25.3062+-0.6159 ? 25.4089+-0.1255 ? ArrayBuffer-Int8Array-alloc 22.5472+-0.6206 ? 22.6386+-0.3059 ? asmjs_bool_bug 8.6082+-0.0644 ? 8.6198+-0.1435 ? assign-custom-setter-polymorphic 4.2318+-0.2615 4.2195+-0.2530 assign-custom-setter 5.5782+-0.0953 ? 5.6210+-0.3489 ? basic-set 13.1588+-0.8117 ? 13.2870+-0.5009 ? big-int-mul 5.2507+-0.0787 ? 5.2657+-0.1181 ? boolean-test 3.9976+-0.0215 ? 4.0862+-0.0782 ? might be 1.0222x slower branch-fold 4.2510+-0.0636 ? 4.2825+-0.1115 ? by-val-generic 10.9334+-0.4105 10.4998+-0.2968 might be 1.0413x faster call-spread-apply 17.6566+-0.1864 ^ 17.2585+-0.1416 ^ definitely 1.0231x faster call-spread-call 7.3965+-0.0898 7.3830+-0.1837 captured-assignments 0.5108+-0.0153 ? 0.5807+-0.1129 ? might be 1.1368x slower cast-int-to-double 7.9879+-0.0450 7.9237+-0.1248 cell-argument 9.8787+-0.3136 ? 10.0284+-0.2517 ? might be 1.0151x slower cfg-simplify 3.4416+-0.0335 ? 3.4436+-0.1532 ? chain-getter-access 12.2977+-0.3148 ? 12.5714+-0.2881 ? might be 1.0223x slower cmpeq-obj-to-obj-other 11.1340+-0.7773 10.9063+-1.0786 might be 1.0209x faster constant-test 7.4530+-0.0870 ? 7.4578+-0.1298 ? DataView-custom-properties 103.5877+-1.5205 ? 104.4734+-0.3669 ? delay-tear-off-arguments-strictmode 3.1289+-0.0654 3.1190+-0.1238 destructuring-arguments 7.5641+-0.1980 7.5203+-0.0692 destructuring-swap 7.5798+-0.1181 7.5544+-0.0641 direct-arguments-getbyval 1.0663+-0.1360 1.0197+-0.0565 might be 1.0457x faster div-boolean-double 5.3570+-0.1064 ? 5.4983+-0.4435 ? might be 1.0264x slower div-boolean 9.7230+-0.0588 9.6798+-0.0878 double-get-by-val-out-of-bounds 5.5947+-0.1272 5.5419+-0.1600 double-pollution-getbyval 9.4851+-0.1534 ? 9.5473+-0.1560 ? double-pollution-putbyoffset 5.0807+-0.0653 ? 5.1431+-0.0492 ? might be 1.0123x slower double-to-int32-typed-array-no-inline 2.5610+-0.0348 2.5453+-0.1145 double-to-int32-typed-array 2.1920+-0.0704 2.1812+-0.0983 double-to-uint32-typed-array-no-inline 2.6450+-0.0490 2.6206+-0.1355 double-to-uint32-typed-array 2.2969+-0.0614 ? 2.3078+-0.1177 ? empty-string-plus-int 8.6785+-0.1640 ? 8.9904+-0.2937 ? might be 1.0359x slower emscripten-cube2hash 46.5969+-1.3503 ? 46.6904+-0.1750 ? external-arguments-getbyval 1.8181+-0.0846 1.8102+-0.1866 external-arguments-putbyval 2.5934+-0.1001 ? 2.7327+-0.0851 ? might be 1.0537x slower fixed-typed-array-storage-var-index 1.3330+-0.0605 ? 1.4042+-0.0376 ? might be 1.0534x slower fixed-typed-array-storage 0.9550+-0.0097 ? 1.0153+-0.1066 ? might be 1.0631x slower Float32Array-matrix-mult 5.8011+-0.4187 ? 5.9152+-0.6883 ? might be 1.0197x slower Float32Array-to-Float64Array-set 74.8793+-3.0277 ? 76.3964+-3.7829 ? might be 1.0203x slower Float64Array-alloc-long-lived 85.3619+-1.0640 ? 85.6628+-1.4740 ? Float64Array-to-Int16Array-set 95.5162+-2.5560 ! 101.3959+-1.4522 ! definitely 1.0616x slower fold-double-to-int 18.4905+-0.5190 18.4101+-0.3548 fold-get-by-id-to-multi-get-by-offset-rare-int 18.0984+-0.4977 ? 18.2728+-0.8592 ? fold-get-by-id-to-multi-get-by-offset 17.6308+-0.7081 ? 18.2083+-0.5528 ? might be 1.0328x slower fold-multi-get-by-offset-to-get-by-offset 11.8196+-0.6094 11.6120+-0.6559 might be 1.0179x faster fold-multi-get-by-offset-to-poly-get-by-offset 12.2070+-0.0642 ? 12.8473+-1.7634 ? might be 1.0525x slower fold-multi-put-by-offset-to-poly-put-by-offset 12.7853+-0.6031 12.6801+-0.4499 fold-multi-put-by-offset-to-put-by-offset 11.3569+-0.5249 11.3250+-0.6292 fold-multi-put-by-offset-to-replace-or-transition-put-by-offset 15.6100+-0.2859 ? 15.8975+-1.2655 ? might be 1.0184x slower fold-put-by-id-to-multi-put-by-offset 19.8185+-0.6333 ? 20.5808+-0.6133 ? might be 1.0385x slower fold-put-structure 10.8227+-0.1352 ? 10.8525+-0.0545 ? for-of-iterate-array-entries 8.0031+-0.1413 ! 8.4238+-0.1340 ! definitely 1.0526x slower for-of-iterate-array-keys 3.3403+-0.1022 3.2449+-0.1708 might be 1.0294x faster for-of-iterate-array-values 2.9965+-0.1608 ? 3.0184+-0.1432 ? fround 22.1659+-0.7860 ? 22.5870+-0.3338 ? might be 1.0190x slower ftl-library-inlining-dataview 91.9135+-5.8960 89.9681+-0.7361 might be 1.0216x faster ftl-library-inlining 96.3553+-0.4108 ? 98.1038+-5.2654 ? might be 1.0181x slower function-dot-apply 2.0095+-0.0468 ? 2.0119+-0.1486 ? function-test 4.3172+-0.1140 ? 4.8522+-1.2270 ? might be 1.1239x slower function-with-eval 85.6993+-3.3968 ? 89.3330+-2.9243 ? might be 1.0424x slower gcse-poly-get-less-obvious 24.6923+-0.2562 24.5020+-0.2959 gcse-poly-get 24.4962+-0.0675 ? 24.6860+-0.2488 ? gcse 6.3062+-0.0549 ! 6.4189+-0.0420 ! definitely 1.0179x slower get-by-id-bimorphic-check-structure-elimination-simple 3.2084+-0.1546 ? 3.2586+-0.1304 ? might be 1.0157x slower get-by-id-bimorphic-check-structure-elimination 8.0857+-0.1472 ? 8.2283+-0.4442 ? might be 1.0176x slower get-by-id-chain-from-try-block 6.8828+-0.0966 ? 6.8848+-0.1942 ? get-by-id-check-structure-elimination 7.3328+-0.1263 ? 7.3520+-0.0588 ? get-by-id-proto-or-self 22.9117+-2.6930 21.8814+-0.9667 might be 1.0471x faster get-by-id-quadmorphic-check-structure-elimination-simple 3.7829+-0.0805 3.7670+-0.0729 get-by-id-self-or-proto 21.7380+-0.7762 ? 22.4020+-1.1376 ? might be 1.0305x slower get-by-val-out-of-bounds 5.4649+-0.3065 ? 5.5790+-0.1532 ? might be 1.0209x slower get_callee_monomorphic 4.1698+-0.1506 ? 4.3051+-0.0761 ? might be 1.0324x slower get_callee_polymorphic 4.0797+-0.2189 4.0690+-0.2143 getter-no-activation 5.5673+-0.1075 ? 5.6314+-0.0547 ? might be 1.0115x slower getter-richards 126.6957+-5.6521 ? 128.3617+-2.4891 ? might be 1.0131x slower getter 6.2438+-0.3130 ? 6.3093+-0.1060 ? might be 1.0105x slower global-var-const-infer-fire-from-opt 1.1663+-0.1735 ? 1.1885+-0.1521 ? might be 1.0190x slower global-var-const-infer 0.9792+-0.0686 0.9668+-0.1137 might be 1.0129x faster HashMap-put-get-iterate-keys 34.1083+-1.5115 ? 34.5516+-1.0417 ? might be 1.0130x slower HashMap-put-get-iterate 33.5930+-0.6792 ? 33.7493+-0.9277 ? HashMap-string-put-get-iterate 38.4637+-0.8782 37.8571+-0.7612 might be 1.0160x faster hoist-make-rope 13.8915+-2.0793 ? 13.9321+-2.4254 ? hoist-poly-check-structure-effectful-loop 6.3415+-0.2494 ? 6.3865+-0.1513 ? hoist-poly-check-structure 4.6920+-0.1193 ? 4.7726+-0.1111 ? might be 1.0172x slower imul-double-only 10.0488+-0.3159 ? 10.2804+-0.5391 ? might be 1.0231x slower imul-int-only 12.3502+-0.9292 ? 12.5470+-0.1639 ? might be 1.0159x slower imul-mixed 9.4193+-0.2255 9.1978+-0.8799 might be 1.0241x faster in-four-cases 24.0114+-0.4273 23.6612+-0.1595 might be 1.0148x faster in-one-case-false 12.2175+-0.0985 ? 12.4510+-0.3500 ? might be 1.0191x slower in-one-case-true 12.9705+-2.1861 12.2994+-0.0855 might be 1.0546x faster in-two-cases 12.7933+-0.0427 ? 12.8089+-0.1114 ? indexed-properties-in-objects 3.5875+-0.0986 ? 3.6382+-0.0901 ? might be 1.0141x slower infer-closure-const-then-mov-no-inline 4.2077+-0.1204 ? 4.2173+-0.0508 ? infer-closure-const-then-mov 24.2515+-0.2020 ? 24.3370+-0.1897 ? infer-closure-const-then-put-to-scope-no-inline 15.0993+-0.2033 14.8785+-0.1781 might be 1.0148x faster infer-closure-const-then-put-to-scope 27.5698+-0.1078 ? 27.7955+-0.4327 ? infer-closure-const-then-reenter-no-inline 64.0956+-0.2397 ? 64.3792+-0.6744 ? infer-closure-const-then-reenter 27.5968+-0.1526 ? 27.7560+-0.1613 ? infer-constant-global-property 4.5553+-0.1480 4.5460+-0.0612 infer-constant-property 3.1496+-0.1030 3.1249+-0.0875 infer-one-time-closure-ten-vars 14.9536+-0.4741 14.6328+-0.2443 might be 1.0219x faster infer-one-time-closure-two-vars 14.1560+-0.7615 14.1498+-0.4379 infer-one-time-closure 13.6154+-0.4706 ? 13.8652+-0.2406 ? might be 1.0183x slower infer-one-time-deep-closure 24.3671+-0.1488 ? 24.3930+-0.4424 ? inline-arguments-access 1.9210+-0.0929 1.9210+-0.1139 inline-arguments-aliased-access 2.1558+-0.1475 2.1425+-0.1012 inline-arguments-local-escape 16.4511+-0.2716 16.3490+-0.1764 inline-get-scoped-var 5.4960+-0.0585 5.4474+-0.0824 inlined-put-by-id-transition 12.8906+-0.2048 ? 12.9819+-0.5252 ? int-or-other-abs-then-get-by-val 6.6875+-0.0204 ? 6.7377+-0.0799 ? int-or-other-abs-zero-then-get-by-val 24.3613+-0.3550 24.3452+-0.1940 int-or-other-add-then-get-by-val 5.7130+-0.1644 ? 5.7233+-0.1191 ? int-or-other-add 7.6124+-0.0682 7.5723+-0.0796 int-or-other-div-then-get-by-val 4.9332+-0.1160 ? 5.0044+-0.0617 ? might be 1.0144x slower int-or-other-max-then-get-by-val 6.5033+-0.2428 6.4103+-0.2516 might be 1.0145x faster int-or-other-min-then-get-by-val 5.0452+-0.1756 4.9665+-0.0518 might be 1.0158x faster int-or-other-mod-then-get-by-val 4.9590+-0.0456 ^ 4.8584+-0.0379 ^ definitely 1.0207x faster int-or-other-mul-then-get-by-val 4.7872+-0.1616 ? 4.7900+-0.1452 ? int-or-other-neg-then-get-by-val 5.9582+-0.0936 5.9468+-0.0671 int-or-other-neg-zero-then-get-by-val 24.3142+-0.4884 24.2709+-0.1223 int-or-other-sub-then-get-by-val 5.6641+-0.0944 ? 5.7228+-0.0316 ? might be 1.0104x slower int-or-other-sub 4.5768+-0.0708 ? 4.6168+-0.1033 ? int-overflow-local 5.8245+-0.4519 5.6566+-0.3131 might be 1.0297x faster Int16Array-alloc-long-lived 60.6345+-0.5238 60.6271+-1.0154 Int16Array-bubble-sort-with-byteLength 38.6588+-0.9353 ? 38.8485+-0.5596 ? Int16Array-bubble-sort 38.0827+-0.5673 ? 38.1199+-0.5152 ? Int16Array-load-int-mul 1.8625+-0.1093 1.8237+-0.1530 might be 1.0213x faster Int16Array-to-Int32Array-set 73.2946+-2.1431 ^ 69.2553+-1.1833 ^ definitely 1.0583x faster Int32Array-alloc-large 36.4370+-0.8548 35.9203+-1.0460 might be 1.0144x faster Int32Array-alloc-long-lived 67.8225+-0.4684 67.4054+-1.0562 Int32Array-alloc 3.9512+-0.0959 ? 3.9548+-0.1517 ? Int32Array-Int8Array-view-alloc 12.0766+-0.1450 ? 12.5549+-0.7854 ? might be 1.0396x slower int52-spill 9.4645+-0.4694 9.3290+-0.7387 might be 1.0145x faster Int8Array-alloc-long-lived 55.4026+-0.8809 55.3443+-1.1203 Int8Array-load-with-byteLength 4.6301+-0.1345 4.5832+-0.0592 might be 1.0102x faster Int8Array-load 4.6130+-0.1003 4.5553+-0.2355 might be 1.0127x faster integer-divide 14.1766+-0.1916 14.1365+-0.1355 integer-modulo 2.4988+-0.1262 2.4880+-0.0176 large-int-captured 8.8680+-0.4136 ? 9.1548+-0.3635 ? might be 1.0323x slower large-int-neg 20.5747+-0.2400 20.3870+-0.3952 large-int 18.4085+-0.6479 18.2914+-0.3288 logical-not 6.0513+-0.1046 ? 6.4773+-0.4296 ? might be 1.0704x slower lots-of-fields 14.2407+-0.2878 13.7685+-0.3058 might be 1.0343x faster make-indexed-storage 3.8298+-0.0474 ? 3.8735+-0.1368 ? might be 1.0114x slower make-rope-cse 5.4252+-0.4327 5.3232+-0.3644 might be 1.0192x faster marsaglia-larger-ints 52.3365+-0.5332 ? 52.7747+-0.8474 ? marsaglia-osr-entry 28.1220+-0.8082 28.1138+-0.8433 max-boolean 3.1536+-0.1068 3.1191+-0.1007 might be 1.0111x faster method-on-number 22.6555+-0.2319 ? 22.8025+-0.3269 ? min-boolean 3.0905+-0.1183 ? 3.1027+-0.1098 ? minus-boolean-double 4.0046+-0.1340 ? 4.0875+-0.0350 ? might be 1.0207x slower minus-boolean 3.1083+-0.0946 3.0955+-0.0738 misc-strict-eq 49.5248+-0.5667 ! 53.7575+-2.2097 ! definitely 1.0855x slower mod-boolean-double 11.5320+-0.1585 ? 11.6235+-0.2067 ? mod-boolean 8.8492+-0.1801 8.7926+-0.1450 mul-boolean-double 4.6829+-0.0639 ? 4.7203+-0.0706 ? mul-boolean 3.3158+-0.1000 ? 3.3514+-0.1140 ? might be 1.0107x slower neg-boolean 4.1052+-0.0565 4.0860+-0.0547 negative-zero-divide 0.4014+-0.0918 0.3877+-0.0169 might be 1.0354x faster negative-zero-modulo 0.3743+-0.0079 ? 0.4033+-0.0813 ? might be 1.0774x slower negative-zero-negate 0.3771+-0.0810 ? 0.3799+-0.0804 ? nested-function-parsing 40.7100+-0.4422 ? 40.8088+-0.8106 ? new-array-buffer-dead 3.4695+-0.0681 ? 3.4785+-0.0702 ? new-array-buffer-push 9.1266+-0.2217 ? 9.2250+-0.1446 ? might be 1.0108x slower new-array-dead 14.1898+-0.1409 ? 14.8135+-0.6808 ? might be 1.0440x slower new-array-push 6.2210+-0.2305 6.1337+-0.2759 might be 1.0142x faster number-test 3.9147+-0.0525 3.9108+-0.0723 object-closure-call 7.6094+-0.1435 7.6041+-0.1005 object-test 4.2196+-0.1443 ? 4.2319+-0.1221 ? plus-boolean-arith 3.1580+-0.0237 ? 3.1666+-0.1393 ? plus-boolean-double 4.0730+-0.0953 ? 4.0735+-0.1019 ? plus-boolean 3.0265+-0.0808 3.0178+-0.0852 poly-chain-access-different-prototypes-simple 3.7500+-0.0625 3.7031+-0.1015 might be 1.0127x faster poly-chain-access-different-prototypes 3.0621+-0.1129 3.0267+-0.0305 might be 1.0117x faster poly-chain-access-simpler 3.7568+-0.0802 3.7462+-0.0562 poly-chain-access 2.6300+-0.3719 ? 2.8093+-0.6306 ? might be 1.0682x slower poly-stricteq 69.0350+-2.6918 ? 69.1829+-2.7771 ? polymorphic-array-call 2.0952+-0.2495 ? 2.1351+-0.2013 ? might be 1.0191x slower polymorphic-get-by-id 4.0427+-0.0480 ? 4.1318+-0.2665 ? might be 1.0221x slower polymorphic-put-by-id 66.4323+-31.0979 ? 81.2769+-35.5863 ? might be 1.2235x slower polymorphic-structure 20.7360+-0.1633 ? 21.9446+-2.1512 ? might be 1.0583x slower polyvariant-monomorphic-get-by-id 11.3028+-0.1370 11.1925+-0.0704 proto-getter-access 12.2562+-0.2450 ? 12.4332+-0.1945 ? might be 1.0144x slower put-by-id-replace-and-transition 10.9228+-0.0475 10.7851+-0.3081 might be 1.0128x faster put-by-id-slightly-polymorphic 3.4277+-0.0283 3.3932+-0.0799 might be 1.0102x faster put-by-id 17.7125+-0.4451 17.3401+-0.2258 might be 1.0215x faster put-by-val-direct 0.6664+-0.0062 ? 0.7087+-0.1149 ? might be 1.0635x slower put-by-val-large-index-blank-indexing-type 8.8200+-0.2731 ? 9.3037+-0.5750 ? might be 1.0548x slower put-by-val-machine-int 3.0053+-0.2164 2.9545+-0.2456 might be 1.0172x faster rare-osr-exit-on-local 17.7368+-0.5298 ? 18.1768+-0.3414 ? might be 1.0248x slower register-pressure-from-osr 26.5925+-0.7854 26.2010+-0.4130 might be 1.0149x faster setter 6.3309+-0.0829 ? 6.3349+-0.1688 ? simple-activation-demo 29.0316+-0.2589 28.9781+-0.1368 simple-getter-access 18.0182+-0.3715 ? 18.0325+-0.2100 ? sin-boolean 23.4936+-3.1910 ? 24.4691+-2.8757 ? might be 1.0415x slower slow-array-profile-convergence 3.6916+-0.1703 ? 3.9391+-0.1494 ? might be 1.0670x slower slow-convergence 4.1650+-0.0406 ? 4.1880+-0.1184 ? sparse-conditional 1.3565+-0.0704 ? 1.3724+-0.1163 ? might be 1.0117x slower splice-to-remove 20.6027+-0.4810 20.1325+-0.1493 might be 1.0234x faster string-char-code-at 19.5939+-0.0396 19.4915+-0.1152 string-concat-object 2.5507+-0.2974 ? 2.5869+-0.3033 ? might be 1.0142x slower string-concat-pair-object 2.6597+-0.2643 2.5403+-0.2722 might be 1.0470x faster string-concat-pair-simple 15.4965+-0.9725 ? 15.5139+-0.4323 ? string-concat-simple 15.3913+-0.4631 ? 15.4832+-0.7043 ? string-cons-repeat 10.1785+-0.4507 ? 10.2456+-0.5541 ? string-cons-tower 9.3326+-0.3473 9.2924+-0.4448 string-equality 22.0068+-0.3423 ? 22.1653+-0.3939 ? string-get-by-val-big-char 11.3014+-0.1336 ? 11.5278+-0.5189 ? might be 1.0200x slower string-get-by-val-out-of-bounds-insane 4.9707+-0.0708 ? 5.1232+-0.1281 ? might be 1.0307x slower string-get-by-val-out-of-bounds 5.9589+-0.0276 ? 5.9755+-0.1196 ? string-get-by-val 4.6395+-0.1357 4.6368+-0.0733 string-hash 2.4778+-0.0447 ? 2.4813+-0.0605 ? string-long-ident-equality 17.9027+-0.2812 ? 17.9430+-0.2144 ? string-repeat-arith 40.7307+-0.5759 40.6195+-0.2328 string-sub 81.6900+-5.7958 79.0357+-0.9765 might be 1.0336x faster string-test 4.0676+-0.1965 4.0172+-0.1564 might be 1.0125x faster string-var-equality 43.3101+-0.2253 ? 43.3143+-0.1921 ? structure-hoist-over-transitions 3.1579+-0.1669 ? 3.2951+-0.2721 ? might be 1.0434x slower substring-concat-weird 53.4512+-0.6159 52.7792+-0.9347 might be 1.0127x faster substring-concat 56.3931+-0.4366 55.5721+-0.4853 might be 1.0148x faster substring 64.2604+-0.6977 ^ 61.9170+-0.7187 ^ definitely 1.0378x faster switch-char-constant 3.1537+-0.1346 3.1412+-0.1070 switch-char 7.6864+-0.0483 7.6863+-0.0680 switch-constant 9.8735+-0.4346 9.7736+-0.5062 might be 1.0102x faster switch-string-basic-big-var 22.8422+-0.5700 21.8578+-1.1867 might be 1.0450x faster switch-string-basic-big 27.7628+-4.7364 26.6805+-7.4784 might be 1.0406x faster switch-string-basic-var 26.9880+-1.1643 ? 27.5948+-1.6439 ? might be 1.0225x slower switch-string-basic 27.7947+-2.1645 24.7870+-6.1448 might be 1.1213x faster switch-string-big-length-tower-var 24.8757+-0.2322 ? 24.9836+-0.1395 ? switch-string-length-tower-var 20.1411+-0.3730 19.6153+-0.1954 might be 1.0268x faster switch-string-length-tower 15.3698+-2.6535 14.5526+-0.1248 might be 1.0562x faster switch-string-short 14.7207+-0.0936 14.4833+-0.3618 might be 1.0164x faster switch 13.5185+-0.3277 ? 13.6107+-0.1701 ? tear-off-arguments-simple 2.0799+-0.1405 2.0410+-0.0595 might be 1.0190x faster tear-off-arguments 3.2820+-0.0660 ? 3.3432+-0.0744 ? might be 1.0186x slower temporal-structure 16.9818+-0.2856 ? 16.9949+-0.2334 ? to-int32-boolean 20.7755+-0.4278 20.6581+-0.1314 undefined-test 4.0798+-0.1158 ? 4.0928+-0.1347 ? unprofiled-licm 27.0200+-0.9228 ? 27.3463+-0.1004 ? might be 1.0121x slower weird-inlining-const-prop 2.1892+-0.0870 ? 2.2608+-0.1691 ? might be 1.0327x slower <arithmetic> 18.4860+-0.1150 ? 18.6158+-0.1859 ? might be 1.0070x slower <geometric> * 9.4235+-0.0100 ? 9.4676+-0.0419 ? might be 1.0047x slower <harmonic> 4.7611+-0.0436 ? 4.8143+-0.0752 ? might be 1.0112x slower Baseline FixedUnwind AsmBench: bigfib.cpp 673.1767+-4.8281 ? 678.1145+-3.9290 ? cray.c 674.0882+-2.7749 ? 676.3723+-4.1658 ? dry.c 651.5102+-12.8595 649.0717+-15.1194 FloatMM.c 956.9308+-1.2871 956.6682+-1.2689 gcc-loops.cpp 6269.0301+-15.6337 6246.5809+-22.2296 n-body.c 1676.1540+-51.7445 1659.6509+-1.7792 Quicksort.c 576.8577+-9.5393 576.2419+-7.9092 stepanov_container.cpp 4951.2058+-159.2353 4900.3220+-68.9695 might be 1.0104x faster Towers.c 407.1215+-1.2471 ? 411.3375+-4.7775 ? might be 1.0104x slower <arithmetic> 1870.6750+-16.1641 1861.5956+-9.2997 might be 1.0049x faster <geometric> * 1147.7132+-4.7215 1146.7322+-2.2665 might be 1.0009x faster <harmonic> 841.3329+-3.1579 ? 843.2694+-1.9652 ? might be 1.0023x slower Baseline FixedUnwind All benchmarks: <arithmetic> 129.7240+-0.4467 129.2708+-0.8080 might be 1.0035x faster <geometric> 15.1738+-0.0145 ? 15.2124+-0.0570 ? might be 1.0025x slower <harmonic> 4.2113+-0.0463 ? 4.2477+-0.0747 ? might be 1.0087x slower Baseline FixedUnwind Geomean of preferred means: <scaled-result> 66.5134+-0.2455 66.4249+-0.2295 might be 1.0013x faster
Michael Saboff
Comment 5 2014-08-22 12:54:48 PDT
Committed r172867: <http://trac.webkit.org/changeset/172867>
Michael Saboff
Comment 7 2014-08-22 17:04:29 PDT
New back trace: Process: com.apple.WebKit.WebContent.Development [38894] Path: /Volumes/VOLUME/*/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.Development.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development Identifier: com.apple.WebKit.WebContent.Development Version: 538+ (538.45+) Code Type: X86-64 (Native) Parent Process: ??? [1] Responsible: com.apple.WebKit.WebContent.Development [38894] User ID: 501 Date/Time: 2014-08-22 16:50:17.556 -0700 OS Version: Mac OS X 10.9.4 (13E28) Report Version: 11 Anonymous UUID: 615A0368-B225-16FD-FF14-A202D44A3EC4 Crashed Thread: 0 Dispatch queue: com.apple.main-thread Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: EXC_I386_GPFLT Application Specific Information: CRASHING TEST:js/dom/line-column-numbers.html Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x0000000112cfbea7 JSC::CodeBlock::handlerForBytecodeOffset(unsigned int) + 39 (Vector.h:610) 1 com.apple.JavaScriptCore 0x0000000112f01f5f JSC::UnwindFunctor::operator()(JSC::StackVisitor&) + 111 (Interpreter.cpp:665) 2 com.apple.JavaScriptCore 0x0000000112efef5b JSC::Interpreter::unwind(void*&, JSC::ExecState*&, JSC::JSValue&) + 555 (StackVisitor.h:129) 3 com.apple.JavaScriptCore 0x0000000112f1940b JSC::genericUnwind(JSC::VM*, JSC::ExecState*, JSC::JSValue) + 91 (JITExceptions.cpp:67) 4 com.apple.JavaScriptCore 0x0000000112f38e4c lookupExceptionHandlerFromCallerFrame + 60 (JITOperations.cpp:1854) 5 ??? 0x000046399ca02d83 0 + 77213254823299 6 com.apple.JavaScriptCore 0x00000001130015e9 vmEntryToJavaScript + 326 7 com.apple.JavaScriptCore 0x0000000112f17b73 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 35 (VM.h:373) 8 com.apple.JavaScriptCore 0x0000000112f01096 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 438 (Interpreter.cpp:989) 9 com.apple.JavaScriptCore 0x0000000112ceb9be JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 (CallData.cpp:39) 10 com.apple.JavaScriptCore 0x0000000112f90295 JSC::JSObject::defaultValue(JSC::JSObject const*, JSC::ExecState*, JSC::PreferredPrimitiveType) + 1189 (Register.h:116) 11 ??? 0x000046399ca02c8c 0 + 77213254823052 12 com.apple.JavaScriptCore 0x00000001130015e9 vmEntryToJavaScript + 326 13 com.apple.JavaScriptCore 0x0000000112f17b73 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 35 (VM.h:373) 14 com.apple.JavaScriptCore 0x0000000112f01096 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 438 (Interpreter.cpp:989) 15 com.apple.JavaScriptCore 0x0000000112ceb9be JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 (CallData.cpp:39) 16 com.apple.JavaScriptCore 0x0000000112f90295 JSC::JSObject::defaultValue(JSC::JSObject const*, JSC::ExecState*, JSC::PreferredPrimitiveType) + 1189 (Register.h:116) 17 ??? 0x000046399ca02c8c 0 + 77213254823052 18 com.apple.JavaScriptCore 0x00000001130015e9 vmEntryToJavaScript + 326 19 com.apple.JavaScriptCore 0x0000000112f17b73 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 35 (VM.h:373) 20 com.apple.JavaScriptCore 0x0000000112f01096 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 438 (Interpreter.cpp:989) 21 com.apple.JavaScriptCore 0x0000000112ceb9be JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 (CallData.cpp:39)
Michael Saboff
Comment 8 2014-08-22 21:16:33 PDT
New crash tracked in <https://bugs.webkit.org/show_bug.cgi?id=136192> - "After r172867 another crash in in js/dom/line-column-numbers.html"
Note You need to log in before you can comment on or make changes to this bug.