| Summary: | REGRESSION(r179538): It made 2 tests fail on ARM traditional | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Csaba Osztrogonác <ossy> | ||||
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | fpizlo, mark.lam, ossy | ||||
| Priority: | P2 | ||||||
| Version: | 528+ (Nightly build) | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Bug Depends on: | |||||||
| Bug Blocks: | 108645, 141183 | ||||||
| Attachments: |
|
||||||
I started to debug this issue, these tests fail only if DFG JIT is enabled, they pass with JSC_useDFGJIT=0 environment variable set, so the bug is somewhere in DFG JIT. It would be great to have a working disassembler for ARM traditional too to be able debug this bug easily: bug123717 This regression will gone away once the monumental patch in bug141174 landed. |
Created attachment 245928 [details] fails ** The following JSC stress test failures have been introduced: jsc-layout-tests.yaml/js/script-tests/dfg-inline-arguments-out-of-bounds.js.layout jsc-layout-tests.yaml/js/script-tests/dfg-inline-arguments-out-of-bounds.js.layout-dfg-eager-no-cjit jsc-layout-tests.yaml/js/script-tests/dfg-inline-arguments-out-of-bounds.js.layout-no-cjit jsc-layout-tests.yaml/js/script-tests/dfg-inline-arguments-out-of-bounds.js.layout-no-llint stress/get-my-argument-by-val-inlined-no-formal-parameters.js.always-trigger-copy-phase stress/get-my-argument-by-val-inlined-no-formal-parameters.js.default stress/get-my-argument-by-val-inlined-no-formal-parameters.js.dfg-eager stress/get-my-argument-by-val-inlined-no-formal-parameters.js.dfg-eager-no-cjit-validate stress/get-my-argument-by-val-inlined-no-formal-parameters.js.no-cjit-validate-phases stress/get-my-argument-by-val-inlined-no-formal-parameters.js.no-llint Results for JSC stress tests: 10 failures found. Detailed fail log is attached.