Bug 151486
| Summary: | REGRESSION: Fix the remaining 20-40 crashes on AArch64 after r189575 | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Csaba Osztrogonác <ossy> |
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED WORKSFORME | ||
| Severity: | Normal | CC: | ossy, zan |
| Priority: | P2 | ||
| Version: | Other | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Bug Depends on: | |||
| Bug Blocks: | 108645, 148666 | ||
Csaba Osztrogonác
After bug149061 we still have 20-40 crashes on the AArch64 JSC tester bot:
https://build.webkit.org/builders/EFL%20Linux%20AArch64%20Release?numbuilds=200
Maybe http://trac.webkit.org/r192352 ( bug149061 / bug150936 ) didn't fix all issues
caused by http://trac.webkit.org/r189575 or maybe it is a new regression happened
during the 2 months long breakage.
I just filed this bug report not to forget this regression,
but won't have time to debug this issue this year.
** The following JSC stress test failures have been introduced:
executableAllocationFuzz.yaml/executableAllocationFuzz/v8-raytrace.js.executable-allocation-fuzz-no-cjit
jsc-layout-tests.yaml/js/script-tests/dfg-put-by-id-prototype-check.js.layout
modules.yaml/modules/defaults.js.no-llint-modules
modules.yaml/modules/destructuring-export.js.dfg-eager-no-cjit-validate-modules
modules.yaml/modules/exported-function-may-be-called-before-module-is-executed.js.no-llint-modules
modules.yaml/modules/fallback-ambiguous.js.no-llint-modules
modules.yaml/modules/uncacheable-when-see-star.js.dfg-eager-modules
mozilla-tests.yaml/ecma/Date/15.9.3.1-1.js.mozilla-baseline
mozilla-tests.yaml/ecma/Date/15.9.5.28-1.js.mozilla-baseline
mozilla-tests.yaml/js1_2/function/Number.js.mozilla-baseline
mozilla-tests.yaml/js1_2/regexp/RegExp_input.js.mozilla-baseline
mozilla-tests.yaml/js1_2/regexp/RegExp_leftContext.js.mozilla-baseline
regress/script-tests/Float32Array-matrix-mult.js.dfg-eager-no-cjit-validate
regress/script-tests/Float32Array-matrix-mult.js.dfg-maximal-flush-validate-no-cjit
regress/script-tests/polymorphic-put-by-id.js.dfg-eager
regress/script-tests/raytrace-with-try-catch.js.no-cjit-validate-phases
stress/math-clz32-basics.js.dfg-eager
stress/multi-put-by-offset-reallocation-butterfly-cse.js.no-llint
stress/multi-put-by-offset-reallocation-cases.js.no-llint
stress/redundant-array-bounds-checks-addition.js.dfg-maximal-flush-validate-no-cjit
stress/v8-deltablue-strict.js.dfg-maximal-flush-validate-no-cjit
stress/v8-earley-boyer-strict.js.no-llint
stress/v8-raytrace-strict.js.always-trigger-copy-phase
stress/v8-raytrace-strict.js.no-llint
stress/v8-splay-strict.js.default
v8-v6/v8-raytrace.js.dfg-maximal-flush-validate-no-cjit
v8-v6/v8-regexp.js.no-llint
v8-v6/v8-splay.js.dfg-eager
v8-v6/v8-splay.js.no-llint
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Csaba Osztrogonác
I tested, it is a regression caused by http://trac.webkit.org/changeset/189575.
No failures before it, but 20-40 failures on r189575 + r192352.
Zan Dobersek
These failures aren't exhibited anymore.