Bug 151952

Summary:

DFG ASSERTION FAILED: m_plan.weakReferences.contains(structure).

Product:

WebKit

Reporter:

Mark Lam <mark.lam>

Component:

JavaScriptCore

Assignee:

Filip Pizlo <fpizlo>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

benjamin, fpizlo, ggaren, keith_miller, msaboff, ossy, saam, webkit-bug-importer

Priority:

Keywords:

InRadar

Version:

WebKit Local Build

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
the patch	mark.lam: review+

Mark Lam

Reported 2015-12-07 11:35:58 PST

This fails on a debug build of r193635 on x86_64 when running the JSC tests: ** The following JSC stress test failures have been introduced: stress/ftl-has-a-bad-time.js.ftl-eager stress/ftl-has-a-bad-time.js.ftl-eager: DFG ASSERTION FAILED: m_plan.weakReferences.contains(structure) stress/ftl-has-a-bad-time.js.ftl-eager: /Volumes/Data/ws2/OpenSource/Source/JavaScriptCore/dfg/DFGGraph.cpp(1373) : void JSC::DFG::Graph::assertIsRegistered(JSC::Structure *) stress/ftl-has-a-bad-time.js.ftl-eager: stress/ftl-has-a-bad-time.js.ftl-eager: Graph at time of failure: stress/ftl-has-a-bad-time.js.ftl-eager: stress/ftl-has-a-bad-time.js.ftl-eager: DFG for foo#<no-hash>:[0x10ba77400->0x10ba77a00->0x10ba80900, DFGFunctionCall, 21 (NeverInline)]: stress/ftl-has-a-bad-time.js.ftl-eager: Fixpoint state: FixpointConverged; Form: SSA; Unification state: GloballyUnified; Ref count state: ExactRefCount stress/ftl-has-a-bad-time.js.ftl-eager: Argument formats: FlushedJSValue, FlushedBoolean stress/ftl-has-a-bad-time.js.ftl-eager: stress/ftl-has-a-bad-time.js.ftl-eager: Block #0 (bc#0): (OSR target) stress/ftl-has-a-bad-time.js.ftl-eager: Execution count: 1.000000 stress/ftl-has-a-bad-time.js.ftl-eager: Predecessors: stress/ftl-has-a-bad-time.js.ftl-eager: Successors: #1 (ForwardEdge) #2 (ForwardEdge) stress/ftl-has-a-bad-time.js.ftl-eager: Dominated by: #0 stress/ftl-has-a-bad-time.js.ftl-eager: Dominates: #0 #1 #2 #3 stress/ftl-has-a-bad-time.js.ftl-eager: Dominance Frontier: stress/ftl-has-a-bad-time.js.ftl-eager: Iterated Dominance Frontier: stress/ftl-has-a-bad-time.js.ftl-eager: Pre/Post Numbering: 0/3 stress/ftl-has-a-bad-time.js.ftl-eager: States: StructuresAreWatched stress/ftl-has-a-bad-time.js.ftl-eager: Availability: {locals = arg1:arg1:FlushedBoolean/Unavailable arg0:this:FlushedJSValue/Unavailable; heap = } stress/ftl-has-a-bad-time.js.ftl-eager: Live: stress/ftl-has-a-bad-time.js.ftl-eager: Values: stress/ftl-has-a-bad-time.js.ftl-eager: 27:< 2:-> JSConstant(JS|UseAsOther, Other, Null, bc#0) stress/ftl-has-a-bad-time.js.ftl-eager: 41:<!0:-> ExitOK(MustGen, W:SideState, bc#0) stress/ftl-has-a-bad-time.js.ftl-eager: 39:< 1:-> GetStack(JS|PureInt, Bool, arg1, machine:arg1, FlushedBoolean, R:Stack(6), bc#0) stress/ftl-has-a-bad-time.js.ftl-eager: 42:<!0:-> KillStack(MustGen, loc0, W:SideState, ClobbersExit, bc#0) stress/ftl-has-a-bad-time.js.ftl-eager: 3:<!0:-> ZombieHint(MustGen, loc0, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 43:<!0:-> KillStack(MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 5:<!0:-> ZombieHint(MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 44:<!0:-> KillStack(MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 7:<!0:-> ZombieHint(MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 45:<!0:-> KillStack(MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 9:<!0:-> ZombieHint(MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 46:<!0:-> KillStack(MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 11:<!0:-> ZombieHint(MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 47:<!0:-> KillStack(MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 13:<!0:-> ZombieHint(MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 48:<!0:-> KillStack(MustGen, loc3, W:SideState, ClobbersExit, bc#1) stress/ftl-has-a-bad-time.js.ftl-eager: 17:<!0:-> ZombieHint(MustGen, loc3, W:SideState, ClobbersExit, bc#1, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 49:<!0:-> KillStack(MustGen, loc4, W:SideState, ClobbersExit, bc#3) stress/ftl-has-a-bad-time.js.ftl-eager: 19:<!0:-> ZombieHint(MustGen, loc4, W:SideState, ClobbersExit, bc#3, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 22:<!0:-> Branch(Boolean:Kill:@39, MustGen, T:#1/w:1.000000, F:#2/w:1.000000, W:SideState, bc#6) stress/ftl-has-a-bad-time.js.ftl-eager: States: TakeBoth, StructuresAreWatched stress/ftl-has-a-bad-time.js.ftl-eager: Availability: {locals = arg1:arg1:FlushedBoolean/@39 arg0:this:FlushedJSValue/Unavailable; heap = } stress/ftl-has-a-bad-time.js.ftl-eager: Live: @27 stress/ftl-has-a-bad-time.js.ftl-eager: Values: @27=>(Other, Null) stress/ftl-has-a-bad-time.js.ftl-eager: stress/ftl-has-a-bad-time.js.ftl-eager: Block #1 (bc#9): stress/ftl-has-a-bad-time.js.ftl-eager: Execution count: 1.000000 stress/ftl-has-a-bad-time.js.ftl-eager: Predecessors: #0 stress/ftl-has-a-bad-time.js.ftl-eager: Successors: #3 (CrossEdge) stress/ftl-has-a-bad-time.js.ftl-eager: Dominated by: #0 #1 stress/ftl-has-a-bad-time.js.ftl-eager: Dominates: #1 stress/ftl-has-a-bad-time.js.ftl-eager: Dominance Frontier: #3 stress/ftl-has-a-bad-time.js.ftl-eager: Iterated Dominance Frontier: #3 stress/ftl-has-a-bad-time.js.ftl-eager: Pre/Post Numbering: 3/2 stress/ftl-has-a-bad-time.js.ftl-eager: States: StructuresAreWatched stress/ftl-has-a-bad-time.js.ftl-eager: Availability: {locals = arg1:arg1:FlushedBoolean/@39 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided; heap = } stress/ftl-has-a-bad-time.js.ftl-eager: Live: stress/ftl-has-a-bad-time.js.ftl-eager: Values: stress/ftl-has-a-bad-time.js.ftl-eager: 50:<!0:-> ExitOK(MustGen, W:SideState, bc#9) stress/ftl-has-a-bad-time.js.ftl-eager: 23:< 2:-> NewArrayBuffer(JS|UseAsOther, Array, 0:[Int32: 42], ArrayWithInt32, R:HeapObjectCount, W:HeapObjectCount, Exits, ClobbersExit, bc#9) stress/ftl-has-a-bad-time.js.ftl-eager: 51:<!0:-> KillStack(MustGen, loc6, W:SideState, ClobbersExit, bc#9, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 24:<!0:-> MovHint(Untyped:@23, MustGen, loc6, W:SideState, ClobbersExit, bc#9, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 52:< 1:-> Upsilon(Untyped:@23, ^40, W:SideState, bc#14) stress/ftl-has-a-bad-time.js.ftl-eager: 26:<!0:-> Jump(MustGen, T:#3, W:SideState, bc#14) stress/ftl-has-a-bad-time.js.ftl-eager: States: InvalidBranchDirection, StructuresAreWatched stress/ftl-has-a-bad-time.js.ftl-eager: Availability: {locals = arg1:arg1:FlushedBoolean/@39 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc6:ConflictingFlush/@23 loc7:DeadFlush/Undecided; heap = } stress/ftl-has-a-bad-time.js.ftl-eager: Live: @40 stress/ftl-has-a-bad-time.js.ftl-eager: Values: @40=>(Array, ArrayWithInt32, [%Cg:Array]) stress/ftl-has-a-bad-time.js.ftl-eager: stress/ftl-has-a-bad-time.js.ftl-eager: Block #2 (bc#16): stress/ftl-has-a-bad-time.js.ftl-eager: Execution count: 1.000000 stress/ftl-has-a-bad-time.js.ftl-eager: Predecessors: #0 stress/ftl-has-a-bad-time.js.ftl-eager: Successors: #3 (ForwardEdge) stress/ftl-has-a-bad-time.js.ftl-eager: Dominated by: #0 #2 stress/ftl-has-a-bad-time.js.ftl-eager: Dominates: #2 stress/ftl-has-a-bad-time.js.ftl-eager: Dominance Frontier: #3 stress/ftl-has-a-bad-time.js.ftl-eager: Iterated Dominance Frontier: #3 stress/ftl-has-a-bad-time.js.ftl-eager: Pre/Post Numbering: 1/1 stress/ftl-has-a-bad-time.js.ftl-eager: States: StructuresAreWatched stress/ftl-has-a-bad-time.js.ftl-eager: Availability: {locals = arg1:arg1:FlushedBoolean/@39 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided; heap = } stress/ftl-has-a-bad-time.js.ftl-eager: Live: @27 stress/ftl-has-a-bad-time.js.ftl-eager: Values: @27=>(Other, Null) stress/ftl-has-a-bad-time.js.ftl-eager: 55:<!0:-> ExitOK(MustGen, W:SideState, bc#16) stress/ftl-has-a-bad-time.js.ftl-eager: 56:<!0:-> KillStack(MustGen, loc6, W:SideState, ClobbersExit, bc#16) stress/ftl-has-a-bad-time.js.ftl-eager: 28:<!0:-> MovHint(Untyped:@27, MustGen, loc6, W:SideState, ClobbersExit, bc#16, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 57:< 1:-> Upsilon(Untyped:@27, ^40, W:SideState, bc#19) stress/ftl-has-a-bad-time.js.ftl-eager: 30:<!0:-> Jump(MustGen, T:#3, W:SideState, bc#19) stress/ftl-has-a-bad-time.js.ftl-eager: States: InvalidBranchDirection, StructuresAreWatched stress/ftl-has-a-bad-time.js.ftl-eager: Availability: {locals = arg1:arg1:FlushedBoolean/@39 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc6:ConflictingFlush/@27 loc7:DeadFlush/Undecided; heap = } stress/ftl-has-a-bad-time.js.ftl-eager: Live: @40 stress/ftl-has-a-bad-time.js.ftl-eager: Values: @40=>(Other, Null) stress/ftl-has-a-bad-time.js.ftl-eager: stress/ftl-has-a-bad-time.js.ftl-eager: Block #3 (bc#19): stress/ftl-has-a-bad-time.js.ftl-eager: Execution count: 1.000000 stress/ftl-has-a-bad-time.js.ftl-eager: Predecessors: #1 #2 stress/ftl-has-a-bad-time.js.ftl-eager: Successors: stress/ftl-has-a-bad-time.js.ftl-eager: Dominated by: #0 #3 stress/ftl-has-a-bad-time.js.ftl-eager: Dominates: #3 stress/ftl-has-a-bad-time.js.ftl-eager: Dominance Frontier: stress/ftl-has-a-bad-time.js.ftl-eager: Iterated Dominance Frontier: stress/ftl-has-a-bad-time.js.ftl-eager: Pre/Post Numbering: 2/0 stress/ftl-has-a-bad-time.js.ftl-eager: States: StructuresAreWatched stress/ftl-has-a-bad-time.js.ftl-eager: Availability: {locals = arg1:arg1:FlushedBoolean/@39 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc7:DeadFlush/Undecided; heap = } stress/ftl-has-a-bad-time.js.ftl-eager: Live: @40 stress/ftl-has-a-bad-time.js.ftl-eager: Values: @40=>(ArrayOther, ArrayWithInt32, [%Cg:Array]) stress/ftl-has-a-bad-time.js.ftl-eager: 40:< 2:-> Phi(JS|PureInt, ArrayOther, W:SideState, bc#19, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 53:<!0:-> MovHint(Untyped:@40, MustGen, loc6, W:SideState, ClobbersExit, bc#19, ExitInvalid) stress/ftl-has-a-bad-time.js.ftl-eager: 54:<!0:-> ExitOK(MustGen, W:SideState, bc#19) stress/ftl-has-a-bad-time.js.ftl-eager: 32:<!0:-> Return(Untyped:Kill:@40, MustGen, W:SideState, Exits, bc#19) stress/ftl-has-a-bad-time.js.ftl-eager: States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated stress/ftl-has-a-bad-time.js.ftl-eager: Availability: {locals = arg1:arg1:FlushedBoolean/@39 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc6:ConflictingFlush/@40 loc7:DeadFlush/Undecided; heap = } stress/ftl-has-a-bad-time.js.ftl-eager: Live: stress/ftl-has-a-bad-time.js.ftl-eager: Values: stress/ftl-has-a-bad-time.js.ftl-eager: stress/ftl-has-a-bad-time.js.ftl-eager: GC Values: stress/ftl-has-a-bad-time.js.ftl-eager: Weak:Cell: 0x10ba53fc0 (%CR:JSGlobalLexicalEnvironment), ID: 50 stress/ftl-has-a-bad-time.js.ftl-eager: Weak:Cell: 0x10ba604f0 (%AW:Function), ID: 51 stress/ftl-has-a-bad-time.js.ftl-eager: Desired watchpoints: stress/ftl-has-a-bad-time.js.ftl-eager: Watchpoint sets: stress/ftl-has-a-bad-time.js.ftl-eager: Inline watchpoint sets: 0x10ba3a460, 0x10ba276e0, 0x10ba27fe0, 0x10ba27ce0, 0x10ba26760, 0x10ba27e60 stress/ftl-has-a-bad-time.js.ftl-eager: Inferred values: 0x10ba71380 stress/ftl-has-a-bad-time.js.ftl-eager: Buffer views: stress/ftl-has-a-bad-time.js.ftl-eager: Object property conditions: stress/ftl-has-a-bad-time.js.ftl-eager: Inferred types: stress/ftl-has-a-bad-time.js.ftl-eager: Structures: stress/ftl-has-a-bad-time.js.ftl-eager: %AW:Function = 0x10ba26680:[Function, {}, NonArray, Proto:0x10ba35e00] stress/ftl-has-a-bad-time.js.ftl-eager: %CR:JSGlobalLexicalEnvironment = 0x10ba26700:[JSGlobalLexicalEnvironment, {}, NonArray, Leaf] stress/ftl-has-a-bad-time.js.ftl-eager: %Cg:Array = 0x10ba3a400:[Array, {}, ArrayWithInt32, Proto:0x10ba57f30, Shady leaf] stress/ftl-has-a-bad-time.js.ftl-eager: stress/ftl-has-a-bad-time.js.ftl-eager: stress/ftl-has-a-bad-time.js.ftl-eager: DFG ASSERTION FAILED: m_plan.weakReferences.contains(structure) stress/ftl-has-a-bad-time.js.ftl-eager: /Volumes/Data/ws2/OpenSource/Source/JavaScriptCore/dfg/DFGGraph.cpp(1373) : void JSC::DFG::Graph::assertIsRegistered(JSC::Structure *) stress/ftl-has-a-bad-time.js.ftl-eager: 1 0x1099cc360 WTFCrashWithSecurityImplication stress/ftl-has-a-bad-time.js.ftl-eager: 2 0x1090803df JSC::DFG::crash(JSC::DFG::Graph&, WTF::CString const&, char const*, int, char const*, char const*) stress/ftl-has-a-bad-time.js.ftl-eager: 3 0x1090802e9 JSC::DFG::Graph::handleAssertionFailure(std::nullptr_t, char const*, int, char const*, char const*) stress/ftl-has-a-bad-time.js.ftl-eager: 4 0x10907df67 JSC::DFG::Graph::assertIsRegistered(JSC::Structure*) stress/ftl-has-a-bad-time.js.ftl-eager: 5 0x10926d5ce JSC::DFG::StructureAbstractValue::assertIsRegistered(JSC::DFG::Graph&) const stress/ftl-has-a-bad-time.js.ftl-eager: 6 0x108f2b4bd JSC::DFG::AbstractValue::assertIsRegistered(JSC::DFG::Graph&) const stress/ftl-has-a-bad-time.js.ftl-eager: 7 0x108f2b55d JSC::DFG::AbstractValue::set(JSC::DFG::Graph&, JSC::Structure*) stress/ftl-has-a-bad-time.js.ftl-eager: 8 0x108fb3d4b JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::executeEffects(unsigned int, JSC::DFG::Node*) stress/ftl-has-a-bad-time.js.ftl-eager: 9 0x1091f7243 JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::executeEffects(unsigned int) stress/ftl-has-a-bad-time.js.ftl-eager: 10 0x1093233de JSC::FTL::(anonymous namespace)::LowerDFGToLLVM::compileNode(unsigned int) stress/ftl-has-a-bad-time.js.ftl-eager: 11 0x10932050b JSC::FTL::(anonymous namespace)::LowerDFGToLLVM::compileBlock(JSC::DFG::BasicBlock*) stress/ftl-has-a-bad-time.js.ftl-eager: 12 0x10931f5d9 JSC::FTL::(anonymous namespace)::LowerDFGToLLVM::lower() stress/ftl-has-a-bad-time.js.ftl-eager: 13 0x10931d80e JSC::FTL::lowerDFGToLLVM(JSC::FTL::State&) stress/ftl-has-a-bad-time.js.ftl-eager: 14 0x109193aae JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) stress/ftl-has-a-bad-time.js.ftl-eager: 15 0x109191a9d JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) stress/ftl-has-a-bad-time.js.ftl-eager: 16 0x109298ff0 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) stress/ftl-has-a-bad-time.js.ftl-eager: 17 0x109297514 JSC::DFG::Worklist::threadFunction(void*) stress/ftl-has-a-bad-time.js.ftl-eager: 18 0x109a36619 WTF::createThread(void (*)(void*), void*, char const*)::$_0::operator()() const stress/ftl-has-a-bad-time.js.ftl-eager: 19 0x109a365ed void std::__1::__invoke_void_return_wrapper<void>::__call<WTF::createThread(void (*)(void*), void*, char const*)::$_0&>(WTF::createThread(void (*)(void*), void*, char const*)::$_0&&&) stress/ftl-has-a-bad-time.js.ftl-eager: 20 0x109a3658c std::__1::__function::__func<WTF::createThread(void (*)(void*), void*, char const*)::$_0, std::__1::allocator<WTF::createThread(void (*)(void*), void*, char const*)::$_0>, void ()>::operator()() stress/ftl-has-a-bad-time.js.ftl-eager: 21 0x1093f87ea std::__1::function<void ()>::operator()() const stress/ftl-has-a-bad-time.js.ftl-eager: 22 0x109a352ee WTF::threadEntryPoint(void*) stress/ftl-has-a-bad-time.js.ftl-eager: 23 0x109a36b91 WTF::wtfThreadEntryPoint(void*) stress/ftl-has-a-bad-time.js.ftl-eager: 24 0x7fff9bfdb9b1 _pthread_body stress/ftl-has-a-bad-time.js.ftl-eager: 25 0x7fff9bfdb92e _pthread_body stress/ftl-has-a-bad-time.js.ftl-eager: 26 0x7fff9bfd9385 thread_start stress/ftl-has-a-bad-time.js.ftl-eager: test_script_11303: line 2: 48186 Segmentation fault: 11 ( "$@" ../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --useFunctionDotArguments\=true --useFTLJIT\=true --ftlCrashesIfCantInitializeLLVM\=true --thresholdForJITAfterWarmUp\=10 --thresholdForJITSoon\=10 --thresholdForOptimizeAfterWarmUp\=20 --thresholdForOptimizeAfterLongWarmUp\=20 --thresholdForOptimizeSoon\=20 --thresholdForFTLOptimizeAfterWarmUp\=20 --thresholdForFTLOptimizeSoon\=20 --maximumEvalCacheableSourceLength\=150000 ftl-has-a-bad-time.js ) stress/ftl-has-a-bad-time.js.ftl-eager: ERROR: Unexpected exit code: 139

Attachments
the patch (2.02 KB, patch) 2015-12-07 14:17 PST, Filip Pizlo	mark.lam: review+	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2015-12-07 11:36:54 PST

<rdar://problem/23786949>

Mark Lam

Comment 2 2015-12-07 11:48:31 PST

Looks likes the test has been failing intermittently since Fil landed it in http://trac.webkit.org/changeset/193480 for https://bugs.webkit.org/show_bug.cgi?id=151882. See https://bugs.webkit.org/show_bug.cgi?id=151882#c6.

Filip Pizlo

Comment 3 2015-12-07 12:04:23 PST

Fix on the way.

Filip Pizlo

Comment 4 2015-12-07 13:07:44 PST

I'm just checking that I've got the right fix. Sort of hard, given that it doesn't repro very reliably for me. I should have a fix by end of day.

Filip Pizlo

Comment 5 2015-12-07 13:08:21 PST

This is not a regression. This is a new test that reveals a very old bug.

Filip Pizlo

Comment 6 2015-12-07 13:59:13 PST

Nope, can't repro. I'll do the blind fix.

Filip Pizlo

Comment 7 2015-12-07 14:17:39 PST

Created attachment 266813 [details] the patch

Mark Lam

Comment 8 2015-12-07 14:30:26 PST

Comment on attachment 266813 [details] the patch r=me

Filip Pizlo

Comment 9 2015-12-07 14:33:19 PST

Landed in http://trac.webkit.org/changeset/193653

Note You need to log in before you can comment on or make changes to this bug.