Bug 152258

Summary:

Enable FTL on FreeBSD

Product:

WebKit

Reporter:

Ting-Wei Lan <lantw44>

Component:

JavaScriptCore

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

bugs-noreply, commit-queue, keith_miller, mark.lam, mcatanzaro, msaboff, saam

Priority:

Version:

Other

Hardware:

Unspecified

OS:

Other

Attachments:

Description	Flags
Patch	none
Patch	none
The patch I used to build WebKit on FreeBSD	none
Patch	none

Ting-Wei Lan

Reported 2015-12-14 10:27:40 PST

FTL in JavaScriptCore is enabled by default in WebKitGTK+ 2.11.2, but there are some #if checks preventing it from building on FreeBSD. I will attach a patch to fix the problem, so we can test FTL on FreeBSD.

Attachments
Patch (3.57 KB, patch) 2015-12-14 10:31 PST, Ting-Wei Lan	no flags	Details Formatted Diff Diff
Patch (3.54 KB, patch) 2015-12-15 04:24 PST, Ting-Wei Lan	no flags	Details Formatted Diff Diff
The patch I used to build WebKit on FreeBSD (4.35 KB, text/plain) 2016-02-10 06:55 PST, Ting-Wei Lan	no flags	Details
Patch (5.59 KB, patch) 2016-02-22 11:36 PST, Ting-Wei Lan	no flags	Details Formatted Diff Diff
Show Obsolete (3) View All Add attachment proposed patch, testcase, etc.

Ting-Wei Lan

Comment 1 2015-12-14 10:31:14 PST

Created attachment 267303 [details] Patch

Ting-Wei Lan

Comment 2 2015-12-15 03:20:28 PST

It seems it crashes WebKitWebProcess when running Octane 2.0 JavaScript Benchmark ...

Ting-Wei Lan

Comment 3 2015-12-15 04:24:58 PST

Created attachment 267364 [details] Patch

Michael Catanzaro

Comment 4 2015-12-15 04:53:53 PST

Well you probably don't want this if it's crashing, right?

Ting-Wei Lan

Comment 5 2015-12-15 04:56:09 PST

I think we can keep this bug open until the crash is fixed.

Ting-Wei Lan

Comment 6 2015-12-15 06:35:42 PST

Backtrace: * thread #1: tid = 0, 0x00000008208fa0af, name = 'WebKitWebProcess', stop reason = signal SIGTRAP * frame #0: 0x00000008208fa0af frame #1: 0x0000000820900c41 frame #2: 0x0000000820850669 frame #3: 0x000000080a87ddc0 libjavascriptcoregtk-4.0.so.18`llint_entry + 26708 frame #4: 0x000000080a87dd46 libjavascriptcoregtk-4.0.so.18`llint_entry + 26586 frame #5: 0x000000080a87ddc0 libjavascriptcoregtk-4.0.so.18`llint_entry + 26708 frame #6: 0x000000080a87ddc0 libjavascriptcoregtk-4.0.so.18`llint_entry + 26708 frame #7: 0x000000080a877356 libjavascriptcoregtk-4.0.so.18`vmEntryToJavaScript + 334 frame #8: 0x000000080a40e50d libjavascriptcoregtk-4.0.so.18`JSC::JITCode::execute(this=0x0000000863fc10c8, vm=0x000000081d4055c0, protoCallFrame=0x00007fffffffda10) + 221 at JITCode.cpp:80 frame #9: 0x000000080a3d4189 libjavascriptcoregtk-4.0.so.18`JSC::Interpreter::executeCall(this=0x000000081d5d5068, callFrame=0x000000081d4bb140, function=0x0000000865633640, callType=CallTypeJS, callData=0x00007fffffffde48, thisValue=JSValue at 0x00007fffffffdab0, args=0x00007fffffffdd78) + 1497 at Interpreter.cpp:1038 frame #10: 0x000000080a5f3d5e libjavascriptcoregtk-4.0.so.18`JSC::call(exec=0x000000081d4bb140, functionObject=JSValue at 0x00007fffffffdb68, callType=CallTypeJS, callData=0x00007fffffffde48, thisValue=JSValue at 0x00007fffffffdb50, args=0x00007fffffffdd78) + 190 at CallData.cpp:39 frame #11: 0x000000080a5f3dc3 libjavascriptcoregtk-4.0.so.18`JSC::call(exec=0x000000081d4bb140, functionObject=JSValue at 0x00007fffffffdbe8, callType=CallTypeJS, callData=0x00007fffffffde48, thisValue=JSValue at 0x00007fffffffdbd0, args=0x00007fffffffdd78, returnedException=0x00007fffffffdd98) + 83 at CallData.cpp:44 frame #12: 0x00000008049f2c6f libwebkit2gtk-4.0.so.37`WebCore::JSMainThreadExecState::call(exec=0x000000081d4bb140, functionObject=JSValue at 0x00007fffffffdc78, callType=CallTypeJS, callData=0x00007fffffffde48, thisValue=JSValue at 0x00007fffffffdc60, args=0x00007fffffffdd78, returnedException=0x00007fffffffdd98) + 111 at JSMainThreadExecState.h:56 frame #13: 0x0000000804ae6b68 libwebkit2gtk-4.0.so.37`WebCore::ScheduledAction::executeFunctionInContext(this=0x00000008649c47a8, globalObject=0x000000081d4bb100, thisValue=JSValue at 0x00007fffffffde68, context=0x000000081d426ae0) + 728 at ScheduledAction.cpp:104 frame #14: 0x0000000804ae6624 libwebkit2gtk-4.0.so.37`WebCore::ScheduledAction::execute(this=0x00000008649c47a8, document=0x000000081d426a40) + 388 at ScheduledAction.cpp:125 frame #15: 0x0000000804ae6473 libwebkit2gtk-4.0.so.37`WebCore::ScheduledAction::execute(this=0x00000008649c47a8, context=0x000000081d426ae0) + 67 at ScheduledAction.cpp:78 frame #16: 0x000000080563cd0b libwebkit2gtk-4.0.so.37`WebCore::DOMTimer::fired(this=0x00000008795ff130) + 1131 at DOMTimer.cpp:348 frame #17: 0x00000008057dd98c libwebkit2gtk-4.0.so.37`WebCore::ThreadTimers::sharedTimerFiredInternal(this=0x000000081d5ca5c8) + 396 at ThreadTimers.cpp:121 frame #18: 0x00000008057de5f1 libwebkit2gtk-4.0.so.37`(this=0x0000000808cc7a08)::operator()() const + 33 at ThreadTimers.cpp:73 frame #19: 0x00000008057de52c libwebkit2gtk-4.0.so.37`std::__1::__function::__func<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0, std::__1::allocator<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0>, void ()>::operator()() [inlined] decltype(this=0x0000000808cc7a08, __f=0x0000000808cc7a08)::$_0&>(fp)(std::__1::forward<>(fp0))) std::__1::__invoke<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0&>(WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0&&&) + 60 at __functional_base:413 frame #20: 0x00000008057de51b libwebkit2gtk-4.0.so.37`std::__1::__function::__func<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0, std::__1::allocator<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0>, void ()>::operator(this=0x0000000808cc7a00)() + 43 at functional:1370 frame #21: 0x0000000803bdecad libwebkit2gtk-4.0.so.37`std::__1::function<void ()>::operator(this=0x0000000808cc7a00)() const + 141 at functional:1756 frame #22: 0x00000008057baa0e libwebkit2gtk-4.0.so.37`WebCore::MainThreadSharedTimer::fired(this=0x0000000808cc79f0) + 110 at MainThreadSharedTimer.cpp:52 frame #23: 0x000000080612cede libwebkit2gtk-4.0.so.37`WTF::RunLoop::Timer<WebCore::MainThreadSharedTimer>::fired(this=0x0000000808cc7a30) + 110 at RunLoop.h:131 frame #24: 0x000000080aa652ed libjavascriptcoregtk-4.0.so.18`(this=0x0000000000000000, userData=0x0000000808cc7a30)::operator()(gpointer) const + 45 at RunLoopGLib.cpp:131 frame #25: 0x000000080aa652b8 libjavascriptcoregtk-4.0.so.18`(userData=0x0000000808cc7a30)::__invoke(gpointer) + 24 at RunLoopGLib.cpp:129 frame #26: 0x000000080aa653e6 libjavascriptcoregtk-4.0.so.18`WTF::$_0::operator(this=0x0000000000000000, source=0x000000081d3105e0, callback=0x000000080aa652a0, userData=0x0000000808cc7a30)(_GSource*, int (*)(void*), void*) const + 86 at RunLoopGLib.cpp:44 frame #27: 0x000000080aa65388 libjavascriptcoregtk-4.0.so.18`WTF::$_0::__invoke(source=0x000000081d3105e0, callback=0x000000080aa652a0, userData=0x0000000808cc7a30)(void*), void*) + 40 at RunLoopGLib.cpp:39 frame #28: 0x000000080d32c5c8 libglib-2.0.so.0`g_main_context_dispatch + 312 frame #29: 0x000000080d32c8fb libglib-2.0.so.0`??? + 411 frame #30: 0x000000080d32cc0f libglib-2.0.so.0`g_main_loop_run + 207 frame #31: 0x000000080aa6482d libjavascriptcoregtk-4.0.so.18`WTF::RunLoop::run() + 189 at RunLoopGLib.cpp:94 frame #32: 0x00000008044ebb2d libwebkit2gtk-4.0.so.37`int WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain>(argc=2, argv=0x00007fffffffe618) + 253 at ChildProcessMain.h:61 frame #33: 0x00000008044eba1b libwebkit2gtk-4.0.so.37`WebKit::WebProcessMainUnix(argc=2, argv=0x00007fffffffe618) + 27 at WebProcessMainGtk.cpp:77 frame #34: 0x0000000000400bf5 WebKitWebProcess`main(argc=2, argv=0x00007fffffffe618) + 69 at WebProcessMain.cpp:44 frame #35: 0x0000000000400acf WebKitWebProcess`_start + 367

Michael Catanzaro

Comment 7 2016-02-09 06:29:19 PST

Might test to see if it's still broken in 2.11.5 (with B3 instead of LLVM).

Ting-Wei Lan

Comment 8 2016-02-09 23:28:39 PST

Comment on attachment 267364 [details] Patch This patch is no longer needed because FTL JIT uses B3 now although another patch is required to get it build.

Ting-Wei Lan

Comment 9 2016-02-10 06:55:55 PST

Created attachment 270987 [details] The patch I used to build WebKit on FreeBSD This is the patch I used to make WebKit build on FreeBSD. I didn't add a ChangeLog entry because it is probably not ready for review. I hope that my modifications are correct, so my test result can be useful for debugging. ARM, ARM64, MIPS are untested because I don't have these hardware devices running FreeBSD, and I currently don't have time to setup QEMU to test them.

Ting-Wei Lan

Comment 10 2016-02-10 10:14:00 PST

FreeBSD 10.3-BETA1 x86_64, WebKit trunk r196364. testb3 always passes, but running Octane benchmark seldom succeeds. WebKitWebProcess usually crashes with the following message. ASSERTION FAILED: value.isUndefinedOrNull() ../../Source/JavaScriptCore/bytecode/SpeculatedType.cpp(394) : SpeculatedType JSC::speculationFromValue(JSC::JSValue) [Backtrace provided by GDB] Core was generated by `WebKitWebProcess'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x000000080b36d06a in WTFCrash () from /home/lantw44/gnome/source/webkit-trunk/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18 #1 0x000000080a7c9617 in JSC::speculationFromValue(JSC::JSValue) () from /home/lantw44/gnome/source/webkit-trunk/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18 #2 0x000000080a75be34 in JSC::ValueProfileBase<1u>::computeUpdatedPrediction(JSC::ConcurrentJITLocker const&) () from /home/lantw44/gnome/source/webkit-trunk/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18 #3 0x000000080a74d0f2 in JSC::CodeBlock::updateAllPredictionsAndCountLiveness(unsigned int&, unsigned int&) () from /home/lantw44/gnome/source/webkit-trunk/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18 #4 0x000000080a74d1bd in JSC::CodeBlock::updateAllValueProfilePredictions() () from /home/lantw44/gnome/source/webkit-trunk/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18 #5 0x000000080a74ac29 in JSC::CodeBlock::updateAllPredictions() () from /home/lantw44/gnome/source/webkit-trunk/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18 #6 0x000000080ad670e8 in operationOptimize () from /home/lantw44/gnome/source/webkit-trunk/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18 #7 0x0000000822cd5731 in ?? () #8 0x000000081e42ff80 in ?? () #9 0x000000081e4055d8 in ?? () #10 0x000000087fc3f4f0 in ?? () #11 0x000000081e4055d8 in ?? () #12 0x00007fffffffa450 in ?? () #13 0x0000000803d808ca in JSC::CopyBarrierBase::set(JSC::VM&, JSC::JSCell const*, void*) () from /home/lantw44/gnome/source/webkit-trunk/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37 #14 0x000000082364a781 in ?? () #15 0x000000087347ba60 in ?? () #16 0x00000008648cb580 in ?? () #17 0x0000000100000008 in ?? () #18 0x00000008652fbd90 in ?? () #19 0xffff00007fe0fc6a in ?? () #20 0x00000008994c3a60 in ?? () #21 0x0000000000000007 in ?? () #22 0x0000000800000006 in ?? () #23 0xffff000000000000 in ?? () #24 0xffff0000000a3943 in ?? () #25 0xffff0000000a394c in ?? () #26 0x0000000803d7f9fd in JSC::JSNonFinalObject::finishCreation(JSC::VM&) () from /home/lantw44/gnome/source/webkit-trunk/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37 #27 0x0000000822f99167 in ?? () #28 0x0000000885a51a80 in ?? () #29 0x00000008648cb610 in ?? () #30 0x0000000000000005 in ?? () #31 0x00000008652fbd90 in ?? () #32 0xffff00007fe0fc6a in ?? () #33 0x0000000000000007 in ?? () #34 0xffff000000000000 in ?? () #35 0x0000000000000006 in ?? () #36 0x000000087b035870 in ?? () #37 0x00000008678bfd00 in ?? () #38 0x0000000864692900 in ?? () #39 0x000000081e4055c0 in ?? () #40 0x000000087b035870 in ?? () #41 0x00000008678bfd00 in ?? () #42 0x00007fffffffa7b0 in ?? () #43 0x000000000000000a in ?? () #44 0x00007fffffffa7b0 in ?? () #45 0x000000082285ef51 in ?? () #46 0x00000008786b2fc0 in ?? () #47 0x00000008648f27d0 in ?? () #48 0x0000000800000003 in ?? () #49 0x000000087fc3f510 in ?? () #50 0x00000008652fbd90 in ?? () #51 0x0000000000000006 in ?? () #52 0x00007fffffffa870 in ?? () #53 0x000000082364a781 in ?? () #54 0x00000008634a3040 in ?? () #55 0x00000008648cb580 in ?? () #56 0x0000000e00000008 in ?? () #57 0x000000087fc3f4e0 in ?? () #58 0x0000000800000000 in ?? () #59 0x000000086349f580 in ?? () #60 0x0000000000000007 in ?? () #61 0x0000000800000006 in ?? () #62 0x00000008652fbd90 in ?? () #63 0x000000087fc3f510 in ?? () #64 0xffff0000000a393f in ?? () #65 0x000000087fc3f4e0 in ?? () #66 0x00000008652fbd90 in ?? () #67 0xffff000000000002 in ?? () #68 0xffff000000000000 in ?? () #69 0xffff000000000002 in ?? () #70 0x00007fffffffa870 in ?? () #71 0x00000008229bfecc in ?? () #72 0x00000008786b4320 in ?? () #73 0x00000008648c9f00 in ?? () #74 0x000000086349e3b0 in ?? () #75 0x0000000000000002 in ?? () #76 0x000000086484b140 in ?? () #77 0x00000008702e2900 in ?? () #78 0x000000000000000a in ?? () #79 0x00000000000a3943 in ?? () #80 0x000000000000000a in ?? () #81 0x000000087fc3f4e0 in ?? () #82 0x000000000000000a in ?? () #83 0x000000000000000a in ?? () #84 0x000000000000000a in ?? () #85 0x000000000000000a in ?? () #86 0x0000000000000006 in ?? () #87 0x0000000000000007 in ?? () #88 0x000000086349f580 in ?? () #89 0x0000000000000001 in ?? () #90 0x00000008652fbd90 in ?? () #91 0xffff000000000002 in ?? () #92 0xffff000000000000 in ?? () #93 0xffff000000000002 in ?? () #94 0x00007fffffffaa90 in ?? () #95 0x0000000822f9c641 in ?? () #96 0x00000008786bd860 in ?? () #97 0x00000008648cb5b0 in ?? () #98 0x0000000d00000006 in ?? () #99 0x00000008652fbd90 in ?? () #100 0xffff00007fe0fc6a in ?? () #101 0xffff000000000009 in ?? () #102 0x0000000000000007 in ?? () #103 0xffff000000000000 in ?? () #104 0x0000000000000007 in ?? () #105 0x00000008678bfd00 in ?? () #106 0x0000000864692900 in ?? () #107 0x000000081e4055c0 in ?? () #108 0x000000087b0358a0 in ?? () #109 0x00000008678bfd00 in ?? () #110 0x00007fffffffa9d0 in ?? () #111 0x000000000000000a in ?? () #112 0x00007fffffffa9d0 in ?? () #113 0xffff000000000030 in ?? () #114 0x00000008994c3a90 in ?? () #115 0x00000008648f27d0 in ?? () #116 0x0000000800000003 in ?? () #117 0x000000087fc3f530 in ?? () #118 0x00000008652fbd90 in ?? () #119 0x0000000000000006 in ?? () #120 0x0000000000000001 in ?? () #121 0x000000081e405668 in ?? () #122 0x00000008634a3040 in ?? () #123 0x000000081e405668 in ?? () #124 0x00007fffffffa980 in ?? () #125 0x000000087fc3f500 in ?? () #126 0x0000000800000000 in ?? () #127 0x000000086349f580 in ?? () #128 0x00007fffffffa9b0 in ?? () #129 0x0000000803d8099f in JSC::Heap::writeBarrier(JSC::JSCell const*) () from /home/lantw44/gnome/source/webkit-trunk/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37 Backtrace stopped: previous frame inner to this frame (corrupt stack?) [Backtrace provided by LLDB] * thread #1: tid = 0, 0x000000080b36d06a libjavascriptcoregtk-4.0.so.18`::WTFCrash() + 42 at Assertions.cpp:321, name = 'WebKitWebProcess', stop reason = signal SIGSEGV * frame #0: 0x000000080b36d06a libjavascriptcoregtk-4.0.so.18`::WTFCrash() + 42 at Assertions.cpp:321 frame #1: 0x000000080a7c9617 libjavascriptcoregtk-4.0.so.18`JSC::speculationFromValue(value=JSValue at 0x00007fffffff9dd0) + 375 at SpeculatedType.cpp:394 frame #2: 0x000000080a75be34 libjavascriptcoregtk-4.0.so.18`JSC::ValueProfileBase<1u>::computeUpdatedPrediction(this=0x000000088a7713a0, (null)=0x00007fffffff9ea8) + 132 at ValueProfile.h:145 frame #3: 0x000000080a74d0f2 libjavascriptcoregtk-4.0.so.18`JSC::CodeBlock::updateAllPredictionsAndCountLiveness(this=0x000000087347ba60, numberOfLiveNonArgumentValueProfiles=0x00007fffffff9ee4, numberOfSamplesInProfiles=0x00007fffffff9ee0) + 258 at CodeBlock.cpp:3847 frame #4: 0x000000080a74d1bd libjavascriptcoregtk-4.0.so.18`JSC::CodeBlock::updateAllValueProfilePredictions(this=0x000000087347ba60) + 29 at CodeBlock.cpp:3863 frame #5: 0x000000080a74ac29 libjavascriptcoregtk-4.0.so.18`JSC::CodeBlock::updateAllPredictions(this=0x000000087347ba60) + 25 at CodeBlock.cpp:3884 frame #6: 0x000000080ad670e8 libjavascriptcoregtk-4.0.so.18`::operationOptimize(exec=0x00007fffffffa500, bytecodeIndex=0) + 616 at JITOperations.cpp:1136 frame #7: 0x0000000822cd5731 frame #8: 0x000000082364a781 frame #9: 0x0000000822f99167 frame #10: 0x0000000822f9c641 frame #11: 0x000000082364bcbf frame #12: 0x0000000822f99167 frame #13: 0x0000000822f9c641 frame #14: 0x00000008239a06a9 frame #15: 0x00000008239e5208 frame #16: 0x0000000822298b7a frame #17: 0x00000008239b0c77 frame #18: 0x00000008239ba093 frame #19: 0x000000082397b0c8 frame #20: 0x000000082326ed56 frame #21: 0x00000008239cb19d frame #22: 0x0000000823994055 frame #23: 0x00000008239e5208 frame #24: 0x000000082325ad5f frame #25: 0x0000000823992d8f frame #26: 0x00000008239e5208 frame #27: 0x000000080b1ee9ef libjavascriptcoregtk-4.0.so.18`llint_entry + 26707 frame #28: 0x000000080b1ee9ef libjavascriptcoregtk-4.0.so.18`llint_entry + 26707 frame #29: 0x000000080b1eea69 libjavascriptcoregtk-4.0.so.18`llint_entry + 26829 frame #30: 0x000000080b1ee9ef libjavascriptcoregtk-4.0.so.18`llint_entry + 26707 frame #31: 0x000000080b1ee9ef libjavascriptcoregtk-4.0.so.18`llint_entry + 26707 frame #32: 0x000000080b1ee9ef libjavascriptcoregtk-4.0.so.18`llint_entry + 26707 frame #33: 0x000000080b1ee9ef libjavascriptcoregtk-4.0.so.18`llint_entry + 26707 frame #34: 0x0000000821c8b9da frame #35: 0x0000000821dbdbe6 frame #36: 0x0000000821c9b7ef frame #37: 0x0000000822849327 frame #38: 0x000000080b1e7f86 libjavascriptcoregtk-4.0.so.18`llintPCRangeStart + 334 frame #39: 0x000000080ad5211d libjavascriptcoregtk-4.0.so.18`JSC::JITCode::execute(this=0x00000008825f41e0, vm=0x000000081e4055c0, protoCallFrame=0x00007fffffffccf0) + 221 at JITCode.cpp:80 frame #40: 0x000000080ad157a9 libjavascriptcoregtk-4.0.so.18`JSC::Interpreter::executeCall(this=0x000000081e5d5068, callFrame=0x000000081e493140, function=0x0000000864af2e30, callType=CallTypeJS, callData=0x00007fffffffd1f8, thisValue=JSValue at 0x00007fffffffcd90, args=0x00007fffffffd128) + 1497 at Interpreter.cpp:1035 frame #41: 0x000000080af3dafe libjavascriptcoregtk-4.0.so.18`JSC::call(exec=0x000000081e493140, functionObject=JSValue at 0x00007fffffffce48, callType=CallTypeJS, callData=0x00007fffffffd1f8, thisValue=JSValue at 0x00007fffffffce30, args=0x00007fffffffd128) + 190 at CallData.cpp:40 frame #42: 0x000000080af3db63 libjavascriptcoregtk-4.0.so.18`JSC::call(exec=0x000000081e493140, functionObject=JSValue at 0x00007fffffffcec8, callType=CallTypeJS, callData=0x00007fffffffd1f8, thisValue=JSValue at 0x00007fffffffceb0, args=0x00007fffffffd128, returnedException=0x00007fffffffd148) + 83 at CallData.cpp:45 frame #43: 0x000000080af3dd51 libjavascriptcoregtk-4.0.so.18`JSC::profiledCall(exec=0x000000081e493140, reason=Other, functionObject=JSValue at 0x00007fffffffcf70, callType=CallTypeJS, callData=0x00007fffffffd1f8, thisValue=JSValue at 0x00007fffffffcf58, args=0x00007fffffffd128, returnedException=0x00007fffffffd148) + 129 at CallData.cpp:64 frame #44: 0x0000000804af40bd libwebkit2gtk-4.0.so.37`WebCore::JSMainThreadExecState::profiledCall(exec=0x000000081e493140, reason=Other, functionObject=JSValue at 0x00007fffffffd010, callType=CallTypeJS, callData=0x00007fffffffd1f8, thisValue=JSValue at 0x00007fffffffcff8, args=0x00007fffffffd128, returnedException=0x00007fffffffd148) + 125 at JSMainThreadExecState.h:74 frame #45: 0x0000000804be95c1 libwebkit2gtk-4.0.so.37`WebCore::ScheduledAction::executeFunctionInContext(this=0x0000000881da7d70, globalObject=0x000000081e493100, thisValue=JSValue at 0x00007fffffffd218, context=0x000000081e430f60) + 737 at ScheduledAction.cpp:104 frame #46: 0x0000000804be9074 libwebkit2gtk-4.0.so.37`WebCore::ScheduledAction::execute(this=0x0000000881da7d70, document=0x000000081e430ec0) + 388 at ScheduledAction.cpp:125 frame #47: 0x0000000804be8ec3 libwebkit2gtk-4.0.so.37`WebCore::ScheduledAction::execute(this=0x0000000881da7d70, context=0x000000081e430f60) + 67 at ScheduledAction.cpp:78 frame #48: 0x000000080573defb libwebkit2gtk-4.0.so.37`WebCore::DOMTimer::fired(this=0x000000088bf90688) + 1131 at DOMTimer.cpp:348 frame #49: 0x00000008058feb1c libwebkit2gtk-4.0.so.37`WebCore::ThreadTimers::sharedTimerFiredInternal(this=0x000000081e5c97a8) + 396 at ThreadTimers.cpp:121 frame #50: 0x00000008058ff781 libwebkit2gtk-4.0.so.37`(this=0x0000000808eddf78)::operator()() const + 33 at ThreadTimers.cpp:73 frame #51: 0x00000008058ff6bc libwebkit2gtk-4.0.so.37`std::__1::__function::__func<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0, std::__1::allocator<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0>, void ()>::operator()() [inlined] decltype(this=0x0000000808eddf78, __f=0x0000000808eddf78)::$_0&>(fp)(std::__1::forward<>(fp0))) std::__1::__invoke<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0&>(WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0&&&) + 60 at __functional_base:413 frame #52: 0x00000008058ff6ab libwebkit2gtk-4.0.so.37`std::__1::__function::__func<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0, std::__1::allocator<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0>, void ()>::operator(this=0x0000000808eddf70)() + 43 at functional:1370 frame #53: 0x0000000803c8f2cd libwebkit2gtk-4.0.so.37`std::__1::function<void ()>::operator(this=0x0000000808eddf70)() const + 141 at functional:1756 frame #54: 0x00000008058d79ce libwebkit2gtk-4.0.so.37`WebCore::MainThreadSharedTimer::fired(this=0x0000000808eddf60) + 110 at MainThreadSharedTimer.cpp:52 frame #55: 0x00000008062934ee libwebkit2gtk-4.0.so.37`WTF::RunLoop::Timer<WebCore::MainThreadSharedTimer>::fired(this=0x0000000808eddfa0) + 110 at RunLoop.h:131 frame #56: 0x000000080b3d934d libjavascriptcoregtk-4.0.so.18`(this=0x0000000000000000, userData=0x0000000808eddfa0)::operator()(gpointer) const + 45 at RunLoopGLib.cpp:131 frame #57: 0x000000080b3d9318 libjavascriptcoregtk-4.0.so.18`(userData=0x0000000808eddfa0)::__invoke(gpointer) + 24 at RunLoopGLib.cpp:129 frame #58: 0x000000080b3d9446 libjavascriptcoregtk-4.0.so.18`WTF::$_0::operator(this=0x000000080b3d93c0, source=0x00000008214db200, callback=0x000000080b3d9300, userData=0x0000000808eddfa0)(_GSource*, int (*)(void*), void*) const + 86 at RunLoopGLib.cpp:44 frame #59: 0x000000080b3d93e8 libjavascriptcoregtk-4.0.so.18`WTF::$_0::__invoke(source=0x00000008214db200, callback=0x000000080b3d9300, userData=0x0000000808eddfa0)(void*), void*) + 40 at RunLoopGLib.cpp:39 frame #60: 0x000000080dffdac4 libglib-2.0.so.0`g_main_dispatch(context=0x000000081e053780) + 452 at gmain.c:3154 frame #61: 0x000000080dffd8e3 libglib-2.0.so.0`g_main_context_dispatch(context=0x000000081e053780) + 51 at gmain.c:3769 frame #62: 0x000000080dffdeb7 libglib-2.0.so.0`g_main_context_iterate(context=0x000000081e053780, block=1, dispatch=1, self=0x000000081e021f30) + 471 at gmain.c:3840 frame #63: 0x000000080dffe3ce libglib-2.0.so.0`g_main_loop_run(loop=0x000000081e3ccc80) + 590 at gmain.c:4034 frame #64: 0x000000080b3d888d libjavascriptcoregtk-4.0.so.18`WTF::RunLoop::run() + 189 at RunLoopGLib.cpp:94 frame #65: 0x00000008045a5d6d libwebkit2gtk-4.0.so.37`int WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain>(argc=2, argv=0x00007fffffffda00) + 253 at ChildProcessMain.h:61 frame #66: 0x00000008045a5c5b libwebkit2gtk-4.0.so.37`WebKit::WebProcessMainUnix(argc=2, argv=0x00007fffffffda00) + 27 at WebProcessMainGtk.cpp:77 frame #67: 0x0000000000400bf5 WebKitWebProcess`main(argc=2, argv=0x00007fffffffda00) + 69 at WebProcessMain.cpp:44 frame #68: 0x0000000000400acf WebKitWebProcess`_start + 367

Ting-Wei Lan

Comment 11 2016-02-11 23:32:53 PST

The same crash problem can also be reproduced on GNU/Linux. It crashes when Octane Benchmark runs the TypeScript test. I think the crash is not FreeBSD-specific and I will upload a new patch to make FTL JIT build on FreeBSD. Fedora 23 x86_64, WebKit trunk r196364. ASSERTION FAILED: value.isUndefinedOrNull() ../../Source/JavaScriptCore/bytecode/SpeculatedType.cpp(394) : JSC::SpeculatedType JSC::speculationFromValue(JSC::JSValue) 1 0x7f4e86fc614d <webkit_trunk>/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(WTFCrash+0x1e) [0x7f4e86fc614d] 2 0x7f4e866939da <webkit_trunk>/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(_ZN3JSC20speculationFromValueENS_7JSValueE+0x13e) [0x7f4e866939da] 3 0x7f4e8663f6ca <webkit_trunk>/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(_ZN3JSC16ValueProfileBaseILj1EE24computeUpdatedPredictionERKNS_19ConcurrentJITLockerE+0x6c) [0x7f4e8663f6ca] 4 0x7f4e86635c02 <webkit_trunk>/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(_ZN3JSC9CodeBlock36updateAllPredictionsAndCountLivenessERjS1_+0xc0) [0x7f4e86635c02] 5 0x7f4e86635cc7 <webkit_trunk>/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(_ZN3JSC9CodeBlock32updateAllValueProfilePredictionsEv+0x23) [0x7f4e86635cc7] 6 0x7f4e86635dd8 <webkit_trunk>/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(_ZN3JSC9CodeBlock20updateAllPredictionsEv+0x18) [0x7f4e86635dd8] 7 0x7f4e86b14c24 <webkit_trunk>/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(+0x1ae0c24) [0x7f4e86b14c24] 8 0x7f4e1d0cf2d1 [0x7f4e1d0cf2d1] [Backtrace provided by GDB] Core was generated by `WebKitWebProcess'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00007f4e86fc6152 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 #1 0x00007f4e866939da in JSC::speculationFromValue (value=...) at ../../Source/JavaScriptCore/bytecode/SpeculatedType.cpp:394 #2 0x00007f4e8663f6ca in JSC::ValueProfileBase<1u>::computeUpdatedPrediction (this=0x7f4d91d62ef8) at ../../Source/JavaScriptCore/bytecode/ValueProfile.h:145 #3 0x00007f4e86635c02 in JSC::CodeBlock::updateAllPredictionsAndCountLiveness (this=0x7f4e0280a520, numberOfLiveNonArgumentValueProfiles=@0x7ffe910dcdbc: 0, numberOfSamplesInProfiles=@0x7ffe910dcdb8: 5) at ../../Source/JavaScriptCore/bytecode/CodeBlock.cpp:3847 #4 0x00007f4e86635cc7 in JSC::CodeBlock::updateAllValueProfilePredictions (this=0x7f4e0280a520) at ../../Source/JavaScriptCore/bytecode/CodeBlock.cpp:3863 #5 0x00007f4e86635dd8 in JSC::CodeBlock::updateAllPredictions (this=0x7f4e0280a520) at ../../Source/JavaScriptCore/bytecode/CodeBlock.cpp:3884 #6 0x00007f4e86b14c24 in JSC::operationOptimize (exec=0x7ffe910dd110, bytecodeIndex=0) at ../../Source/JavaScriptCore/jit/JITOperations.cpp:1136 #7 0x00007f4e1d0cf2d1 in ?? () #8 0x00007ffe910dd030 in ?? () #9 0x00007f4e72805600 in ?? () #10 0x00007ffe910dd040 in ?? () #11 0x00007f4e8cf3a8dd in std::__get_helper<0ul, JSC::StructureIDTable::StructureOrOffset*, std::default_delete<JSC::StructureIDTable::StructureOrOffset []> > ( __t=...) at /usr/include/c++/5.3.1/tuple:827 #12 0x00007f4e1d9b7b3e in ?? () #13 0x00007f4e0280a520 in ?? () #14 0x00007f4e0342f850 in ?? () #15 0x0000000100000008 in ?? () #16 0x00007f4e1a2b7c60 in ?? () #17 0xffff00007fe0fd2b in ?? () #18 0x00007f4d72ec3a90 in ?? () #19 0x0000000000000007 in ?? () #20 0x00007f4d00000006 in ?? () #21 0xffff000000000000 in ?? () #22 0xffff0000000faea3 in ?? () #23 0xffff0000000faeab in ?? () #24 0x00007f4d6e2e7e30 in ?? () #25 0x00007ffe910dd1d0 in ?? () #26 0x00007f4e8d7f8792 in JSC::JSArray::createWithButterfly (vm=..., structure=0x7ffe910dd270, butterfly=0xfae8c) at ../../Source/JavaScriptCore/runtime/JSArray.h:279 #27 0x00007f4e1de18d99 in ?? () #28 0x00007f4d91070100 in ?? () #29 0x00007f4e0342f8e0 in ?? () #30 0x0000000000000005 in ?? () #31 0x00007f4e1a2b7c60 in ?? () #32 0xffff00007fe0fd2b in ?? () #33 0x0000000000000007 in ?? () #34 0xffff000000000000 in ?? () #35 0x0000000000000006 in ?? () #36 0x00000001910dd2f0 in ?? () #37 0x00007f4e728055e8 in ?? () #38 0x00007ffe910dd300 in ?? () #39 0x00007f4e8cf39483 in JSC::JSCell::structure (this=0xffff000000000002) at ../../Source/JavaScriptCore/runtime/JSCellInlines.h:102 #40 0x00007f4e1cd220ba in ?? () #41 0x00007f4d934620e0 in ?? () #42 0x00007f4e0342f880 in ?? () #43 0x0000001000000005 in ?? () #44 0x00007f4e1a2b7c60 in ?? () #45 0xffff00007fe0fd2b in ?? () #46 0xffff000000000001 in ?? () #47 0x0000000000000007 in ?? () #48 0xffff000000000000 in ?? () #49 0x0000000000000006 in ?? () #50 0x000000000000000a in ?? () #51 0x0000000000000007 in ?? () #52 0x00007f4e8d25b1c4 in JSC::JSValue::isDouble (this=0xffff000000000002) at ../../Source/JavaScriptCore/runtime/JSCJSValueInlines.h:420 #53 0x00007f4e1d0cfe9b in ?? () #54 0x00007f4dab8cc100 in ?? () #55 0x00007f4e0342fbe0 in ?? () #56 0x0000000500000002 in ?? () #57 0x00007f4e1a2b7c60 in ?? () #58 0xffff00007fe0fd2a in ?? () #59 0x00007f4e0389d6c0 in ?? () #60 0x00007f4e1aaa3580 in ?? () #61 0x00007f4e028e3e20 in ?? () #62 0xffff00000000001c in ?? () #63 0x00007f4dd5416be0 in ?? () #64 0x00007f4e0342fbe0 in ?? () #65 0x00007f4e030828c0 in ?? () #66 0x00007f4e028e3e20 in ?? () #67 0x00007f4e0389d6c0 in ?? () #68 0x00007f4e1aaa3580 in ?? () #69 0xffff000000000037 in ?? () #70 0x00007f4dd00cb8c0 in ?? () #71 0x000000000000000a in ?? () #72 0x000000000000000a in ?? () #73 0x00007f4d72ec3ac0 in ?? () #74 0x000000000000000a in ?? () #75 0xffff000000000000 in ?? () #76 0xffff0000000fae91 in ?? () #77 0x00007f4e1aaa3580 in ?? () #78 0x00007f4e1aaa3580 in ?? () #79 0xffff000000000002 in ?? () #80 0xffff000000000000 in ?? () #81 0xffff0000000fae8c in ?? () #82 0x00007ffe910dd7e0 in ?? () #83 0x00007f4e1d9b7b3e in ?? () #84 0x00007f4e0280a520 in ?? () #85 0x00007f4e0342f850 in ?? () #86 0x000001a700000008 in ?? () #87 0x00007f4e1a2b7c60 in ?? () #88 0xffff00007fe0fd2a in ?? () #89 0x00007f4dd5416be0 in ?? () #90 0x0000000000000007 in ?? () #91 0x00007f4d00000006 in ?? () #92 0xffff000000000000 in ?? () #93 0xffff0000000fae8c in ?? () #94 0xffff0000000fae90 in ?? () #95 0x00007f4d6e2e7e60 in ?? () #96 0x00007ffe910dd740 in ?? () #97 0x00007f4e8d7f8792 in JSC::JSArray::createWithButterfly (vm=..., structure=0xffff0000000fae91, butterfly=0xffff000000000000) at ../../Source/JavaScriptCore/runtime/JSArray.h:279

Ting-Wei Lan

Comment 12 2016-02-22 11:36:38 PST

Created attachment 271938 [details] Patch

Ting-Wei Lan

Comment 13 2016-02-22 11:42:08 PST

Comment on attachment 271938 [details] Patch This patch is only tested on x86_64. Code for other architectures is neither build-tested nor run-tested because I don't have access to them.

WebKit Commit Bot

Comment 14 2016-02-22 15:03:22 PST

Comment on attachment 271938 [details] Patch Clearing flags on attachment: 271938 Committed r196962: <http://trac.webkit.org/changeset/196962>

WebKit Commit Bot

Comment 15 2016-02-22 15:03:29 PST

All reviewed patches have been landed. Closing bug.

Note You need to log in before you can comment on or make changes to this bug.