Summary: | Debug JSC test failure: stress/multi-put-by-offset-reallocation-butterfly-cse.js.ftl-no-cjit-small-pool | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Ryan Haddad <ryanhaddad> | ||||
Component: | JavaScriptCore | Assignee: | Filip Pizlo <fpizlo> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | commit-queue, fpizlo, keith_miller, mark.lam, msaboff, ryanhaddad, saam | ||||
Priority: | P2 | ||||||
Version: | WebKit Nightly Build | ||||||
Hardware: | Unspecified | ||||||
OS: | Unspecified | ||||||
Attachments: |
|
Description
Ryan Haddad
2016-04-08 10:25:51 PDT
The JSC change in the failing test run was <https://trac.webkit.org/changeset/199209> I will look. Hey it repros! Heh. That's awesome. The bug here is that we are doing a GC from the butterfly allocation call, but we forgot to make the stub be GC-aware. So, the GC may delete the stub while we're running it. Here's the stack during the GC moments before we crash: Requested GC with stack: 1 0x100a339ff JSC::Heap::collectImpl(JSC::HeapOperation, void*, void*, int (&) [37]) 2 0x100a3396d JSC::Heap::collect(JSC::HeapOperation) 3 0x1002aa548 JSC::Heap::collectIfNecessaryOrDefer() 4 0x1002aa492 JSC::Heap::decrementDeferralDepthAndGCIfNeeded() 5 0x1002aa468 JSC::DeferGC::~DeferGC() 6 0x1002a8b75 JSC::DeferGC::~DeferGC() 7 0x100b8d55f operationReallocateButterflyToHavePropertyStorageWithInitialCapacity 8 0x22c95a6020c8 9 0x100d6c69d llint_entry 10 0x100d65bde vmEntryToJavaScript 11 0x100b7755a JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) 12 0x100b0e31a JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) 13 0x1004b37a0 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 14 0x100003ed3 runWithScripts(GlobalObject*, WTF::Vector<Script, 0ul, WTF::CrashOnOverflow, 16ul> const&, bool, bool) 15 0x1000033f4 runJSC(JSC::VM*, CommandLine) 16 0x10000283a jscmain(int, char**) 17 0x1000026fb main 18 0x7fff9662b5ad start Notice operationReallocateButterflyToHavePropertyStorageWithInitialCapacity. My put_by_id transition work added a call to that in the IC. Created attachment 276088 [details]
the patch
Attachment 276088 [details] did not pass style-queue:
ERROR: Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp:86: Wrong number of spaces before statement. (expected: 8) [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp:106: Wrong number of spaces before statement. (expected: 8) [whitespace/indent] [4]
Total errors found: 2 in 5 files
If any of these errors are false positives, please file a bug against check-webkit-style.
Comment on attachment 276088 [details]
the patch
r=me
Landed in http://trac.webkit.org/changeset/199275 |