Bug 164274
| Summary: | ASSERTION FAILED: op() == CreateRest || op() == GetRestLength || op() == GetMyArgumentByVal || op() == GetMyArgumentByValOutOfBounds | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Ryan Haddad <ryanhaddad> |
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED DUPLICATE | ||
| Severity: | Normal | CC: | saam |
| Priority: | P2 | ||
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Ryan Haddad
https://build.webkit.org/builders/Apple%20El%20Capitan%20Debug%20JSC%20%28Tests%29/builds/4424/steps/jscore-test/logs/stdio
stress/rest-parameter-basics.js.default: ASSERTION FAILED: op() == CreateRest || op() == GetRestLength || op() == GetMyArgumentByVal || op() == GetMyArgumentByValOutOfBounds
stress/rest-parameter-basics.js.default: /Volumes/Data/slave/elcapitan-debug/build/Source/JavaScriptCore/dfg/DFGNode.h(2393) : unsigned int JSC::DFG::Node::numberOfArgumentsToSkip()
stress/rest-parameter-basics.js.default: 1 0x102a28790 WTFCrash
stress/rest-parameter-basics.js.default: 2 0x101c8dd38 JSC::DFG::Node::numberOfArgumentsToSkip()
stress/rest-parameter-basics.js.default: 3 0x101c9237b JSC::DFG::emitCodeToGetArgumentsArrayLength(JSC::DFG::InsertionSet&, JSC::DFG::Node*, unsigned int, JSC::DFG::NodeOrigin)
stress/rest-parameter-basics.js.default: 4 0x101c7be74 JSC::DFG::(anonymous namespace)::ArgumentsEliminationPhase::transform()::'lambda'(JSC::DFG::Node*)::operator()(JSC::DFG::Node*) const
stress/rest-parameter-basics.js.default: 5 0x101c6765a JSC::DFG::(anonymous namespace)::ArgumentsEliminationPhase::transform()
stress/rest-parameter-basics.js.default: 6 0x101c66039 JSC::DFG::(anonymous namespace)::ArgumentsEliminationPhase::run()
stress/rest-parameter-basics.js.default: 7 0x101c65df2 bool JSC::DFG::runAndLog<JSC::DFG::(anonymous namespace)::ArgumentsEliminationPhase>(JSC::DFG::(anonymous namespace)::ArgumentsEliminationPhase&)
stress/rest-parameter-basics.js.default: 8 0x101c65d55 bool JSC::DFG::runPhase<JSC::DFG::(anonymous namespace)::ArgumentsEliminationPhase>(JSC::DFG::Graph&)
stress/rest-parameter-basics.js.default: 9 0x101c65d25 JSC::DFG::performArgumentsElimination(JSC::DFG::Graph&)
stress/rest-parameter-basics.js.default: 10 0x101f78a80 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&)
stress/rest-parameter-basics.js.default: 11 0x101f770db JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*)
stress/rest-parameter-basics.js.default: 12 0x1020e8ae0 JSC::DFG::Worklist::ThreadBody::work()
stress/rest-parameter-basics.js.default: 13 0x102a8eaa1 WTF::AutomaticThread::start(WTF::Locker<WTF::LockBase> const&)::$_0::operator()() const
stress/rest-parameter-basics.js.default: 14 0x102a8e85d void std::__1::__invoke_void_return_wrapper<void>::__call<WTF::AutomaticThread::start(WTF::Locker<WTF::LockBase> const&)::$_0&>(WTF::AutomaticThread::start(WTF::Locker<WTF::LockBase> const&)::$_0&&&)
stress/rest-parameter-basics.js.default: 15 0x102a8e66c std::__1::__function::__func<WTF::AutomaticThread::start(WTF::Locker<WTF::LockBase> const&)::$_0, std::__1::allocator<WTF::AutomaticThread::start(WTF::Locker<WTF::LockBase> const&)::$_0>, void ()>::operator()()
stress/rest-parameter-basics.js.default: 16 0x101fe90aa std::__1::function<void ()>::operator()() const
stress/rest-parameter-basics.js.default: 17 0x102aa13be WTF::threadEntryPoint(void*)
stress/rest-parameter-basics.js.default: 18 0x102aa2e61 WTF::wtfThreadEntryPoint(void*)
stress/rest-parameter-basics.js.default: 19 0x7fff8919799d _pthread_body
stress/rest-parameter-basics.js.default: 20 0x7fff8919791a _pthread_body
stress/rest-parameter-basics.js.default: 21 0x7fff89195351 thread_start
stress/rest-parameter-basics.js.default: test_script_13721: line 2: 36143 Segmentation fault: 11 ( "$@" ../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --useFunctionDotArguments\=true --maxPerThreadStackUsage\=1572864 --useFTLJIT\=true rest-parameter-basics.js )
stress/rest-parameter-basics.js.default: ERROR: Unexpected exit code: 139
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Ryan Haddad
** The following JSC stress test failures have been introduced:
microbenchmarks/rest-parameter-allocation-elimination.js.default
microbenchmarks/rest-parameter-allocation-elimination.js.ftl-eager
microbenchmarks/rest-parameter-allocation-elimination.js.ftl-eager-no-cjit
microbenchmarks/rest-parameter-allocation-elimination.js.ftl-no-cjit-no-inline-validate
microbenchmarks/rest-parameter-allocation-elimination.js.ftl-no-cjit-no-put-stack-validate
microbenchmarks/rest-parameter-allocation-elimination.js.ftl-no-cjit-small-pool
microbenchmarks/rest-parameter-allocation-elimination.js.ftl-no-cjit-validate-sampling-profiler
microbenchmarks/rest-parameter-construction-performance.js.default
microbenchmarks/rest-parameter-construction-performance.js.ftl-eager
microbenchmarks/rest-parameter-construction-performance.js.ftl-eager-no-cjit
microbenchmarks/rest-parameter-construction-performance.js.ftl-no-cjit-no-put-stack-validate
microbenchmarks/rest-parameter-construction-performance.js.ftl-no-cjit-small-pool
microbenchmarks/rest-parameter-construction-performance.js.ftl-no-cjit-validate-sampling-profiler
stress/proxy-call.js.ftl-eager-no-cjit
stress/proxy-construct.js.ftl-eager-no-cjit
stress/rest-parameter-basics.js.default
stress/rest-parameter-basics.js.ftl-eager
stress/rest-parameter-basics.js.ftl-eager-no-cjit
stress/rest-parameter-basics.js.ftl-no-cjit-no-inline-validate
stress/rest-parameter-basics.js.ftl-no-cjit-no-put-stack-validate
stress/rest-parameter-basics.js.ftl-no-cjit-small-pool
stress/rest-parameter-basics.js.ftl-no-cjit-validate-sampling-profiler
stress/rest-parameter-is-destructuring.js.ftl-eager-no-cjit
stress/rest-parameter-various-types.js.default
stress/rest-parameter-various-types.js.ftl-eager
stress/rest-parameter-various-types.js.ftl-eager-no-cjit
stress/rest-parameter-various-types.js.ftl-no-cjit-no-put-stack-validate
stress/rest-parameter-various-types.js.ftl-no-cjit-validate-sampling-profiler
Ryan Haddad
Started with https://trac.webkit.org/changeset/208208
Ryan Haddad
*** This bug has been marked as a duplicate of bug 164276 ***