|Summary:||REGRESSION(r223691): Broke Speedometer 2 React-Redux-TodoMVC test case (Requested by rniwa on #webkit).|
|Product:||WebKit||Reporter:||WebKit Commit Bot <commit-queue>|
|Component:||New Bugs||Assignee:||Robin Morisset <rmorisset>|
|Severity:||Normal||CC:||rmorisset, rniwa, ryanhaddad, sbarati|
|Version:||WebKit Nightly Build|
|Bug Depends on:|
Description WebKit Commit Bot 2017-10-25 15:11:47 PDT
https://trac.webkit.org/changeset/223691 broke the build: Broke Speedometer 2 React-Redux-TodoMVC test case (Requested by rniwa on #webkit). This is an automatic bug report generated by webkitbot. If this bug report was created because of a flaky test, please file a bug for the flaky test (if we don't already have one on file) and dup this bug against that bug so that we can track how often these flaky tests fail.
Comment 1 WebKit Commit Bot 2017-10-25 15:11:56 PDT
Created attachment 324905 [details] ROLLOUT of r223691 Any committer can land this patch automatically by marking it commit-queue+. The commit-queue will build and test the patch before landing to ensure that the rollout will be successful. This process takes approximately 15 minutes. If you would like to land the rollout faster, you can use the following command: webkit-patch land-attachment ATTACHMENT_ID where ATTACHMENT_ID is the ID of this attachment.
Comment 2 WebKit Commit Bot 2017-10-25 15:15:43 PDT
Comment on attachment 324905 [details] ROLLOUT of r223691 Clearing flags on attachment: 324905 Committed r223989: <https://trac.webkit.org/changeset/223989>
Comment 3 WebKit Commit Bot 2017-10-25 15:15:45 PDT
All reviewed patches have been landed. Closing bug.
Comment 4 Ryosuke Niwa 2017-10-25 15:19:13 PDT
*** Bug 178820 has been marked as a duplicate of this bug. ***
Comment 5 Robin Morisset 2017-11-06 04:37:05 PST
With sbarati and fpizlo, we found the origin of this problem: the bug is actually in DFGByteCodeParser.cpp::flush(InlineStackEntry *) and was only made visible in Speedometer by my optimization. The bug is in the following two lines: ``` if (!inlineStackEntry->m_inlineCallFrame && m_graph.needsFlushedThis()) flushDirect(virtualRegisterForArgument(0)); ``` It causes 'this' not to be correctly preserved for OSR exit in some corner cases. It is fixed by adding the following just afterwards: ``` else phantomLocalDirect(virtualRegisterForArgument(0)); ``` I will upload a fix on this bug as soon as I manage to write a minimized test case that triggers without my optimization.
Comment 6 Robin Morisset 2017-11-08 12:14:25 PST
I thought I would do this as a separate patch, but as I could not build a regression test that does not use https://bugs.webkit.org/show_bug.cgi?id=176601, I decided to merge the two bugs together. *** This bug has been marked as a duplicate of bug 176601 ***