Bug 191271 – Multiple stress/regexp-compile-oom.js tests are failing on High Sierra Debug and Release JSC testers.

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Matt Lewis]

the JSC test stress/regexp-compile-oom.js.dfg-maximal-flush-validate-no-cjit on JSC release High Sierra nd about 15 failures on Debug as well:
	stress/regexp-compile-oom.js.default
	stress/regexp-compile-oom.js.dfg-eager
	stress/regexp-compile-oom.js.dfg-eager-no-cjit-validate
	stress/regexp-compile-oom.js.dfg-maximal-flush-validate-no-cjit
	stress/regexp-compile-oom.js.ftl-eager
	stress/regexp-compile-oom.js.ftl-eager-no-cjit
	stress/regexp-compile-oom.js.ftl-eager-no-cjit-b3o1
	stress/regexp-compile-oom.js.ftl-no-cjit-b3o1
	stress/regexp-compile-oom.js.ftl-no-cjit-no-inline-validate
	stress/regexp-compile-oom.js.ftl-no-cjit-no-put-stack-validate
	stress/regexp-compile-oom.js.ftl-no-cjit-small-pool
	stress/regexp-compile-oom.js.ftl-no-cjit-validate-sampling-profiler
	stress/regexp-compile-oom.js.no-cjit-validate-phases
	stress/regexp-compile-oom.js.no-ftl
	stress/regexp-compile-oom.js.no-llint


https://build.webkit.org/builders/Apple%20High%20Sierra%20Release%20JSC%20%28Tests%29/builds/6416/steps/jscore-test/logs/stdio
https://build.webkit.org/builders/Apple%20High%20Sierra%20Debug%20JSC%20%28Tests%29/builds/1687/steps/jscore-test/logs/stdio


This happened after:
https://trac.webkit.org/changeset/237763/webkit

Example assertion failure
 ASSERTION FAILED: !m_needExceptionCheck
stress/regexp-compile-oom.js.default: ./runtime/VM.cpp(1211) : void JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation &)
stress/regexp-compile-oom.js.default: 1   0x102b1d4a9 WTFCrash
stress/regexp-compile-oom.js.default: 2   0x102b1e3ab WTFCrashWithInfo(int, char const*, char const*, int)
stress/regexp-compile-oom.js.default: 3   0x1041b8cab JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation&)
stress/regexp-compile-oom.js.default: 4   0x1041911cd JSC::ThrowScope::~ThrowScope()
stress/regexp-compile-oom.js.default: 5   0x104191635 JSC::ThrowScope::~ThrowScope()
stress/regexp-compile-oom.js.default: 6   0x1038c22f4 JSC::RegExpObject::matchInline(JSC::ExecState*, JSC::JSGlobalObject*, JSC::JSString*)
stress/regexp-compile-oom.js.default: 7   0x104124e5d JSC::RegExpObject::match(JSC::ExecState*, JSC::JSGlobalObject*, JSC::JSString*)
stress/regexp-compile-oom.js.default: 8   0x1038a732d JSC::RegExpObject::test(JSC::ExecState*, JSC::JSGlobalObject*, JSC::JSString*)
stress/regexp-compile-oom.js.default: 9   0x104128a7a JSC::regExpProtoFuncTestFast(JSC::ExecState*)
stress/regexp-compile-oom.js.default: 10  0x40e76677177
stress/regexp-compile-oom.js.default: 11  0x102fd77f3 llint_entry
stress/regexp-compile-oom.js.default: 12  0x40eb6676cb7
stress/regexp-compile-oom.js.default: 13  0x40eb6676644
stress/regexp-compile-oom.js.default: 14  0x40eb6676644
stress/regexp-compile-oom.js.default: 15  0x40eb6676644
stress/regexp-compile-oom.js.default: 16  0x40eb6676644
stress/regexp-compile-oom.js.default: 17  0x40eb6676644
stress/regexp-compile-oom.js.default: 18  0x40eb6676644
stress/regexp-compile-oom.js.default: 19  0x40eb6676644
stress/regexp-compile-oom.js.default: 20  0x40eb6676644
stress/regexp-compile-oom.js.default: 21  0x40eb6676644
stress/regexp-compile-oom.js.default: 22  0x40eb6676644
stress/regexp-compile-oom.js.default: 23  0x40eb6676644
stress/regexp-compile-oom.js.default: 24  0x40eb6676644
stress/regexp-compile-oom.js.default: 25  0x40eb6676644
stress/regexp-compile-oom.js.default: 26  0x40eb6676644
stress/regexp-compile-oom.js.default: 27  0x40eb6676644
stress/regexp-compile-oom.js.default: 28  0x40eb6676644
stress/regexp-compile-oom.js.default: 29  0x40eb6676644
stress/regexp-compile-oom.js.default: 30  0x40eb6676644
stress/regexp-compile-oom.js.default: 31  0x40eb6676644

[Guillaume Emont]

Also fails on a bunch of our linux bots:
 - WPE Linux 64-bit Debug (Tests)
 - GTK Linux 64-bit Release Wayland (Tests)
 - GTK Linux 64-bit Release (Tests)
 - GTK Linux 64-bit Debug (Tests)
 - JSCOnly Linux MIPS32el Release
 - JSCOnly Linux ARMv7 Thumb2 Release
 - JSCOnly Linux ARMv7 Thumb2 SoftFP Release

[Michael Saboff]

Patch in the works.

[Michael Saboff]

<rdar://problem/39316988>

[Michael Saboff]

Created attachment 353926 [details]
Patch

[Saam Barati]

Comment on attachment 353926 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=353926&action=review

r=me

> JSTests/ChangeLog:8
> +        Added more test cases and made all test cases runn with the same deeply recursive stack

Typo: runn

> Source/JavaScriptCore/runtime/RegExpPrototype.cpp:502
> +    RETURN_IF_EXCEPTION(scope, encodedJSValue());

Maybe just release the scope before the above call since this is the last thing? That way we avoid the branch

[Michael Saboff]

(In reply to Saam Barati from comment #5)
> Comment on attachment 353926 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=353926&action=review
> 
> r=me
> 
> > JSTests/ChangeLog:8
> > +        Added more test cases and made all test cases runn with the same deeply recursive stack
> 
> Typo: runn

Fixed.

> > Source/JavaScriptCore/runtime/RegExpPrototype.cpp:502
> > +    RETURN_IF_EXCEPTION(scope, encodedJSValue());
> 
> Maybe just release the scope before the above call since this is the last
> thing? That way we avoid the branch

This is here because code called by RegExpConstructor::performMatch() can throw an exception.

[Michael Saboff]

Committed r237877: <https://trac.webkit.org/changeset/237877>