Bug 195892

Summary:	REGRESSION: (r243032) inspector/model/remote-object.html is failing.
Product:	WebKit	Reporter:	Truitt Savell <tsavell>
Component:	Tools / Tests	Assignee:	Mark Lam <mark.lam>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	fpizlo, jlewis3, keith_miller, lforschler, msaboff, rmorisset, ryanhaddad, saam, tzagallo, webkit-bug-importer, ysuzuki
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified
See Also:	https://bugs.webkit.org/show_bug.cgi?id=196008

Description Truitt Savell 2019-03-18 09:27:51 PDT

The following layout test is failing on Mac

inspector/model/remote-object.html

Probable cause:

This test began failing near constantly after changes in https://trac.webkit.org/changeset/243032/webkit. 

Flakiness Dashboard:

https://webkit-test-results.webkit.org/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=inspector%2Fmodel%2Fremote-object.html

Diff:
https://build.webkit.org/results/Apple%20High%20Sierra%20Release%20WK1%20(Tests)/r243062%20(11965)/inspector/model/remote-object-diff.txt

I was able to reproduce this locally with command:
run-webkit-tests inspector/model/remote-object.html --iterations 100 -f

it fails often on 242032 but passes on 242031.

Comment 1 Truitt Savell 2019-03-18 09:30:58 PDT

marked failing in https://trac.webkit.org/changeset/243071/webkit until mark can fix this.

Comment 2 Radar WebKit Bug Importer 2019-03-18 09:40:54 PDT

<rdar://problem/48981239>

Comment 3 Mark Lam 2019-03-21 10:10:43 PDT

Also from https://bugs.webkit.org/show_bug.cgi?id=195827#c8:

It appears that changes in https://trac.webkit.org/changeset/243032

Are causing a JSC failure on the Debug queue

microbenchmarks/data-view-accesses-2.js.ftl-no-cjit-small-pool

https://build.webkit.org/builders/Apple%20High%20Sierra%20Debug%20JSC%20%28Tests%29/builds/2348/steps/jscore-test/logs/stdio

Regression range is 243030 to 243033

Comment 4 Mark Lam 2019-03-23 21:11:37 PDT

From the rollout ChangeLog:

The fix is incorrect: it relies on being able to determine liveness of an object in an ObjectPropertyCondition based on the state of the object's MarkedBit.  However, there's no guarantee that GC has run and that the MarkedBit is already set even if the object is live.  As a result, we may not re-install adaptive watchpoints based on presumed dead objects which are actually live.

I'm rolling this out, and will implement a more comprehensive fix to handle watchpoint liveness later.

Comment 5 Mark Lam 2019-03-23 21:12:08 PDT

*** Bug 196008 has been marked as a duplicate of this bug. ***

Comment 6 Mark Lam 2019-03-23 21:16:47 PDT

The rollout was landed in r243420: <http://trac.webkit.org/r243420>.