Bug 197756

Summary:

testb3 failing with crash in JSC::B3::BasicBlock::appendNonTerminal

Product:

WebKit

Reporter:

Ryan Haddad <ryanhaddad>

Component:

JavaScriptCore

Assignee:

Robin Morisset <rmorisset>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

ap, commit-queue, ews-watchlist, keith_miller, mark.lam, msaboff, rmorisset, saam, webkit-bot-watchers-bugzilla, webkit-bug-importer

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Bug Depends on:

197265

Bug Blocks:

Attachments:

Description	Flags
crash log	none
Patch	none

Ryan Haddad

Reported 2019-05-09 15:45:17 PDT

Created attachment 369526 [details] crash log While looking at https://build.webkit.org/builders/Apple%20High%20Sierra%20Release%20JSC%20%28Tests%29/builds/9309/steps/jscore-test/logs/stdio I noticed that testb3 completed with rc=11 I found the following crash on the bot: Thread 7 Crashed:: testb3 thread 0 com.apple.JavaScriptCore 0x0000000105b1e6e6 JSC::B3::BasicBlock::appendNonTerminal(JSC::B3::Value*) + 70 1 com.apple.JavaScriptCore 0x0000000105b8a28a JSC::B3::(anonymous namespace)::ReduceStrength::reduceValueStrength() + 730 (B3ReduceStrength.cpp:2165) 2 com.apple.JavaScriptCore 0x0000000105b885d0 JSC::B3::reduceStrength(JSC::B3::Procedure&) + 1424 (B3ReduceStrength.cpp:468) 3 com.apple.JavaScriptCore 0x0000000105b38763 JSC::B3::generateToAir(JSC::B3::Procedure&) + 195 (B3Generate.cpp:89) 4 com.apple.JavaScriptCore 0x0000000105b38680 JSC::B3::prepareForGeneration(JSC::B3::Procedure&) + 48 (B3Generate.cpp:63) 5 com.apple.JavaScriptCore 0x0000000105b236fa JSC::B3::compile(JSC::B3::Procedure&) + 74 (B3Compile.cpp:47) 6 testb3 0x0000000104b51034 (anonymous namespace)::compileProc(JSC::B3::Procedure&, unsigned int) + 68 (testb3.cpp:129) 7 testb3 0x0000000104d924e6 (anonymous namespace)::testCheckSelect() + 982 (testb3.cpp:12759) 8 testb3 0x0000000104d920d8 (anonymous namespace)::run(char const*)::$_1360::operator()() const + 56 (testb3.cpp:18435) 9 testb3 0x0000000104d92079 WTF::SharedTaskFunctor<void (), (anonymous namespace)::run(char const*)::$_1360>::run() + 25 (SharedTas k.h:91) 10 testb3 0x0000000104e4b748 (anonymous namespace)::run(char const*)::$_1623::operator()() const + 408 (testb3.cpp:18758) 11 testb3 0x0000000104e4b539 WTF::Detail::CallableWrapper<(anonymous namespace)::run(char const*)::$_1623, void>::call() + 25 (Funct ion.h:52) 12 com.apple.JavaScriptCore 0x000000010589cdf4 WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) + 212 (Threading.cpp:149) 13 com.apple.JavaScriptCore 0x000000010589ef49 WTF::wtfThreadEntryPoint(void*) + 9 (ThreadingPOSIX.cpp:201) 14 libsystem_pthread.dylib 0x00007fff79090661 _pthread_body + 340 15 libsystem_pthread.dylib 0x00007fff7909050d _pthread_start + 377 16 libsystem_pthread.dylib 0x00007fff7908fbf9 thread_start + 13

Attachments
crash log (58.75 KB, text/plain) 2019-05-09 15:45 PDT, Ryan Haddad	no flags	Details
Patch (2.43 KB, patch) 2019-05-10 13:07 PDT, Robin Morisset	no flags	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2019-05-09 15:45:42 PDT

<rdar://problem/50641659>

Ryan Haddad

Comment 2 2019-05-09 15:47:11 PDT

I don't know when this regressed.

Robin Morisset

Comment 3 2019-05-10 13:00:45 PDT

*** Bug 197792 has been marked as a duplicate of this bug. ***

Robin Morisset

Comment 4 2019-05-10 13:07:13 PDT

Created attachment 369586 [details] Patch

WebKit Commit Bot

Comment 5 2019-05-10 13:37:12 PDT

Comment on attachment 369586 [details] Patch Clearing flags on attachment: 369586 Committed r245192: <https://trac.webkit.org/changeset/245192>

WebKit Commit Bot

Comment 6 2019-05-10 13:37:14 PDT

All reviewed patches have been landed. Closing bug.

Note You need to log in before you can comment on or make changes to this bug.