Bug 210507

Summary: [Catalina JSC Debug] Multiple stress/typed-array-subarray-can-throw-oom-error.js are timing out.
Product: WebKit Reporter: Matt Lewis <jlewis3>
Component: JavaScriptCoreAssignee: Yusuke Suzuki <ysuzuki>
Status: RESOLVED FIXED    
Severity: Normal CC: mark.lam, ryanhaddad, tsavell, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=209974

Description Matt Lewis 2020-04-14 11:27:37 PDT 
Multiple stress/typed-array-subarray-can-throw-oom-error.js are timing out on Catalina JSC Debug testers. It looks like these have been timing out since being added in : https://trac.webkit.org/changeset/259478/webkit
tests:
        stress/typed-array-subarray-can-throw-oom-error.js.bytecode-cache
	stress/typed-array-subarray-can-throw-oom-error.js.default
	stress/typed-array-subarray-can-throw-oom-error.js.dfg-eager
	stress/typed-array-subarray-can-throw-oom-error.js.dfg-eager-no-cjit-validate
	stress/typed-array-subarray-can-throw-oom-error.js.eager-jettison-no-cjit
	stress/typed-array-subarray-can-throw-oom-error.js.ftl-eager
	stress/typed-array-subarray-can-throw-oom-error.js.ftl-eager-no-cjit
	stress/typed-array-subarray-can-throw-oom-error.js.ftl-eager-no-cjit-b3o1
	stress/typed-array-subarray-can-throw-oom-error.js.ftl-no-cjit-b3o0
	stress/typed-array-subarray-can-throw-oom-error.js.ftl-no-cjit-no-inline-validate
	stress/typed-array-subarray-can-throw-oom-error.js.ftl-no-cjit-no-put-stack-validate
	stress/typed-array-subarray-can-throw-oom-error.js.ftl-no-cjit-small-pool
	stress/typed-array-subarray-can-throw-oom-error.js.ftl-no-cjit-validate-sampling-profiler
	stress/typed-array-subarray-can-throw-oom-error.js.mini-mode
	stress/typed-array-subarray-can-throw-oom-error.js.no-cjit-validate-phases
	stress/typed-array-subarray-can-throw-oom-error.js.no-ftl
	stress/typed-array-subarray-can-throw-oom-error.js.no-llint

the test all have a similar backtrace:
Timed out after 587.000000 sec seconds!
1   0x109dd7c39 WTFCrash
2   0x109c7d117 timeoutCheckCallback(JSC::VM&)
3   0x10b7f7c8d JSC::VMTraps::handleTraps(JSC::JSGlobalObject*, JSC::CallFrame*, JSC::VMTraps::Mask)
4   0x10b10b8db JSC::VM::handleTraps(JSC::JSGlobalObject*, JSC::CallFrame*, JSC::VMTraps::Mask)
5   0x10b10c0c9 JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
6   0x10b432109 JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
7   0x10b503cd2 JSC::callGetter(JSC::JSGlobalObject*, JSC::JSValue, JSC::JSValue)
8   0x10b71b594 JSC::PropertySlot::functionGetter(JSC::JSGlobalObject*) const
9   0x10b557c0c JSC::PropertySlot::getValue(JSC::JSGlobalObject*, unsigned int) const
10  0x10b3d4abe JSC::JSObject::get(JSC::JSGlobalObject*, unsigned int) const
11  0x10adad503 JSC::JSGenericTypedArrayView<JSC::Int16Adaptor>::set(JSC::JSGlobalObject*, unsigned int, JSC::JSObject*, unsigned int, unsigned int, JSC::CopyType)
12  0x10ad1bace JSC::JSObject* JSC::constructGenericTypedArrayViewWithArguments<JSC::JSGenericTypedArrayView<JSC::Int16Adaptor> >(JSC::JSGlobalObject*, JSC::Structure*, long long, unsigned int, WTF::Optional<unsigned int>)
13  0x10b5cc421 long long JSC::constructGenericTypedArrayView<JSC::JSGenericTypedArrayView<JSC::Int16Adaptor> >(JSC::JSGlobalObject*, JSC::CallFrame*)
14  0x491596e010c7
15  0x491596e0dbc6
16  0x10a2ec3c3 vmEntryToJavaScript
17  0x10b10bd27 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
18  0x10b10c49f JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
19  0x10b432109 JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
20  0x10b503cd2 JSC::callGetter(JSC::JSGlobalObject*, JSC::JSValue, JSC::JSValue)
21  0x10b71b594 JSC::PropertySlot::functionGetter(JSC::JSGlobalObject*) const
22  0x10b557c0c JSC::PropertySlot::getValue(JSC::JSGlobalObject*, unsigned int) const
23  0x10b3d4abe JSC::JSObject::get(JSC::JSGlobalObject*, unsigned int) const
24  0x10adad503 JSC::JSGenericTypedArrayView<JSC::Int16Adaptor>::set(JSC::JSGlobalObject*, unsigned int, JSC::JSObject*, unsigned int, unsigned int, JSC::CopyType)
25  0x10ad1bace JSC::JSObject* JSC::constructGenericTypedArrayViewWithArguments<JSC::JSGenericTypedArrayView<JSC::Int16Adaptor> >(JSC::JSGlobalObject*, JSC::Structure*, long long, unsigned int, WTF::Optional<unsigned int>)
26  0x10b5cc421 long long JSC::constructGenericTypedArrayView<JSC::JSGenericTypedArrayView<JSC::Int16Adaptor> >(JSC::JSGlobalObject*, JSC::CallFrame*)
27  0x491596e010c7
28  0x491596e0dbc6
29  0x10a2ec3c3 vmEntryToJavaScript
30  0x10b10bd27 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
31  0x10b10c49f JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
test_script_98: line 2: 45245 Segmentation fault: 11  ( "$@" ../../.vm/JavaScriptCore.framework/Helpers/jsc --useFTLJIT\=false --useFunctionDotArguments\=true --validateExceptionChecks\=true --useDollarVM\=true --maxPerThreadStackUsage\=1572864 --jitMemoryReservationSize\=50000 --useFTLJIT\=true --useConcurrentJIT\=false --thresholdForJITAfterWarmUp\=100 --scribbleFreeCells\=true typed-array-subarray-can-throw-oom-error.js )
ERROR: Unexpected exit code: 139

https://build.webkit.org/builders/Apple-Catalina-Debug-JSC-Tests/builds/679/steps/jscore-test/logs/stdio
https://build.webkit.org/builders/Apple-Catalina-Debug-JSC-Tests/builds/679
Comment 1 Radar WebKit Bug Importer 2020-04-14 11:28:12 PDT 
<rdar://problem/61781787>
Comment 3 Yusuke Suzuki 2020-04-14 12:09:35 PDT 
Committed r260087: <https://trac.webkit.org/changeset/260087>