Bug 210507

Summary: [Catalina JSC Debug] Multiple stress/typed-array-subarray-can-throw-oom-error.js are timing out.
Product: WebKit Reporter: Matt Lewis <jlewis3>
Component: JavaScriptCoreAssignee: Yusuke Suzuki <ysuzuki>
Status: RESOLVED FIXED    
Severity: Normal CC: mark.lam, ryanhaddad, tsavell, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=209974

Matt Lewis
Reported 2020-04-14 11:27:37 PDT
Multiple stress/typed-array-subarray-can-throw-oom-error.js are timing out on Catalina JSC Debug testers. It looks like these have been timing out since being added in : https://trac.webkit.org/changeset/259478/webkit tests: stress/typed-array-subarray-can-throw-oom-error.js.bytecode-cache stress/typed-array-subarray-can-throw-oom-error.js.default stress/typed-array-subarray-can-throw-oom-error.js.dfg-eager stress/typed-array-subarray-can-throw-oom-error.js.dfg-eager-no-cjit-validate stress/typed-array-subarray-can-throw-oom-error.js.eager-jettison-no-cjit stress/typed-array-subarray-can-throw-oom-error.js.ftl-eager stress/typed-array-subarray-can-throw-oom-error.js.ftl-eager-no-cjit stress/typed-array-subarray-can-throw-oom-error.js.ftl-eager-no-cjit-b3o1 stress/typed-array-subarray-can-throw-oom-error.js.ftl-no-cjit-b3o0 stress/typed-array-subarray-can-throw-oom-error.js.ftl-no-cjit-no-inline-validate stress/typed-array-subarray-can-throw-oom-error.js.ftl-no-cjit-no-put-stack-validate stress/typed-array-subarray-can-throw-oom-error.js.ftl-no-cjit-small-pool stress/typed-array-subarray-can-throw-oom-error.js.ftl-no-cjit-validate-sampling-profiler stress/typed-array-subarray-can-throw-oom-error.js.mini-mode stress/typed-array-subarray-can-throw-oom-error.js.no-cjit-validate-phases stress/typed-array-subarray-can-throw-oom-error.js.no-ftl stress/typed-array-subarray-can-throw-oom-error.js.no-llint the test all have a similar backtrace: Timed out after 587.000000 sec seconds! 1 0x109dd7c39 WTFCrash 2 0x109c7d117 timeoutCheckCallback(JSC::VM&) 3 0x10b7f7c8d JSC::VMTraps::handleTraps(JSC::JSGlobalObject*, JSC::CallFrame*, JSC::VMTraps::Mask) 4 0x10b10b8db JSC::VM::handleTraps(JSC::JSGlobalObject*, JSC::CallFrame*, JSC::VMTraps::Mask) 5 0x10b10c0c9 JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 6 0x10b432109 JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 7 0x10b503cd2 JSC::callGetter(JSC::JSGlobalObject*, JSC::JSValue, JSC::JSValue) 8 0x10b71b594 JSC::PropertySlot::functionGetter(JSC::JSGlobalObject*) const 9 0x10b557c0c JSC::PropertySlot::getValue(JSC::JSGlobalObject*, unsigned int) const 10 0x10b3d4abe JSC::JSObject::get(JSC::JSGlobalObject*, unsigned int) const 11 0x10adad503 JSC::JSGenericTypedArrayView<JSC::Int16Adaptor>::set(JSC::JSGlobalObject*, unsigned int, JSC::JSObject*, unsigned int, unsigned int, JSC::CopyType) 12 0x10ad1bace JSC::JSObject* JSC::constructGenericTypedArrayViewWithArguments<JSC::JSGenericTypedArrayView<JSC::Int16Adaptor> >(JSC::JSGlobalObject*, JSC::Structure*, long long, unsigned int, WTF::Optional<unsigned int>) 13 0x10b5cc421 long long JSC::constructGenericTypedArrayView<JSC::JSGenericTypedArrayView<JSC::Int16Adaptor> >(JSC::JSGlobalObject*, JSC::CallFrame*) 14 0x491596e010c7 15 0x491596e0dbc6 16 0x10a2ec3c3 vmEntryToJavaScript 17 0x10b10bd27 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) 18 0x10b10c49f JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 19 0x10b432109 JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 20 0x10b503cd2 JSC::callGetter(JSC::JSGlobalObject*, JSC::JSValue, JSC::JSValue) 21 0x10b71b594 JSC::PropertySlot::functionGetter(JSC::JSGlobalObject*) const 22 0x10b557c0c JSC::PropertySlot::getValue(JSC::JSGlobalObject*, unsigned int) const 23 0x10b3d4abe JSC::JSObject::get(JSC::JSGlobalObject*, unsigned int) const 24 0x10adad503 JSC::JSGenericTypedArrayView<JSC::Int16Adaptor>::set(JSC::JSGlobalObject*, unsigned int, JSC::JSObject*, unsigned int, unsigned int, JSC::CopyType) 25 0x10ad1bace JSC::JSObject* JSC::constructGenericTypedArrayViewWithArguments<JSC::JSGenericTypedArrayView<JSC::Int16Adaptor> >(JSC::JSGlobalObject*, JSC::Structure*, long long, unsigned int, WTF::Optional<unsigned int>) 26 0x10b5cc421 long long JSC::constructGenericTypedArrayView<JSC::JSGenericTypedArrayView<JSC::Int16Adaptor> >(JSC::JSGlobalObject*, JSC::CallFrame*) 27 0x491596e010c7 28 0x491596e0dbc6 29 0x10a2ec3c3 vmEntryToJavaScript 30 0x10b10bd27 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) 31 0x10b10c49f JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) test_script_98: line 2: 45245 Segmentation fault: 11 ( "$@" ../../.vm/JavaScriptCore.framework/Helpers/jsc --useFTLJIT\=false --useFunctionDotArguments\=true --validateExceptionChecks\=true --useDollarVM\=true --maxPerThreadStackUsage\=1572864 --jitMemoryReservationSize\=50000 --useFTLJIT\=true --useConcurrentJIT\=false --thresholdForJITAfterWarmUp\=100 --scribbleFreeCells\=true typed-array-subarray-can-throw-oom-error.js ) ERROR: Unexpected exit code: 139 https://build.webkit.org/builders/Apple-Catalina-Debug-JSC-Tests/builds/679/steps/jscore-test/logs/stdio https://build.webkit.org/builders/Apple-Catalina-Debug-JSC-Tests/builds/679
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2020-04-14 11:28:12 PDT
<rdar://problem/61781787>
Yusuke Suzuki
Comment 3 2020-04-14 12:09:35 PDT
Committed r260087: <https://trac.webkit.org/changeset/260087>
Note You need to log in before you can comment on or make changes to this bug.