Bug 230215
| Summary: | [JSC][32bit] Crash in stress/has-own-property-name-cache-symbols-and-strings.js, not enough registers | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Xan Lopez <xan.lopez> |
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED DUPLICATE | ||
| Severity: | Normal | CC: | mikhail, xan.lopez, ysuzuki |
| Priority: | P2 | ||
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Xan Lopez
Starting program: /home/igalia/xlopez/WebKit/WebKitBuild/Debug/bin/jsc -f JSTests/stress/has-own-property-name-cache-symbols-and-strings.js
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/arm-linux-gnueabihf/libthread_db.so.1".
[New Thread 0xf3fb8440 (LWP 17334)]
Thread 1 "jsc" received signal SIGABRT, Aborted.
__libc_do_syscall () at ../sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:47
47 ../sysdeps/unix/sysv/linux/arm/libc-do-syscall.S: No such file or directory.
(gdb) bt
#0 __libc_do_syscall () at ../sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:47
#1 0xf5e6dea0 in __libc_signal_restore_set (set=0xfffed31c) at ../sysdeps/unix/sysv/linux/internal-signals.h:86
#2 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:48
#3 0xf5e5e7a2 in __GI_abort () at abort.c:79
#4 0xf6cc52ac in JSC::ScratchRegisterAllocator::allocateScratch<JSC::GPRInfo> (this=0xfffed640) at ../../Source/JavaScriptCore/jit/ScratchRegisterAllocator.cpp:97
#5 0xf6cbc10c in JSC::ScratchRegisterAllocator::allocateScratchGPR (this=0xfffed640) at ../../Source/JavaScriptCore/jit/ScratchRegisterAllocator.cpp:102
#6 0xf62d1ce0 in JSC::AccessCase::generateImpl (this=0xf3699300, state=...) at ../../Source/JavaScriptCore/bytecode/AccessCase.cpp:2276
#7 0xf62cfc4a in JSC::AccessCase::generateWithGuard (this=0xf3699300, state=..., fallThrough=...) at ../../Source/JavaScriptCore/bytecode/AccessCase.cpp:1755
#8 0xf63afcea in JSC::PolymorphicAccess::regenerate (this=0xf369cf20, locker=..., vm=..., globalObject=0xf20f9038, codeBlock=0xf1eac000, ecmaMode=..., stubInfo=...)
at ../../Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp:672
#9 0xf63d7d34 in operator() (__closure=0xfffeec94) at ../../Source/JavaScriptCore/bytecode/StructureStubInfo.cpp:221
#10 0xf63d7e8e in JSC::StructureStubInfo::addAccessCase (this=0xf36f6948, locker=..., globalObject=0xf20f9038, codeBlock=0xf1eac000, ecmaMode=..., ident=...,
accessCase=...) at ../../Source/JavaScriptCore/bytecode/StructureStubInfo.cpp:245
#11 0xf6cb774a in JSC::tryCachePutBy (globalObject=0xf20f9038, codeBlock=0xf1eac000, baseValue=..., oldStructure=0xf1e9caf0, propertyName=..., slot=..., stubInfo=...,
putByKind=JSC::PutByKind::ByVal, putKind=JSC::PutKind::NotDirect) at ../../Source/JavaScriptCore/jit/Repatch.cpp:877
#12 0xf6cb790a in JSC::repatchPutBy (globalObject=0xf20f9038, codeBlock=0xf1eac000, baseValue=..., oldStructure=0xf1e9caf0, propertyName=..., slot=..., stubInfo=...,
putByKind=JSC::PutByKind::ByVal, putKind=JSC::PutKind::NotDirect) at ../../Source/JavaScriptCore/jit/Repatch.cpp:897
#13 0xf6c5b34c in JSC::putByValOptimize (globalObject=0xf20f9038, codeBlock=0xf1eac000, baseValue=..., subscript=..., value=..., stubInfo=0xf36f6948, profile=0xf20f6e48,
ecmaMode=...) at ../../Source/JavaScriptCore/jit/JITOperations.cpp:1055
#14 0xf6c5b4fe in JSC::operationPutByValNonStrictOptimize (globalObject=0xf20f9038, encodedBaseValue=-17416011584, encodedSubscript=-17415806032, encodedValue=-4294967271,
stubInfo=0xf36f6948, profile=0xf20f6e48) at ../../Source/JavaScriptCore/jit/JITOperations.cpp:1087
#15 0xf35fd662 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb)
Probably also introduced by bug #229229.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Xan Lopez
*** This bug has been marked as a duplicate of bug 230241 ***