Summary: | REGRESSION (r75289): Assertion failure in JSC::Heap::destroy() when running JS tests | ||
---|---|---|---|
Product: | WebKit | Reporter: | Adam Roben (:aroben) <aroben> |
Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> |
Status: | RESOLVED FIXED | ||
Severity: | Normal | CC: | barraclough, ggaren, msaboff, oliver |
Priority: | P2 | Keywords: | InRadar, LayoutTestFailure, PlatformOnly |
Version: | 528+ (Nightly build) | ||
Hardware: | PC | ||
OS: | Windows XP | ||
URL: | http://build.webkit.org/builders/Windows%20XP%20Debug%20%28Tests%29/builds/24054/steps/jscore-test/logs/stdio |
Is there any way to skip JS tests? Looks like run-javascriptcore-tests has support for skipping tests. (In reply to comment #5) > Maybe this was caused by r75289? I would guess so, rather than disabling those tests, i think it would be better to rollout that patch. Yes, please roll out the offending patch. (...and re-enable the tests.) I don't know what the offending patch is yet. I'm testing r75289 now. Rolling out r75289 fixes the assertions. :-( |
To reproduce: 1. run-javascriptcore-tests Three tests will hit an assertion. The tests are: js1_5/Regress/regress-152646.js js1_5/Regress/regress-192414.js js1_5/Regress/regress-96526-002.js The assertion is in Heap::destroy. It is: ASSERT(!m_globalData->dynamicGlobalObject); m_globalData->dynamicGlobalObject seems always to be 0x01500000. Here's the backtrace: > JavaScriptCore.dll!JSC::Heap::destroy() Line 90 + 0x28 bytes C++ jsc.exe!cleanupGlobalData(JSC::JSGlobalData * globalData=0x00f2be88) Line 364 C++ jsc.exe!main(int argc=6, char * * argv=0x00cfed00) Line 356 + 0x9 bytes C++ jsc.exe!__tmainCRTStartup() Line 597 + 0x17 bytes C kernel32.dll!_BaseProcessStart@4() + 0x23 bytes