Bug 71505 – Showing the data overlay in OpenStreetMap doesn't work, zooming partially broken

• Component: New Bugs
• Status: RESOLVED FIXED

For Version 5.1.1 (6534.51.22, r98912) OpenStreetMap is somewhat broken:

1. showing the data overlay doesn't work:
  - on the right side of http://www.openstreetmap.org/ there is a small (+) sign. 
  - When you click on this a drawer with options opens. 
  - now click onto the "data" overlay checkbox.
  -> nothing happens.
  -> check the normal release of Safari (or any other browser) to see the expected behaviour.

2. zooming into OpenStreetMap by double clicking into the map works unreliable
  - after a while the map display is either empty or no longer updated
  - reloading brings back a lower zoom level
  -> check the normal release of Safari (or any other browser) to see the expected behaviour.

r97664 is the last version to work without flaws, the next available version r98824 has the issues (up until today r100547)

[Filip Pizlo]

Seems like in debug builds of ToT (r100874) we hit the following assertion:


ASSERTION FAILED: dst != func
/Volumes/Data/pizlo/tertiary/OpenSource/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp(1840) : JSC::RegisterID *JSC::BytecodeGenerator::emitCallVarargs(JSC::RegisterID *, JSC::RegisterID *, JSC::RegisterID *, JSC::RegisterID *, JSC::RegisterID *, unsigned int, unsigned int, unsigned int)
1   0x10d947c01 JSC::BytecodeGenerator::emitCallVarargs(JSC::RegisterID*, JSC::RegisterID*, JSC::RegisterID*, JSC::RegisterID*, JSC::RegisterID*, unsigned int, unsigned int, unsigned int)
2   0x10db1b6a5 JSC::ApplyFunctionCallDotNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
3   0x10d94f278 JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::Node*)
4   0x10db1fd13 JSC::ConditionalNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
5   0x10d94f278 JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::Node*)
6   0x10db20b95 JSC::AssignResolveNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
7   0x10d94f278 JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::Node*)
8   0x10db226cd JSC::ExprStatementNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
9   0x10d94f278 JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::Node*)
10  0x10db28324 JSC::SourceElements::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
11  0x10db2251f JSC::BlockNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
12  0x10d94f278 JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::Node*)
13  0x10db22a21 JSC::IfNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
14  0x10d94f278 JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::Node*)
15  0x10db28324 JSC::SourceElements::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
16  0x10db2251f JSC::BlockNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
17  0x10d94f278 JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::Node*)
18  0x10db28324 JSC::SourceElements::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
19  0x10db28945 JSC::ScopeNode::emitStatementsBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
20  0x10db2728c JSC::FunctionBodyNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
21  0x10d93daad JSC::BytecodeGenerator::generate()
22  0x10da106cd JSC::FunctionExecutable::produceCodeBlockFor(JSC::ScopeChainNode*, JSC::CompilationKind, JSC::CodeSpecializationKind, JSC::JSObject*&)
23  0x10da0f0f6 JSC::FunctionExecutable::compileForCallInternal(JSC::ExecState*, JSC::ScopeChainNode*, JSC::JITCode::JITType)
24  0x10d92e633 JSC::FunctionExecutable::compileForCall(JSC::ExecState*, JSC::ScopeChainNode*)
25  0x10da2e2d8 JSC::Interpreter::prepareForRepeatCall(JSC::FunctionExecutable*, JSC::ExecState*, JSC::JSFunction*, int, JSC::ScopeChainNode*)
26  0x10d92caea JSC::CachedCall::CachedCall(JSC::ExecState*, JSC::JSFunction*, int)
27  0x10d92bb8b JSC::CachedCall::CachedCall(JSC::ExecState*, JSC::JSFunction*, int)
28  0x10dbbbc00 _ZN3JSCL22stringProtoFuncReplaceEPNS_9ExecStateE
29  0x21511e601218
30  0x10da30679 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*)
31  0x10da2d0f6 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)

[Filip Pizlo]

Created attachment 116018 [details]
the patch

I believe this fixes it.

[WebKit Review Bot]

Comment on attachment 116018 [details]
the patch

Clearing flags on attachment: 116018

Committed r100879: <http://trac.webkit.org/changeset/100879>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.

[Filip Pizlo]

<rdar://problem/10476342>

Sorry to rain on your parade, the bug is not fixed. Try zooming into the map at http://www.openstreetmap.org/ by double clicking the map several times in a row.

Version r100927 is still affected I wanted to say.

[Oliver Hunt]

(In reply to comment #7)
> Sorry to rain on your parade, the bug is not fixed. Try zooming into the map at http://www.openstreetmap.org/ by double clicking the map several times in a row.

Try to be polite and respectful in bug comments, being snarky isn't helpful

(In reply to comment #9)
> (In reply to comment #7)
> > Sorry to rain on your parade, the bug is not fixed. Try zooming into the map at http://www.openstreetmap.org/ by double clicking the map several times in a row.
> 
> Try to be polite and respectful in bug comments, being snarky isn't helpful

Sorry for that. I did not want to be snarky, I am not a native speaker, I wasn't aware that the idiom I used is considered snarky. I just used http://dict.leo.org/ to translate a colloquial german saying. Please excuse me.

[Filip Pizlo]

(In reply to comment #8)
> Version r100927 is still affected I wanted to say.

It appears so.  I'm looking into it now, but I wanted to see if you can confirm what I'm seeing:

1) Zooming and panning often results in the map getting totally corrupted, and eventually stops responding.  Expected behavior is that this does not happen.

2) Changing the following line in Source/JavaScriptCore/runtime/Heuristics.cpp

    SET(maximumInliningDepth, 5);

to:

    SET(maximumInliningDepth, 1);

appears to "fix" the problem.

(In reply to comment #11)
> (In reply to comment #8)
> > Version r100927 is still affected I wanted to say.
> 
> It appears so.  I'm looking into it now, but I wanted to see if you can confirm what I'm seeing:
> 
> 1) Zooming and panning often results in the map getting totally corrupted, and eventually stops responding.  Expected behavior is that this does not happen.

This is what I experienced to. The map gets corrupted and stops to respond to any action until you reload it. For the expected behaviour please try r97664 which doesn't fail even if the double clicks are done in a rapid manner.

> 
> 2) Changing the following line in Source/JavaScriptCore/runtime/Heuristics.cpp
> 
>     SET(maximumInliningDepth, 5);
> 
> to:
> 
>     SET(maximumInliningDepth, 1);
> 
> appears to "fix" the problem.

I can't comment on that one as I have no idea what it does.

[Filip Pizlo]

Created attachment 116157 [details]
the patch

Sadly, I couldn't get this to repro in any simplified test case. :-(

[Filip Pizlo]

(In reply to comment #8)
> Version r100927 is still affected I wanted to say.

I think my new patch fixes it.  But please do let us know if you still find problems!

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/100972

The issue seems to be solved. Thanks one more time!