Bug 84815

Summary:

http://bellard.org/jslinux/ triggers an assertion failure in the DFG JIT

Product:

WebKit

Reporter:

Oliver Hunt <oliver>

Component:

JavaScriptCore

Assignee:

Filip Pizlo <fpizlo>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

oliver

Priority:

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

URL:

http://bellard.org/jslinux/

Attachments:

Description	Flags
the patch	barraclough: review+

Oliver Hunt

Reported 2012-04-24 18:35:12 PDT

Go to the above url in a debug build, and i get: 0 com.apple.JavaScriptCore 0x00000001055ec130 JSC::DFG::SpeculativeJIT::forwardSpeculationCheck(JSC::DFG::ExitKind, JSC::DFG::JSValueSource, unsigned int, JSC::AbstractMacroAssembler<JSC::X86Assembler>::Jump, JSC::ValueRecovery const&) + 848 (DFGSpeculativeJIT.h:1889) 1 com.apple.JavaScriptCore 0x00000001055df197 JSC::DFG::SpeculativeJIT::compileUInt32ToNumber(JSC::DFG::Node&) + 647 (DFGSpeculativeJIT.cpp:1734) 2 com.apple.JavaScriptCore 0x00000001056045a0 JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node&) + 5696 (DFGSpeculativeJIT64.cpp:2114) 3 com.apple.JavaScriptCore 0x00000001055db550 JSC::DFG::SpeculativeJIT::compile(JSC::DFG::BasicBlock&) + 1984 (DFGSpeculativeJIT.cpp:1025) 4 com.apple.JavaScriptCore 0x00000001055dd725 JSC::DFG::SpeculativeJIT::compile() + 213 (DFGSpeculativeJIT.cpp:1256) 5 com.apple.JavaScriptCore 0x00000001055b2e3b JSC::DFG::JITCompiler::compileBody(JSC::DFG::SpeculativeJIT&) + 107 (DFGJITCompiler.cpp:81) 6 com.apple.JavaScriptCore 0x00000001055b3e15 JSC::DFG::JITCompiler::compileFunction(JSC::JITCode&, JSC::MacroAssemblerCodePtr&) + 277 (DFGJITCompiler.cpp:237) 7 com.apple.JavaScriptCore 0x00000001055a87dd JSC::DFG::compile(JSC::DFG::CompileMode, JSC::JSGlobalData&, JSC::CodeBlock*, JSC::JITCode&, JSC::MacroAssemblerCodePtr*) + 573 (DFGDriver.cpp:79) 8 com.apple.JavaScriptCore 0x00000001055a8594 JSC::DFG::tryCompileFunction(JSC::JSGlobalData&, JSC::CodeBlock*, JSC::JITCode&, JSC::MacroAssemblerCodePtr&) + 52 (DFGDriver.cpp:97) 9 com.apple.JavaScriptCore 0x000000010562378e JSC::jitCompileFunctionIfAppropriate(JSC::JSGlobalData&, WTF::OwnPtr<JSC::FunctionCodeBlock>&, JSC::JITCode&, JSC::MacroAssemblerCodePtr&, JSC::SharedSymbolTable*&, JSC::JITCode::JITType, JSC::JITCompilationEffort) + 222 (JITDriver.h:91) 10 com.apple.JavaScriptCore 0x00000001056240f6 JSC::prepareFunctionForExecution(JSC::JSGlobalData&, WTF::OwnPtr<JSC::FunctionCodeBlock>&, JSC::JITCode&, JSC::MacroAssemblerCodePtr&, JSC::SharedSymbolTable*&, JSC::JITCode::JITType, JSC::CodeSpecializationKind) + 246 (ExecutionHarness.h:64) 11 com.apple.JavaScriptCore 0x000000010561fdb2 JSC::FunctionExecutable::compileForCallInternal(JSC::ExecState*, JSC::ScopeChainNode*, JSC::JITCode::JITType) + 802 (Executable.cpp:554) 12 com.apple.JavaScriptCore 0x000000010561fa24 JSC::FunctionExecutable::compileOptimizedForCall(JSC::ExecState*, JSC::ScopeChainNode*) + 324 (Executable.cpp:465) 13 com.apple.JavaScriptCore 0x0000000105544349 JSC::FunctionExecutable::compileOptimizedFor(JSC::ExecState*, JSC::ScopeChainNode*, JSC::CodeSpecializationKind) + 329 (Executable.h:588) 14 com.apple.JavaScriptCore 0x000000010553d804 JSC::FunctionCodeBlock::compileOptimized(JSC::ExecState*, JSC::ScopeChainNode*) + 148 (CodeBlock.cpp:2302) 15 com.apple.JavaScriptCore 0x000000010567ed1a cti_optimize_from_ret + 250 (JITStubs.cpp:2075) 16 com.apple.JavaScriptCore 0x0000000105686aa0 0x1054c7000 + 1833632 17 com.apple.JavaScriptCore 0x000000010564dd19 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*) + 105 (JITCode.h:127) 18 com.apple.JavaScriptCore 0x000000010564a1df JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 1855 (Interpreter.cpp:1306) 19 com.apple.JavaScriptCore 0x000000010552f048 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 296 (CallData.cpp:39) 20 com.apple.JavaScriptCore 0x00000001056a0286 JSC::boundFunctionCall(JSC::ExecState*) + 646 (JSBoundFunction.cpp:56) 21 com.apple.JavaScriptCore 0x000000010564a4be JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 2590 (Interpreter.cpp:1335)

Attachments
the patch (2.19 KB, patch) 2012-04-25 12:08 PDT, Filip Pizlo	barraclough: review+	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Filip Pizlo

Comment 1 2012-04-25 12:08:02 PDT

Created attachment 138852 [details] the patch Can I get an RS for a test case as well?

Filip Pizlo

Comment 2 2012-04-25 12:52:43 PDT

Landed in http://trac.webkit.org/changeset/115237

Note You need to log in before you can comment on or make changes to this bug.