Bug 94191 – JSC: 2 regex assertion failures in webkit tests with LLint interpreter

• Component: JavaScriptCore
• Status: NEW

[Mark Lam]

If you disable the JITs and run interpreted only on a debug build, 2 regex tests will crash with assertion failures:

Regressions: Unexpected crashes : (2)
  fast/js/regexp-non-greedy-parentheses.html = CRASH
  fast/regex/parentheses.html = CRASH

To reproduce:
1. Apply the following patch to runtime/Options.cpp.  This will disable the JITs:

Index: Source/JavaScriptCore/runtime/Options.cpp
===================================================================
--- Source/JavaScriptCore/runtime/Options.cpp	(revision 125744)
+++ Source/JavaScriptCore/runtime/Options.cpp	(working copy)
@@ -138,6 +138,9 @@
     ; // Deconfuse editors that do auto indentation
 #endif
     
+    useJIT() = false;
+    useDFGJIT() = false;
+
     // Do range checks where needed and make corrections to the options:
     ASSERT(thresholdForOptimizeAfterLongWarmUp() >= thresholdForOptimizeAfterWarmUp());
     ASSERT(thresholdForOptimizeAfterWarmUp() >= thresholdForOptimizeSoon());

2. Do a debug build.
3. Run the webkit JS tests:

$ ./Tools/Scripts/run-webkit-tests --debug fast/js/ fast/regex/ ietestcenter/Javascript/ sputnik/

[Mark Lam]

rdar://problem/12108184

[Mark Lam]

Correction: rdar://problem/12110946

[Csaba Osztrogonác]

cc-ing Gábor and Zoltán, maybe you are interested in this LLINT bug.