After http://trac.webkit.org/changeset/132757, the 2 following jquery test cases started crashing: jquery/manipulation.html jquery/traversing.html Backtrace: crash log for DumpRenderTree (pid 860): STDOUT: <empty> STDERR: ASSERTION FAILED: ArrayMode(Array::Arguments).alreadyChecked(m_state.forNode(node.child1())) STDERR: /home/buildslave-1/webkit-buildslave/efl-linux-64-debug/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp(3247) : void JSC::DFG::SpeculativeJIT::compileGetByValOnArguments(JSC::DFG::Node&) STDERR: 1 0x7f56d6262474 JSC::DFG::SpeculativeJIT::compileGetByValOnArguments(JSC::DFG::Node&) STDERR: 2 0x7f56d6285456 JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node&) STDERR: 3 0x7f56d6259602 JSC::DFG::SpeculativeJIT::compile(JSC::DFG::BasicBlock&) STDERR: 4 0x7f56d6259d87 JSC::DFG::SpeculativeJIT::compile() STDERR: 5 0x7f56d622a1ce JSC::DFG::JITCompiler::compileBody(JSC::DFG::SpeculativeJIT&) STDERR: 6 0x7f56d622b163 JSC::DFG::JITCompiler::compileFunction(JSC::JITCode&, JSC::MacroAssemblerCodePtr&) STDERR: 7 0x7f56d621dfab JSC::DFG::compile(JSC::DFG::CompileMode, JSC::ExecState*, JSC::CodeBlock*, JSC::JITCode&, JSC::MacroAssemblerCodePtr*, unsigned int) STDERR: 8 0x7f56d621d900 JSC::DFG::tryCompileFunction(JSC::ExecState*, JSC::CodeBlock*, JSC::JITCode&, JSC::MacroAssemblerCodePtr&, unsigned int) STDERR: 9 0x7f56d63add8f JSC::jitCompileFunctionIfAppropriate(JSC::ExecState*, WTF::OwnPtr<JSC::FunctionCodeBlock>&, JSC::JITCode&, JSC::MacroAssemblerCodePtr&, JSC::WriteBarrier<JSC::SharedSymbolTable>&, JSC::JITCode::JITType, unsigned int, JSC::JITCompilationEffort) STDERR: 10 0x7f56d63ae08a JSC::prepareFunctionForExecution(JSC::ExecState*, WTF::OwnPtr<JSC::FunctionCodeBlock>&, JSC::JITCode&, JSC::MacroAssemblerCodePtr&, JSC::WriteBarrier<JSC::SharedSymbolTable>&, JSC::JITCode::JITType, unsigned int, JSC::CodeSpecializationKind) STDERR: 11 0x7f56d63abf71 JSC::FunctionExecutable::compileForCallInternal(JSC::ExecState*, JSC::JSScope*, JSC::JITCode::JITType, unsigned int) STDERR: 12 0x7f56d63ab39b JSC::FunctionExecutable::compileOptimizedForCall(JSC::ExecState*, JSC::JSScope*, unsigned int) STDERR: 13 0x7f56d614ad85 JSC::FunctionExecutable::compileOptimizedFor(JSC::ExecState*, JSC::JSScope*, unsigned int, JSC::CodeSpecializationKind) STDERR: 14 0x7f56d6146e38 JSC::FunctionCodeBlock::compileOptimized(JSC::ExecState*, JSC::JSScope*, unsigned int) STDERR: 15 0x7f56d63177bd STDERR: 16 0x7f56d6313be0 STDERR: 17 0x7f5682780058
<rdar://problem/12591971>
This bug is valid on Qt too, I skipped the asserting tests to paint the bots green - r132923. Please unskip them with the proper fix. And it is P1/critical, because it is an assertion and regression.
ping?
I think we should revert the original change if the author is unavailable to fix the regression.
(In reply to comment #4) > I think we should revert the original change if the author is unavailable to fix the regression. I do not see this crash on Mac.
(In reply to comment #5) > (In reply to comment #4) > > I think we should revert the original change if the author is unavailable to fix the regression. > > I do not see this crash on Mac. It doesn't mean if the crash is invalid. The crash/assertion occured on EFL debug and on Qt debug buildbots.
If you have any idea, I willingly check it on Qt to help debugging this bug, but I can't debug it myself, because I don't know anything about your original patch.
(In reply to comment #7) > If you have any idea, I willingly check it on Qt to help debugging this bug, > but I can't debug it myself, because I don't know anything about your original patch. Does it reproduce to the point where you can catch the assertion in gdb? If so, can you show me what the contents of 'm_state.forNode(node.child1())' is? Also, if you could enable DFG_ENABLE_DEBUG_VERBOSE (in DFGCommon.h) and show me the output dump from that, that would be absolutely fabulous.
Hm, it seems the assertions disappeared after http://trac.webkit.org/changeset/133160. Is it possible if it was the proper fix for this bug? Or did it make the bug hidden?
For the record, I also tried to reproduce the crashing on EFL port today and could not.
(In reply to comment #9) > Hm, it seems the assertions disappeared after http://trac.webkit.org/changeset/133160. Is it possible if it was the proper fix for this bug? Or did it make the bug hidden? No, it is impossible. All tests crashed between r133138-r133160, r133135 is the revision fixed this bug.
Created attachment 172346 [details] verbose DRT output 1 on r133134
Created attachment 172348 [details] verbose DRT output 2 on r133134
Created attachment 172349 [details] GDB backtrace for jquery/manipulation.html
Could you check if http://trac.webkit.org/changeset/133135 fixed this bug properly or only made this bug hidden?
I unskipped them by r133487, but it would be great if you can confirm if r133135 is the proper fix for this bug or not.
(In reply to comment #15) > Could you check if http://trac.webkit.org/changeset/133135 fixed this bug properly or only made this bug hidden? It's a real fix.
Thanks.