Bug 115167 - REGRESSION(r137994): Random crashes in Yarr JIT for SH4 arch
Summary: REGRESSION(r137994): Random crashes in Yarr JIT for SH4 arch
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-04-25 03:24 PDT by Julien Brianceau
Modified: 2013-04-25 09:17 PDT (History)
6 users (show)

See Also:


Attachments
Flush each page separately in cacheFlush function for SH4 arch (2.44 KB, patch)
2013-04-25 07:30 PDT, Julien Brianceau
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Julien Brianceau 2013-04-25 03:24:52 PDT
Random crashes seen when using SH4 RegExp JIT. These crashes "disappear" if "JSC_useRegExpJIT=false" environment variable is set.

Unit test to reproduce:
$ ./jsc -s Source/JavaScriptCore/tests/mozilla/ecma_3/shell.js -s Source/JavaScriptCore/tests/mozilla/ecma_3/RegExp/shell.js /usr/WebKit-jsc/jsctest/ecma_3/RegExp/perlstress-001.js

According to http://trac.webkit.org/changeset/144170 and http://trac.webkit.org/changeset/145194, I also suspect that SH4 cacheFlush() should also be aligned on page size (or function receives incorrect values from caller).
Comment 1 Julien Brianceau 2013-04-25 03:29:16 PDT
I forgot to mention that if I revert r137994, issue is "solved".
Comment 2 Julien Brianceau 2013-04-25 07:30:08 PDT
Created attachment 199659 [details]
Flush each page separately in cacheFlush function for SH4 arch
Comment 3 WebKit Commit Bot 2013-04-25 09:17:40 PDT
Comment on attachment 199659 [details]
Flush each page separately in cacheFlush function for SH4 arch

Clearing flags on attachment: 199659

Committed r149114: <http://trac.webkit.org/changeset/149114>
Comment 4 WebKit Commit Bot 2013-04-25 09:17:42 PDT
All reviewed patches have been landed.  Closing bug.