Bug 122929 – We need test coverage for just the Baseline JIT

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Filip Pizlo]

Currently we can run tests for just the LLInt very easily, and we're getting better at running tests that are targeted at the DFG and FTL.  But the Baseline JIT needs some love, also.

[Filip Pizlo]

Created attachment 214409 [details]
the patch

Note, I will land this after I make sure that all of the tests pass in this configuration.  I suspect that I will see failures.

[Filip Pizlo]

Sure enough this reveals a crash:

mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 12.10-1 The with statment
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: ASSERTION FAILED: !Heap::heap(value) || Heap::heap(value) == Heap::heap(thisObject)
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: /Volumes/Data/primary/OpenSource/Source/JavaScriptCore/runtime/JSObject.cpp(347) : static void JSC::JSObject::put(JSC::JSCell *, JSC::ExecState *, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot &)
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 1   0x10098ffd0 WTFCrash
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 2   0x10075c0cc JSC::JSObject::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&)
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 3   0x100552cad JSC::JSValue::put(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&)
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 4   0x10054df0e operationPutByIdNonStrictOptimizeWithReturnAddress
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 5   0x4e58cb207457
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 6   0x1006cad77 JSC::JITCode::execute(JSC::JSStack*, JSC::ExecState*, JSC::VM*)
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 7   0x1006adf8b JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*)
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 8   0x10047980f JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*)
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 9   0x100365827 runWithScripts(GlobalObject*, WTF::Vector<Script, 0ul, WTF::CrashOnOverflow> const&, bool)
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 10  0x100364f1c jscmain(int, char**)
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 11  0x100364cf6 main
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 12  0x7fff845865fd start
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: test_script_2124: line 2:  7580 Segmentation fault: 11  "$@" /Volumes/Data/primary/OpenSource/WebKitBuild/Debug/jsc --useLLInt\=false --useDFGJIT\=false /Volumes/Data/primary/OpenSource/Source/JavaScriptCore/tests/mozilla/ecma/shell.js 12.10-1.js
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: ERROR: Unexpected exit code: 139

[Filip Pizlo]

And another failure:

jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: DIFF FAILURE!
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: --- /Volumes/Data/primary/OpenSource/LayoutTests/js/dictionary-prototype-caching-expected.txt	2013-10-01 11:22:42.000000000 -0700
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: +++ /Volumes/Data/primary/OpenSource/WebKitBuild/Debug/jsc-stress-results/jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint.out	2013-10-16 17:28:57.000000000 -0700
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: @@ -9,7 +9,7 @@
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint:  PASS protoKeys is [1,2,3]
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint:  PASS testFunction(subclass1) is true
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint:  PASS testFunction(subclass2) is true
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: -PASS testFunction(subclass2) is true
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: +FAIL testFunction(subclass2) should be true. Was false.
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint:  PASS successfullyParsed is true
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint:  
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint:  TEST COMPLETE

[Filip Pizlo]

(In reply to comment #2)
> Sure enough this reveals a crash:
> 
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 12.10-1 The with statment
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: ASSERTION FAILED: !Heap::heap(value) || Heap::heap(value) == Heap::heap(thisObject)
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: /Volumes/Data/primary/OpenSource/Source/JavaScriptCore/runtime/JSObject.cpp(347) : static void JSC::JSObject::put(JSC::JSCell *, JSC::ExecState *, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot &)
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 1   0x10098ffd0 WTFCrash
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 2   0x10075c0cc JSC::JSObject::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&)
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 3   0x100552cad JSC::JSValue::put(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&)
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 4   0x10054df0e operationPutByIdNonStrictOptimizeWithReturnAddress
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 5   0x4e58cb207457
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 6   0x1006cad77 JSC::JITCode::execute(JSC::JSStack*, JSC::ExecState*, JSC::VM*)
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 7   0x1006adf8b JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*)
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 8   0x10047980f JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*)
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 9   0x100365827 runWithScripts(GlobalObject*, WTF::Vector<Script, 0ul, WTF::CrashOnOverflow> const&, bool)
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 10  0x100364f1c jscmain(int, char**)
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 11  0x100364cf6 main
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 12  0x7fff845865fd start
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: test_script_2124: line 2:  7580 Segmentation fault: 11  "$@" /Volumes/Data/primary/OpenSource/WebKitBuild/Debug/jsc --useLLInt\=false --useDFGJIT\=false /Volumes/Data/primary/OpenSource/Source/JavaScriptCore/tests/mozilla/ecma/shell.js 12.10-1.js
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: ERROR: Unexpected exit code: 139

Fix in: https://bugs.webkit.org/show_bug.cgi?id=122937

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/157557