Bug 122929 - We need test coverage for just the Baseline JIT
Summary: We need test coverage for just the Baseline JIT
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Filip Pizlo
URL:
Keywords:
Depends on: 122930 122937 122938
Blocks:
  Show dependency tree / graph
 
Reported: 2013-10-16 16:58 PDT by Filip Pizlo
Modified: 2013-10-16 20:35 PDT (History)
8 users (show)

See Also:

Attachments
the patch (2.51 KB, patch)
2013-10-16 17:21 PDT, Filip Pizlo 		sam: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2013-10-16 16:58:42 PDT 
Currently we can run tests for just the LLInt very easily, and we're getting better at running tests that are targeted at the DFG and FTL.  But the Baseline JIT needs some love, also.
Comment 1 Filip Pizlo 2013-10-16 17:21:37 PDT 
Created attachment 214409 [details]
the patch

Note, I will land this after I make sure that all of the tests pass in this configuration.  I suspect that I will see failures.
Comment 2 Filip Pizlo 2013-10-16 17:28:18 PDT 
Sure enough this reveals a crash:

mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 12.10-1 The with statment
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: ASSERTION FAILED: !Heap::heap(value) || Heap::heap(value) == Heap::heap(thisObject)
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: /Volumes/Data/primary/OpenSource/Source/JavaScriptCore/runtime/JSObject.cpp(347) : static void JSC::JSObject::put(JSC::JSCell *, JSC::ExecState *, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot &)
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 1   0x10098ffd0 WTFCrash
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 2   0x10075c0cc JSC::JSObject::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&)
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 3   0x100552cad JSC::JSValue::put(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&)
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 4   0x10054df0e operationPutByIdNonStrictOptimizeWithReturnAddress
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 5   0x4e58cb207457
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 6   0x1006cad77 JSC::JITCode::execute(JSC::JSStack*, JSC::ExecState*, JSC::VM*)
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 7   0x1006adf8b JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*)
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 8   0x10047980f JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*)
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 9   0x100365827 runWithScripts(GlobalObject*, WTF::Vector<Script, 0ul, WTF::CrashOnOverflow> const&, bool)
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 10  0x100364f1c jscmain(int, char**)
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 11  0x100364cf6 main
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 12  0x7fff845865fd start
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: test_script_2124: line 2:  7580 Segmentation fault: 11  "$@" /Volumes/Data/primary/OpenSource/WebKitBuild/Debug/jsc --useLLInt\=false --useDFGJIT\=false /Volumes/Data/primary/OpenSource/Source/JavaScriptCore/tests/mozilla/ecma/shell.js 12.10-1.js
mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: ERROR: Unexpected exit code: 139
Comment 3 Filip Pizlo 2013-10-16 17:29:20 PDT 
And another failure:

jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: DIFF FAILURE!
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: --- /Volumes/Data/primary/OpenSource/LayoutTests/js/dictionary-prototype-caching-expected.txt	2013-10-01 11:22:42.000000000 -0700
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: +++ /Volumes/Data/primary/OpenSource/WebKitBuild/Debug/jsc-stress-results/jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint.out	2013-10-16 17:28:57.000000000 -0700
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: @@ -9,7 +9,7 @@
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint:  PASS protoKeys is [1,2,3]
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint:  PASS testFunction(subclass1) is true
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint:  PASS testFunction(subclass2) is true
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: -PASS testFunction(subclass2) is true
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint: +FAIL testFunction(subclass2) should be true. Was false.
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint:  PASS successfullyParsed is true
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint:  
jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint:  TEST COMPLETE
Comment 4 Filip Pizlo 2013-10-16 19:48:59 PDT 
(In reply to comment #2)
> Sure enough this reveals a crash:
> 
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 12.10-1 The with statment
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: ASSERTION FAILED: !Heap::heap(value) || Heap::heap(value) == Heap::heap(thisObject)
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: /Volumes/Data/primary/OpenSource/Source/JavaScriptCore/runtime/JSObject.cpp(347) : static void JSC::JSObject::put(JSC::JSCell *, JSC::ExecState *, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot &)
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 1   0x10098ffd0 WTFCrash
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 2   0x10075c0cc JSC::JSObject::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&)
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 3   0x100552cad JSC::JSValue::put(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&)
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 4   0x10054df0e operationPutByIdNonStrictOptimizeWithReturnAddress
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 5   0x4e58cb207457
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 6   0x1006cad77 JSC::JITCode::execute(JSC::JSStack*, JSC::ExecState*, JSC::VM*)
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 7   0x1006adf8b JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*)
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 8   0x10047980f JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*)
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 9   0x100365827 runWithScripts(GlobalObject*, WTF::Vector<Script, 0ul, WTF::CrashOnOverflow> const&, bool)
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 10  0x100364f1c jscmain(int, char**)
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 11  0x100364cf6 main
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: 12  0x7fff845865fd start
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: test_script_2124: line 2:  7580 Segmentation fault: 11  "$@" /Volumes/Data/primary/OpenSource/WebKitBuild/Debug/jsc --useLLInt\=false --useDFGJIT\=false /Volumes/Data/primary/OpenSource/Source/JavaScriptCore/tests/mozilla/ecma/shell.js 12.10-1.js
> mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline: ERROR: Unexpected exit code: 139

Fix in: https://bugs.webkit.org/show_bug.cgi?id=122937
Comment 5 Filip Pizlo 2013-10-16 20:35:30 PDT 
Landed in http://trac.webkit.org/changeset/157557