Bug 129155 - [Win][LLINT] Many JSC stress test failures.
Summary: [Win][LLINT] Many JSC stress test failures.
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-02-21 09:43 PST by peavo
Modified: 2014-02-24 14:54 PST (History)
5 users (show)

See Also:


Attachments
Patch (2.08 KB, patch)
2014-02-21 09:52 PST, peavo
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description peavo 2014-02-21 09:43:01 PST
When running the stress tests on Windows with LLINT enabled, about 25% of the tests fail.
Comment 1 peavo 2014-02-21 09:52:34 PST
Created attachment 224879 [details]
Patch
Comment 2 Michael Saboff 2014-02-21 10:28:34 PST
Comment on attachment 224879 [details]
Patch

r=me
Comment 3 peavo 2014-02-21 10:33:23 PST
(In reply to comment #2)
> (From update of attachment 224879 [details])
> r=me

Thanks for reviewing :)
Comment 4 peavo 2014-02-21 10:35:26 PST
With this patch, I get the following results from the stress tests:

** The following JSC stress test failures have been introduced:
        mozilla-tests.yaml/ecma/FunctionObjects/15.3.1.1-3.js.mozilla
        mozilla-tests.yaml/ecma/FunctionObjects/15.3.1.1-3.js.mozilla-llint
        mozilla-tests.yaml/ecma/FunctionObjects/15.3.1.1-3.js.mozilla-baseline
        mozilla-tests.yaml/ecma/FunctionObjects/15.3.1.1-3.js.mozilla-dfg-eager-no-cjit-validate-phases
        mozilla-tests.yaml/ecma/FunctionObjects/15.3.2.1-3.js.mozilla
        mozilla-tests.yaml/ecma/FunctionObjects/15.3.2.1-3.js.mozilla-llint
        mozilla-tests.yaml/ecma/FunctionObjects/15.3.2.1-3.js.mozilla-baseline
        mozilla-tests.yaml/ecma/FunctionObjects/15.3.2.1-3.js.mozilla-dfg-eager-no-cjit-validate-phases
        mozilla-tests.yaml/ecma/FunctionObjects/15.3.5-1.js.mozilla
        mozilla-tests.yaml/ecma/FunctionObjects/15.3.5-1.js.mozilla-llint
        mozilla-tests.yaml/ecma/FunctionObjects/15.3.5-1.js.mozilla-baseline
        mozilla-tests.yaml/ecma/FunctionObjects/15.3.5-1.js.mozilla-dfg-eager-no-cjit-validate-phases
        mozilla-tests.yaml/ecma_3/Date/15.9.5.6.js.mozilla
        mozilla-tests.yaml/ecma_3/Date/15.9.5.6.js.mozilla-llint
        mozilla-tests.yaml/ecma_3/Date/15.9.5.6.js.mozilla-baseline
        mozilla-tests.yaml/ecma_3/Date/15.9.5.6.js.mozilla-dfg-eager-no-cjit-validate-phases
        mozilla-tests.yaml/ecma/Array/15.4.5.2-2.js.mozilla
        mozilla-tests.yaml/ecma/Array/15.4.5.2-2.js.mozilla-llint
        mozilla-tests.yaml/ecma/Array/15.4.5.2-2.js.mozilla-baseline
        mozilla-tests.yaml/ecma/Array/15.4.5.2-2.js.mozilla-dfg-eager-no-cjit-validate-phases
        mozilla-tests.yaml/js1_5/Regress/regress-191633.js.mozilla
        mozilla-tests.yaml/js1_5/Regress/regress-191633.js.mozilla-llint
        mozilla-tests.yaml/js1_5/Regress/regress-191633.js.mozilla-baseline
        mozilla-tests.yaml/js1_5/Regress/regress-191633.js.mozilla-dfg-eager-no-cjit-validate-phases
        mozilla-tests.yaml/js1_5/Regress/regress-192414.js.mozilla
        mozilla-tests.yaml/js1_5/Regress/regress-192414.js.mozilla-llint
        mozilla-tests.yaml/js1_5/Regress/regress-192414.js.mozilla-baseline
        mozilla-tests.yaml/js1_5/Regress/regress-192414.js.mozilla-dfg-eager-no-cjit-validate-phases
        mozilla-tests.yaml/js1_5/String/regress-179068.js.mozilla
        mozilla-tests.yaml/js1_5/String/regress-179068.js.mozilla-llint
        mozilla-tests.yaml/js1_5/String/regress-179068.js.mozilla-baseline
        mozilla-tests.yaml/js1_5/String/regress-179068.js.mozilla-dfg-eager-no-cjit-validate-phases
        stress/ftl-arithcos.js.default
        stress/ftl-arithcos.js.no-llint
        stress/ftl-arithcos.js.always-trigger-copy-phase
        stress/ftl-arithcos.js.no-cjit-validate-phases
        stress/ftl-arithcos.js.dfg-eager
        stress/ftl-arithcos.js.dfg-eager-no-cjit-validate
        jsc-layout-tests.yaml/js/script-tests/basic-map.js.layout
        jsc-layout-tests.yaml/js/script-tests/basic-map.js.layout-no-cjit
        jsc-layout-tests.yaml/js/script-tests/excessive-comma-usage.js.layout
        jsc-layout-tests.yaml/js/script-tests/excessive-comma-usage.js.layout-no-cjit
        jsc-layout-tests.yaml/js/script-tests/excessive-comma-usage.js.layout-dfg-eager-no-cjit
        jsc-layout-tests.yaml/js/script-tests/function-apply-many-args.js.layout
        jsc-layout-tests.yaml/js/script-tests/function-apply-many-args.js.layout-no-llint
        jsc-layout-tests.yaml/js/script-tests/function-apply-many-args.js.layout-no-cjit
        jsc-layout-tests.yaml/js/script-tests/function-apply-many-args.js.layout-dfg-eager-no-cjit
        jsc-layout-tests.yaml/js/script-tests/function-apply.js.layout
        jsc-layout-tests.yaml/js/script-tests/function-apply.js.layout-no-llint
        jsc-layout-tests.yaml/js/script-tests/function-apply.js.layout-no-cjit
        jsc-layout-tests.yaml/js/script-tests/function-apply.js.layout-dfg-eager-no-cjit
        jsc-layout-tests.yaml/js/script-tests/reentrant-caching.js.layout-no-llint
        jsc-layout-tests.yaml/js/script-tests/reentrant-caching.js.layout-dfg-eager-no-cjit
        jsc-layout-tests.yaml/js/script-tests/sort-stability.js.layout
        jsc-layout-tests.yaml/js/script-tests/sort-stability.js.layout-no-llint
        jsc-layout-tests.yaml/js/script-tests/sort-stability.js.layout-no-cjit
        jsc-layout-tests.yaml/js/script-tests/sort-stability.js.layout-dfg-eager-no-cjit

Results for JSC stress tests:
    57 failures found.
Comment 5 peavo 2014-02-21 11:54:24 PST
When running with the C Loop LLINT, I get these results:

** The following JSC stress test failures have been introduced:
        mozilla-tests.yaml/ecma_3/Date/15.9.5.6.js.mozilla
        mozilla-tests.yaml/ecma_3/Date/15.9.5.6.js.mozilla-llint
        mozilla-tests.yaml/ecma_3/Date/15.9.5.6.js.mozilla-baseline
        mozilla-tests.yaml/ecma_3/Date/15.9.5.6.js.mozilla-dfg-eager-no-cjit-validate-phases
        stress/ftl-arithcos.js.default
        stress/ftl-arithcos.js.no-llint
        stress/ftl-arithcos.js.always-trigger-copy-phase
        stress/ftl-arithcos.js.no-cjit-validate-phases
        stress/ftl-arithcos.js.dfg-eager
        stress/ftl-arithcos.js.dfg-eager-no-cjit-validate
        jsc-layout-tests.yaml/js/script-tests/basic-map.js.layout
        jsc-layout-tests.yaml/js/script-tests/basic-map.js.layout-no-llint
        jsc-layout-tests.yaml/js/script-tests/basic-map.js.layout-no-cjit
        jsc-layout-tests.yaml/js/script-tests/basic-map.js.layout-dfg-eager-no-cjit
        jsc-layout-tests.yaml/js/script-tests/sort-stability.js.layout
        jsc-layout-tests.yaml/js/script-tests/sort-stability.js.layout-no-llint
        jsc-layout-tests.yaml/js/script-tests/sort-stability.js.layout-no-cjit
        jsc-layout-tests.yaml/js/script-tests/sort-stability.js.layout-dfg-eager-no-cjit

Results for JSC stress tests:
    18 failures found.

So there seems to be some regressions when using the x86 backend compared to the C Loop backend, I will look into those next.
Comment 6 Mark Lam 2014-02-21 11:59:41 PST
(In reply to comment #5)
> Results for JSC stress tests:
>     18 failures found.
> 
> So there seems to be some regressions when using the x86 backend compared to the C Loop backend, I will look into those next.

Beware of https://bugs.webkit.org/show_bug.cgi?id=129099 which may contribute some failures.  Note: some stress tests will turn on the DFG even if you don’t have it on by default.  The only way it doesn’t get turned on is if the DFG is not built in.  The C loop LLINT build benefits from that.
Comment 7 peavo 2014-02-21 12:03:37 PST
(In reply to comment #6)
> (In reply to comment #5)
> > Results for JSC stress tests:
> >     18 failures found.
> > 
> > So there seems to be some regressions when using the x86 backend compared to the C Loop backend, I will look into those next.
> 
> Beware of https://bugs.webkit.org/show_bug.cgi?id=129099 which may contribute some failures.  Note: some stress tests will turn on the DFG even if you don’t have it on by default.  The only way it doesn’t get turned on is if the DFG is not built in.  The C loop LLINT build benefits from that.

Ok, so maybe I should run a test with DFG and LLINT enabled?
Comment 8 Mark Lam 2014-02-21 12:13:24 PST
(In reply to comment #7)
> (In reply to comment #6)
> > (In reply to comment #5)
> > > Results for JSC stress tests:
> > >     18 failures found.
> > > 
> > > So there seems to be some regressions when using the x86 backend compared to the C Loop backend, I will look into those next.
> > 
> > Beware of https://bugs.webkit.org/show_bug.cgi?id=129099 which may contribute some failures.  Note: some stress tests will turn on the DFG even if you don’t have it on by default.  The only way it doesn’t get turned on is if the DFG is not built in.  The C loop LLINT build benefits from that.
> 
> Ok, so maybe I should run a test with DFG and LLINT enabled?

Just to clarify: the LLINT is always enabled.  It’s either the C loop LLINT or the ASM LLINT.

The DFG can be disabled at runtime, but some jsc stress tests will turn it back on because that is the purpose of those tests i.e. to test the DFG.  If you run them with the DFG not built in the binary (like the C loop build), then the DFG won’t come into play.

To remove the effects of the DFG, don’t build the DFG into the code.
Comment 9 peavo 2014-02-21 12:16:38 PST
(In reply to comment #8)
> (In reply to comment #7)
> > (In reply to comment #6)
> > > (In reply to comment #5)
> > > > Results for JSC stress tests:
> > > >     18 failures found.
> > > > 
> > > > So there seems to be some regressions when using the x86 backend compared to the C Loop backend, I will look into those next.
> > > 
> > > Beware of https://bugs.webkit.org/show_bug.cgi?id=129099 which may contribute some failures.  Note: some stress tests will turn on the DFG even if you don’t have it on by default.  The only way it doesn’t get turned on is if the DFG is not built in.  The C loop LLINT build benefits from that.
> > 
> > Ok, so maybe I should run a test with DFG and LLINT enabled?
> 
> Just to clarify: the LLINT is always enabled.  It’s either the C loop LLINT or the ASM LLINT.
> 
> The DFG can be disabled at runtime, but some jsc stress tests will turn it back on because that is the purpose of those tests i.e. to test the DFG.  If you run them with the DFG not built in the binary (like the C loop build), then the DFG won’t come into play.
> 
> To remove the effects of the DFG, don’t build the DFG into the code.

Ok, I haven't been building with DFG, only LLINT (x86 backend).
Comment 10 peavo 2014-02-21 12:45:37 PST
Not a committer, cq+?  :)
Comment 11 WebKit Commit Bot 2014-02-21 13:21:33 PST
Comment on attachment 224879 [details]
Patch

Clearing flags on attachment: 224879

Committed r164494: <http://trac.webkit.org/changeset/164494>
Comment 12 WebKit Commit Bot 2014-02-21 13:21:36 PST
All reviewed patches have been landed.  Closing bug.
Comment 13 Csaba Osztrogonác 2014-02-24 08:30:53 PST
(In reply to comment #11)
> (From update of attachment 224879 [details])
> Clearing flags on attachment: 224879
> 
> Committed r164494: <http://trac.webkit.org/changeset/164494>

It broke zillion tests on 32 bit platforms. :-/

Here is the log from the GTK bot:
 http://build.webkit.org/builders/GTK%20Linux%2032-bit%20Release/builds/41425

But you can easily reproduce the  failures on Mac too.
Comment 14 peavo 2014-02-24 13:19:58 PST
(In reply to comment #13)
> (In reply to comment #11)
> > (From update of attachment 224879 [details] [details])
> > Clearing flags on attachment: 224879
> > 
> > Committed r164494: <http://trac.webkit.org/changeset/164494>
> 
> It broke zillion tests on 32 bit platforms. :-/
> 
> Here is the log from the GTK bot:
>  http://build.webkit.org/builders/GTK%20Linux%2032-bit%20Release/builds/41425
> 
> But you can easily reproduce the  failures on Mac too.

Sorry for this, I will look into it, and create a new patch soon.
Comment 15 Mark Lam 2014-02-24 13:21:55 PST
(In reply to comment #14)
> (In reply to comment #13)
> > (In reply to comment #11)
> > > (From update of attachment 224879 [details] [details] [details])
> > > Clearing flags on attachment: 224879
> > > 
> > > Committed r164494: <http://trac.webkit.org/changeset/164494>
> > 
> > It broke zillion tests on 32 bit platforms. :-/
> > 
> > Here is the log from the GTK bot:
> >  http://build.webkit.org/builders/GTK%20Linux%2032-bit%20Release/builds/41425
> > 
> > But you can easily reproduce the  failures on Mac too.
> 
> Sorry for this, I will look into it, and create a new patch soon.

peavo, if you think it will take longer than 1 hour to find the fix, we should roll out this change first until you can fix it.  Please advise.
Comment 16 peavo 2014-02-24 13:35:33 PST
(In reply to comment #15)
> (In reply to comment #14)
> > (In reply to comment #13)
> > > (In reply to comment #11)
> > > > (From update of attachment 224879 [details] [details] [details] [details])
> > > > Clearing flags on attachment: 224879
> > > > 
> > > > Committed r164494: <http://trac.webkit.org/changeset/164494>
> > > 
> > > It broke zillion tests on 32 bit platforms. :-/
> > > 
> > > Here is the log from the GTK bot:
> > >  http://build.webkit.org/builders/GTK%20Linux%2032-bit%20Release/builds/41425
> > > 
> > > But you can easily reproduce the  failures on Mac too.
> > 
> > Sorry for this, I will look into it, and create a new patch soon.
> 
> peavo, if you think it will take longer than 1 hour to find the fix, we should roll out this change first until you can fix it.  Please advise.

I think I can post a fix within one hour.
Comment 17 Mark Lam 2014-02-24 14:54:53 PST
FYI, the fix for the regression was address in https://bugs.webkit.org/show_bug.cgi?id=129272.  Fix landed in r164612: <http://trac.webkit.org/changeset/164612>