Bug 129318 - Fix JSC stress test failures on 32-bit x86 on Mac
Summary: Fix JSC stress test failures on 32-bit x86 on Mac
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Mark Lam
URL:
Keywords: InRadar
Depends on: 129947 129969
Blocks:
  Show dependency treegraph
 
Reported: 2014-02-25 11:22 PST by Mark Lam
Modified: 2014-03-10 02:38 PDT (History)
8 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Lam 2014-02-25 11:22:48 PST
The jsc stress test results running on 32-bit x86 Mac:

stress/recurse-infinitely-on-getter.js.dfg-eager: test_script_5127: line 2: 24956 Bus error: 10           "$@" ../../.vm/JavaScriptCore.framework/Resources/jsc --thresholdForJITAfterWarmUp\=10 --thresholdForJITSoon\=10 --thresholdForOptimizeAfterWarmUp\=20 --thresholdForOptimizeAfterLongWarmUp\=20 --thresholdForOptimizeSoon\=20 --thresholdForFTLOptimizeAfterWarmUp\=20 --thresholdForFTLOptimizeSoon\=20 recurse-infinitely-on-getter.js
stress/recurse-infinitely-on-getter.js.dfg-eager: ERROR: Unexpected exit code: 138
stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate: test_script_5128: line 2: 24966 Bus error: 10           "$@" ../../.vm/JavaScriptCore.framework/Resources/jsc --enableConcurrentJIT\=false --validateGraph\=true --thresholdForJITAfterWarmUp\=10 --thresholdForJITSoon\=10 --thresholdForOptimizeAfterWarmUp\=20 --thresholdForOptimizeAfterLongWarmUp\=20 --thresholdForOptimizeSoon\=20 --thresholdForFTLOptimizeAfterWarmUp\=20 --thresholdForFTLOptimizeSoon\=20 recurse-infinitely-on-getter.js
stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate: ERROR: Unexpected exit code: 138
8388/8388 (failed 2)                 

** The following JSC stress test failures have been introduced:
	stress/recurse-infinitely-on-getter.js.dfg-eager
	stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate

Results for JSC stress tests:
    2 failures found.
Comment 1 Radar WebKit Bug Importer 2014-02-25 11:25:01 PST
<rdar://problem/16162647>
Comment 2 Csaba Osztrogonác 2014-02-28 08:43:50 PST
Is this bug still valid? I haven't seen these failures on ToT (r164860) on
Mavericks with 32 bit build.
Comment 3 Mark Lam 2014-02-28 09:44:04 PST
(In reply to comment #2)
> Is this bug still valid? I haven't seen these failures on ToT (r164860) on
> Mavericks with 32 bit build.

I just did a build and run with r164862, and still saw these.  I also saw 15 other new failures.
Comment 4 Filip Pizlo 2014-02-28 09:48:54 PST
(In reply to comment #3)
> (In reply to comment #2)
> > Is this bug still valid? I haven't seen these failures on ToT (r164860) on
> > Mavericks with 32 bit build.
> 
> I just did a build and run with r164862, and still saw these.  I also saw 15 other new failures.

Can you post the 15 new ones here?

At some point we should whip the 32-bit code into shape. :-/
Comment 5 Mark Lam 2014-02-28 09:50:33 PST
Here's the complete list:

** The following JSC stress test failures have been introduced:
	stress/recurse-infinitely-on-getter.js.default
	stress/recurse-infinitely-on-getter.js.always-trigger-copy-phase
	stress/recurse-infinitely-on-getter.js.no-cjit-validate-phases
	stress/recurse-infinitely-on-getter.js.dfg-eager
	stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate
	regress/script-tests/call-spread-call.js.default
	regress/script-tests/call-spread-call.js.no-llint
	regress/script-tests/call-spread-call.js.always-trigger-copy-phase
	regress/script-tests/call-spread-call.js.no-cjit-validate-phases
	regress/script-tests/call-spread-call.js.dfg-eager
	regress/script-tests/call-spread-call.js.dfg-eager-no-cjit-validate
	regress/script-tests/string-cons-tower.js.dfg-eager
	regress/script-tests/string-cons-tower.js.dfg-eager-no-cjit-validate
	jsc-layout-tests.yaml/js/script-tests/dfg-convert-this-dom-window.js.layout-no-llint
	jsc-layout-tests.yaml/js/script-tests/dfg-convert-this-dom-window.js.layout-dfg-eager-no-cjit
	jsc-layout-tests.yaml/js/script-tests/function-call-aliased.js.layout-no-llint
	jsc-layout-tests.yaml/js/script-tests/function-call-aliased.js.layout-dfg-eager-no-cjit

Results for JSC stress tests:
    17 failures found.
Comment 6 Csaba Osztrogonác 2014-02-28 12:19:02 PST
(In reply to comment #5)
> Here's the complete list:
> 
> ** The following JSC stress test failures have been introduced:
>     stress/recurse-infinitely-on-getter.js.default
>     stress/recurse-infinitely-on-getter.js.always-trigger-copy-phase
>     stress/recurse-infinitely-on-getter.js.no-cjit-validate-phases
>     stress/recurse-infinitely-on-getter.js.dfg-eager
>     stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate
I haven't seen these yet.


>     jsc-layout-tests.yaml/js/script-tests/dfg-convert-this-dom-window.js.layout-no-llint
>     jsc-layout-tests.yaml/js/script-tests/dfg-convert-this-dom-window.js.layout-dfg-eager-no-cjit
>     jsc-layout-tests.yaml/js/script-tests/function-call-aliased.js.layout-no-llint
>     jsc-layout-tests.yaml/js/script-tests/function-call-aliased.js.layout-dfg-eager-no-cjit
>     regress/script-tests/call-spread-call.js.default
>     regress/script-tests/call-spread-call.js.no-llint
>     regress/script-tests/call-spread-call.js.always-trigger-copy-phase
>     regress/script-tests/call-spread-call.js.no-cjit-validate-phases
>     regress/script-tests/call-spread-call.js.dfg-eager
>     regress/script-tests/call-spread-call.js.dfg-eager-no-cjit-validate
New bug about these failures: https://bugs.webkit.org/show_bug.cgi?id=129488


>     regress/script-tests/string-cons-tower.js.dfg-eager
>     regress/script-tests/string-cons-tower.js.dfg-eager-no-cjit-validate
New bug about these failures: https://bugs.webkit.org/show_bug.cgi?id=129490
Comment 7 Mark Lam 2014-03-06 23:26:30 PST
The list of failures have changed again.  With r165232, I'm getting the following when running on 32-bit x86:

** The following JSC stress test failures have been introduced:
	stress/equals-masquerader.js.default
	stress/equals-masquerader.js.no-llint
	stress/equals-masquerader.js.always-trigger-copy-phase
	stress/equals-masquerader.js.no-cjit-validate-phases
	stress/equals-masquerader.js.dfg-eager
	stress/equals-masquerader.js.dfg-eager-no-cjit-validate
	stress/recurse-infinitely-on-getter.js.default
	stress/recurse-infinitely-on-getter.js.always-trigger-copy-phase
	stress/recurse-infinitely-on-getter.js.no-cjit-validate-phases
	stress/recurse-infinitely-on-getter.js.dfg-eager
	stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate

Results for JSC stress tests:
    11 failures found.
Comment 8 Csaba Osztrogonác 2014-03-07 04:36:49 PST
(In reply to comment #7)
> The list of failures have changed again.  With r165232, I'm getting the following when running on 32-bit x86:
> 
> ** The following JSC stress test failures have been introduced:
>     stress/equals-masquerader.js.default
>     stress/equals-masquerader.js.no-llint
>     stress/equals-masquerader.js.always-trigger-copy-phase
>     stress/equals-masquerader.js.no-cjit-validate-phases
>     stress/equals-masquerader.js.dfg-eager
>     stress/equals-masquerader.js.dfg-eager-no-cjit-validate

I can confirm these failures on r165256, it seems to be a new regression.

>     stress/recurse-infinitely-on-getter.js.default
>     stress/recurse-infinitely-on-getter.js.always-trigger-copy-phase
>     stress/recurse-infinitely-on-getter.js.no-cjit-validate-phases
>     stress/recurse-infinitely-on-getter.js.dfg-eager
>     stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate

I still haven't see these failures on my Mavericks.

but got 2 other failures:
	jsc-layout-tests.yaml/js/script-tests/reentrant-caching.js.layout-no-llint
	jsc-layout-tests.yaml/js/script-tests/reentrant-caching.js.layout-dfg-eager-no-cjit
Comment 9 Csaba Osztrogonác 2014-03-07 05:20:43 PST
(In reply to comment #7)
> The list of failures have changed again.  With r165232, I'm getting the following when running on 32-bit x86:
> 
> ** The following JSC stress test failures have been introduced:
>     stress/equals-masquerader.js.default
>     stress/equals-masquerader.js.no-llint
>     stress/equals-masquerader.js.always-trigger-copy-phase
>     stress/equals-masquerader.js.no-cjit-validate-phases
>     stress/equals-masquerader.js.dfg-eager
>     stress/equals-masquerader.js.dfg-eager-no-cjit-validate

It is a new test introduced in http://trac.webkit.org/changeset/165119 
and fails from the beginning on 32 bit.
Comment 10 Mark Lam 2014-03-08 00:12:43 PST
The 6 stress/equals-masquerader.js tests now passes with the fix for https://bugs.webkit.org/show_bug.cgi?id=129947.  The 5 stress/recurse-infinitely-on-getter.js testa are still failing.
Comment 11 Mark Lam 2014-03-08 21:08:47 PST
With the fix for https://bugs.webkit.org/show_bug.cgi?id=129969, the stress/recurse-infinitely-on-getter.js tests no longer crashes.  The jsc stress tests are passing completely for me on 32-bit.

I haven't been able to reproduce Ossy's reentrant-caching.js failures.  However, that test also exercises stack overflow errors.  Hence, it is possible that Ossy saw that on his machine and not the stress/recurse-infinitely-on-getter.js because of difference in the compilers we use generating code with difference amount or stack usage, and also different OS'es with different stack sizes.  I think it's reasonable to conclude at this point that the issue has been fixed with https://bugs.webkit.org/show_bug.cgi?id=129969.

Ossy, I'll going this bug as resolved since I don't see anymore jsc stress test failures on x86 32-bit.  If you the failures manifest still, feel free to file a new bug and assign it to me.
Comment 12 Mark Lam 2014-03-08 21:09:35 PST
(In reply to comment #11)
> Ossy, I'll going this bug as resolved since I don't see anymore jsc stress test failures on x86 32-bit.  If you the failures manifest still, feel free to file a new bug and assign it to me.

typo: "going to mark this bug as resolved".
Comment 13 Csaba Osztrogonác 2014-03-10 02:38:44 PDT
All tests pass for me too now. Thanks for fixing them.