Bug 129318 – Fix JSC stress test failures on 32-bit x86 on Mac

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Mark Lam]

The jsc stress test results running on 32-bit x86 Mac:

stress/recurse-infinitely-on-getter.js.dfg-eager: test_script_5127: line 2: 24956 Bus error: 10           "$@" ../../.vm/JavaScriptCore.framework/Resources/jsc --thresholdForJITAfterWarmUp\=10 --thresholdForJITSoon\=10 --thresholdForOptimizeAfterWarmUp\=20 --thresholdForOptimizeAfterLongWarmUp\=20 --thresholdForOptimizeSoon\=20 --thresholdForFTLOptimizeAfterWarmUp\=20 --thresholdForFTLOptimizeSoon\=20 recurse-infinitely-on-getter.js
stress/recurse-infinitely-on-getter.js.dfg-eager: ERROR: Unexpected exit code: 138
stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate: test_script_5128: line 2: 24966 Bus error: 10           "$@" ../../.vm/JavaScriptCore.framework/Resources/jsc --enableConcurrentJIT\=false --validateGraph\=true --thresholdForJITAfterWarmUp\=10 --thresholdForJITSoon\=10 --thresholdForOptimizeAfterWarmUp\=20 --thresholdForOptimizeAfterLongWarmUp\=20 --thresholdForOptimizeSoon\=20 --thresholdForFTLOptimizeAfterWarmUp\=20 --thresholdForFTLOptimizeSoon\=20 recurse-infinitely-on-getter.js
stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate: ERROR: Unexpected exit code: 138
8388/8388 (failed 2)                 

** The following JSC stress test failures have been introduced:
	stress/recurse-infinitely-on-getter.js.dfg-eager
	stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate

Results for JSC stress tests:
    2 failures found.

[Radar WebKit Bug Importer]

<rdar://problem/16162647>

[Csaba Osztrogonác]

Is this bug still valid? I haven't seen these failures on ToT (r164860) on
Mavericks with 32 bit build.

[Mark Lam]

(In reply to comment #2)
> Is this bug still valid? I haven't seen these failures on ToT (r164860) on
> Mavericks with 32 bit build.

I just did a build and run with r164862, and still saw these.  I also saw 15 other new failures.

[Filip Pizlo]

(In reply to comment #3)
> (In reply to comment #2)
> > Is this bug still valid? I haven't seen these failures on ToT (r164860) on
> > Mavericks with 32 bit build.
> 
> I just did a build and run with r164862, and still saw these.  I also saw 15 other new failures.

Can you post the 15 new ones here?

At some point we should whip the 32-bit code into shape. :-/

[Mark Lam]

Here's the complete list:

** The following JSC stress test failures have been introduced:
	stress/recurse-infinitely-on-getter.js.default
	stress/recurse-infinitely-on-getter.js.always-trigger-copy-phase
	stress/recurse-infinitely-on-getter.js.no-cjit-validate-phases
	stress/recurse-infinitely-on-getter.js.dfg-eager
	stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate
	regress/script-tests/call-spread-call.js.default
	regress/script-tests/call-spread-call.js.no-llint
	regress/script-tests/call-spread-call.js.always-trigger-copy-phase
	regress/script-tests/call-spread-call.js.no-cjit-validate-phases
	regress/script-tests/call-spread-call.js.dfg-eager
	regress/script-tests/call-spread-call.js.dfg-eager-no-cjit-validate
	regress/script-tests/string-cons-tower.js.dfg-eager
	regress/script-tests/string-cons-tower.js.dfg-eager-no-cjit-validate
	jsc-layout-tests.yaml/js/script-tests/dfg-convert-this-dom-window.js.layout-no-llint
	jsc-layout-tests.yaml/js/script-tests/dfg-convert-this-dom-window.js.layout-dfg-eager-no-cjit
	jsc-layout-tests.yaml/js/script-tests/function-call-aliased.js.layout-no-llint
	jsc-layout-tests.yaml/js/script-tests/function-call-aliased.js.layout-dfg-eager-no-cjit

Results for JSC stress tests:
    17 failures found.

[Csaba Osztrogonác]

(In reply to comment #5)
> Here's the complete list:
> 
> ** The following JSC stress test failures have been introduced:
>     stress/recurse-infinitely-on-getter.js.default
>     stress/recurse-infinitely-on-getter.js.always-trigger-copy-phase
>     stress/recurse-infinitely-on-getter.js.no-cjit-validate-phases
>     stress/recurse-infinitely-on-getter.js.dfg-eager
>     stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate
I haven't seen these yet.


>     jsc-layout-tests.yaml/js/script-tests/dfg-convert-this-dom-window.js.layout-no-llint
>     jsc-layout-tests.yaml/js/script-tests/dfg-convert-this-dom-window.js.layout-dfg-eager-no-cjit
>     jsc-layout-tests.yaml/js/script-tests/function-call-aliased.js.layout-no-llint
>     jsc-layout-tests.yaml/js/script-tests/function-call-aliased.js.layout-dfg-eager-no-cjit
>     regress/script-tests/call-spread-call.js.default
>     regress/script-tests/call-spread-call.js.no-llint
>     regress/script-tests/call-spread-call.js.always-trigger-copy-phase
>     regress/script-tests/call-spread-call.js.no-cjit-validate-phases
>     regress/script-tests/call-spread-call.js.dfg-eager
>     regress/script-tests/call-spread-call.js.dfg-eager-no-cjit-validate
New bug about these failures: https://bugs.webkit.org/show_bug.cgi?id=129488


>     regress/script-tests/string-cons-tower.js.dfg-eager
>     regress/script-tests/string-cons-tower.js.dfg-eager-no-cjit-validate
New bug about these failures: https://bugs.webkit.org/show_bug.cgi?id=129490

[Mark Lam]

The list of failures have changed again.  With r165232, I'm getting the following when running on 32-bit x86:

** The following JSC stress test failures have been introduced:
	stress/equals-masquerader.js.default
	stress/equals-masquerader.js.no-llint
	stress/equals-masquerader.js.always-trigger-copy-phase
	stress/equals-masquerader.js.no-cjit-validate-phases
	stress/equals-masquerader.js.dfg-eager
	stress/equals-masquerader.js.dfg-eager-no-cjit-validate
	stress/recurse-infinitely-on-getter.js.default
	stress/recurse-infinitely-on-getter.js.always-trigger-copy-phase
	stress/recurse-infinitely-on-getter.js.no-cjit-validate-phases
	stress/recurse-infinitely-on-getter.js.dfg-eager
	stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate

Results for JSC stress tests:
    11 failures found.

[Csaba Osztrogonác]

(In reply to comment #7)
> The list of failures have changed again.  With r165232, I'm getting the following when running on 32-bit x86:
> 
> ** The following JSC stress test failures have been introduced:
>     stress/equals-masquerader.js.default
>     stress/equals-masquerader.js.no-llint
>     stress/equals-masquerader.js.always-trigger-copy-phase
>     stress/equals-masquerader.js.no-cjit-validate-phases
>     stress/equals-masquerader.js.dfg-eager
>     stress/equals-masquerader.js.dfg-eager-no-cjit-validate

I can confirm these failures on r165256, it seems to be a new regression.

>     stress/recurse-infinitely-on-getter.js.default
>     stress/recurse-infinitely-on-getter.js.always-trigger-copy-phase
>     stress/recurse-infinitely-on-getter.js.no-cjit-validate-phases
>     stress/recurse-infinitely-on-getter.js.dfg-eager
>     stress/recurse-infinitely-on-getter.js.dfg-eager-no-cjit-validate

I still haven't see these failures on my Mavericks.

but got 2 other failures:
	jsc-layout-tests.yaml/js/script-tests/reentrant-caching.js.layout-no-llint
	jsc-layout-tests.yaml/js/script-tests/reentrant-caching.js.layout-dfg-eager-no-cjit

[Csaba Osztrogonác]

(In reply to comment #7)
> The list of failures have changed again.  With r165232, I'm getting the following when running on 32-bit x86:
> 
> ** The following JSC stress test failures have been introduced:
>     stress/equals-masquerader.js.default
>     stress/equals-masquerader.js.no-llint
>     stress/equals-masquerader.js.always-trigger-copy-phase
>     stress/equals-masquerader.js.no-cjit-validate-phases
>     stress/equals-masquerader.js.dfg-eager
>     stress/equals-masquerader.js.dfg-eager-no-cjit-validate

It is a new test introduced in http://trac.webkit.org/changeset/165119 
and fails from the beginning on 32 bit.

[Mark Lam]

The 6 stress/equals-masquerader.js tests now passes with the fix for https://bugs.webkit.org/show_bug.cgi?id=129947.  The 5 stress/recurse-infinitely-on-getter.js testa are still failing.

[Mark Lam]

With the fix for https://bugs.webkit.org/show_bug.cgi?id=129969, the stress/recurse-infinitely-on-getter.js tests no longer crashes.  The jsc stress tests are passing completely for me on 32-bit.

I haven't been able to reproduce Ossy's reentrant-caching.js failures.  However, that test also exercises stack overflow errors.  Hence, it is possible that Ossy saw that on his machine and not the stress/recurse-infinitely-on-getter.js because of difference in the compilers we use generating code with difference amount or stack usage, and also different OS'es with different stack sizes.  I think it's reasonable to conclude at this point that the issue has been fixed with https://bugs.webkit.org/show_bug.cgi?id=129969.

Ossy, I'll going this bug as resolved since I don't see anymore jsc stress test failures on x86 32-bit.  If you the failures manifest still, feel free to file a new bug and assign it to me.

[Mark Lam]

(In reply to comment #11)
> Ossy, I'll going this bug as resolved since I don't see anymore jsc stress test failures on x86 32-bit.  If you the failures manifest still, feel free to file a new bug and assign it to me.

typo: "going to mark this bug as resolved".

[Csaba Osztrogonác]

All tests pass for me too now. Thanks for fixing them.