Bug 131798 - REGRESSION: ASSERT(!typeInfo().hasImpureGetOwnPropertySlot() || typeInfo().newImpurePropertyFiresWatchpoints()) on jquery tests
Summary: REGRESSION: ASSERT(!typeInfo().hasImpureGetOwnPropertySlot() || typeInfo().ne...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: CSS (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Filip Pizlo
URL:
Keywords: InRadar, Regression
Depends on:
Blocks: 131810
  Show dependency tree / graph
 
Reported: 2014-04-17 11:37 PDT by Alexey Proskuryakov
Modified: 2014-04-17 20:02 PDT (History)
2 users (show)

See Also:

Attachments
the patch (2.62 KB, patch)
2014-04-17 13:48 PDT, Filip Pizlo 		ap: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexey Proskuryakov 2014-04-17 11:37:41 PDT 
jquery tests started to fail with assertions very frequently yesterday:

http://build.webkit.org/results/Apple%20MountainLion%20(Leaks)/r167385%20(10109)/jquery/attributes-crash-log.txt

ASSERT(!typeInfo().hasImpureGetOwnPropertySlot() || typeInfo().newImpurePropertyFiresWatchpoints())
Thread 17 Crashed:: JSC Compilation Thread
0   com.apple.JavaScriptCore      	0x000000010e5e544a WTFCrash + 42 (Assertions.cpp:333)
1   com.apple.JavaScriptCore      	0x000000010e20453e JSC::Structure::takesSlowPathInDFGForImpureProperty() + 174 (Structure.h:149)
2   com.apple.JavaScriptCore      	0x000000010e203172 JSC::GetByIdStatus::computeForStubInfo(JSC::ConcurrentJITLocker const&, JSC::CodeBlock*, JSC::StructureStubInfo*, WTF::StringImpl*) + 1586 (GetByIdStatus.cpp:221)
3   com.apple.JavaScriptCore      	0x000000010e2029a3 JSC::GetByIdStatus::computeFor(JSC::CodeBlock*, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, unsigned int, WTF::StringImpl*) + 179 (GetByIdStatus.cpp:151)
4   com.apple.JavaScriptCore      	0x000000010e203eef JSC::GetByIdStatus::computeFor(JSC::CodeBlock*, JSC::CodeBlock*, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, JSC::CodeOrigin, WTF::StringImpl*) + 703 (GetByIdStatus.cpp:325)
5   com.apple.JavaScriptCore      	0x000000010e019514 JSC::DFG::ByteCodeParser::parseBlock(unsigned int) + 15412 (DFGByteCodeParser.cpp:2660)
6   com.apple.JavaScriptCore      	0x000000010e013a02 JSC::DFG::ByteCodeParser::parseCodeBlock() + 1970 (DFGByteCodeParser.cpp:3600)
7   com.apple.JavaScriptCore      	0x000000010e01f8d8 JSC::DFG::ByteCodeParser::parse() + 968 (DFGByteCodeParser.cpp:3660)
8   com.apple.JavaScriptCore      	0x000000010e01fc0e JSC::DFG::parse(JSC::DFG::Graph&) + 62 (DFGByteCodeParser.cpp:3685)
9   com.apple.JavaScriptCore      	0x000000010e13a111 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) + 193 (DFGPlan.cpp:193)
Comment 1 Alexey Proskuryakov 2014-04-17 11:40:04 PDT 
Hmm, looks like most of the tests crashes once, and were good since then, but jquery/attributes.html is not.
Comment 2 Alexey Proskuryakov 2014-04-17 11:40:18 PDT 
s/crashes/crashed/
Comment 3 Filip Pizlo 2014-04-17 13:20:43 PDT 
OMG I hate this assertion so much.  It's time to kill it.
Comment 4 Filip Pizlo 2014-04-17 13:48:14 PDT 
Created attachment 229571 [details]
the patch
Comment 5 Filip Pizlo 2014-04-17 15:20:54 PDT 
Landed in http://trac.webkit.org/changeset/167452
Comment 6 David Kilzer (:ddkilzer) 2014-04-17 20:02:17 PDT 
<rdar://problem/15705242>