RESOLVED INVALID135026
REGRESSION: New int52 test failures on ARM64, possibly due to r171096 
https://bugs.webkit.org/show_bug.cgi?id=135026
Summary REGRESSION: New int52 test failures on ARM64, possibly due to r171096
Michael Saboff
Reported 2014-07-17 14:41:26 PDT
The test failures below are happening on ARM64 systems. This is possibly due to r171096. stress/dead-fiat-double-to-int52-then-exit-not-int52.js.always-trigger-copy-phase stress/dead-fiat-double-to-int52-then-exit-not-int52.js.default stress/dead-fiat-double-to-int52-then-exit-not-int52.js.dfg-eager stress/dead-fiat-double-to-int52-then-exit-not-int52.js.dfg-eager-no-cjit-validate stress/dead-fiat-double-to-int52-then-exit-not-int52.js.no-cjit-validate-phases stress/dead-fiat-double-to-int52-then-exit-not-int52.js.no-llint stress/dead-fiat-double-to-int52.js.always-trigger-copy-phase stress/dead-fiat-double-to-int52.js.default stress/dead-fiat-double-to-int52.js.dfg-eager stress/dead-fiat-double-to-int52.js.dfg-eager-no-cjit-validate stress/dead-fiat-double-to-int52.js.no-cjit-validate-phases stress/dead-fiat-double-to-int52.js.no-llint stress/dead-fiat-int32-to-int52.js.always-trigger-copy-phase stress/dead-fiat-int32-to-int52.js.default stress/dead-fiat-int32-to-int52.js.dfg-eager stress/dead-fiat-int32-to-int52.js.dfg-eager-no-cjit-validate stress/dead-fiat-int32-to-int52.js.no-cjit-validate-phases stress/dead-fiat-int32-to-int52.js.no-llint stress/dead-fiat-value-to-int52-double-path.js.always-trigger-copy-phase stress/dead-fiat-value-to-int52-double-path.js.default stress/dead-fiat-value-to-int52-double-path.js.dfg-eager stress/dead-fiat-value-to-int52-double-path.js.dfg-eager-no-cjit-validate stress/dead-fiat-value-to-int52-double-path.js.no-cjit-validate-phases stress/dead-fiat-value-to-int52-double-path.js.no-llint stress/dead-fiat-value-to-int52-then-exit-not-double.js.always-trigger-copy-phase stress/dead-fiat-value-to-int52-then-exit-not-double.js.default stress/dead-fiat-value-to-int52-then-exit-not-double.js.dfg-eager stress/dead-fiat-value-to-int52-then-exit-not-double.js.dfg-eager-no-cjit-validate stress/dead-fiat-value-to-int52-then-exit-not-double.js.no-cjit-validate-phases stress/dead-fiat-value-to-int52-then-exit-not-double.js.no-llint stress/dead-fiat-value-to-int52-then-exit-not-int52.js.always-trigger-copy-phase stress/dead-fiat-value-to-int52-then-exit-not-int52.js.default stress/dead-fiat-value-to-int52-then-exit-not-int52.js.dfg-eager stress/dead-fiat-value-to-int52-then-exit-not-int52.js.dfg-eager-no-cjit-validate stress/dead-fiat-value-to-int52-then-exit-not-int52.js.no-cjit-validate-phases stress/dead-fiat-value-to-int52-then-exit-not-int52.js.no-llint stress/dead-fiat-value-to-int52.js.always-trigger-copy-phase stress/dead-fiat-value-to-int52.js.default stress/dead-fiat-value-to-int52.js.dfg-eager stress/dead-fiat-value-to-int52.js.dfg-eager-no-cjit-validate stress/dead-fiat-value-to-int52.js.no-cjit-validate-phases stress/dead-fiat-value-to-int52.js.no-llint stress/fiat-double-to-int52-then-exit-not-int52.js.always-trigger-copy-phase stress/fiat-double-to-int52-then-exit-not-int52.js.default stress/fiat-double-to-int52-then-exit-not-int52.js.dfg-eager stress/fiat-double-to-int52-then-exit-not-int52.js.dfg-eager-no-cjit-validate stress/fiat-double-to-int52-then-exit-not-int52.js.no-cjit-validate-phases stress/fiat-double-to-int52-then-exit-not-int52.js.no-llint stress/fiat-double-to-int52-then-fail-to-fold.js.always-trigger-copy-phase stress/fiat-double-to-int52-then-fail-to-fold.js.default stress/fiat-double-to-int52-then-fail-to-fold.js.dfg-eager stress/fiat-double-to-int52-then-fail-to-fold.js.dfg-eager-no-cjit-validate stress/fiat-double-to-int52-then-fail-to-fold.js.no-cjit-validate-phases stress/fiat-double-to-int52-then-fail-to-fold.js.no-llint stress/fiat-double-to-int52-then-fold.js.always-trigger-copy-phase stress/fiat-double-to-int52-then-fold.js.default stress/fiat-double-to-int52-then-fold.js.dfg-eager stress/fiat-double-to-int52-then-fold.js.dfg-eager-no-cjit-validate stress/fiat-double-to-int52-then-fold.js.no-cjit-validate-phases stress/fiat-double-to-int52-then-fold.js.no-llint stress/fiat-double-to-int52.js.always-trigger-copy-phase stress/fiat-double-to-int52.js.default stress/fiat-double-to-int52.js.dfg-eager stress/fiat-double-to-int52.js.dfg-eager-no-cjit-validate stress/fiat-double-to-int52.js.no-cjit-validate-phases stress/fiat-double-to-int52.js.no-llint stress/fiat-int32-to-int52.js.always-trigger-copy-phase stress/fiat-int32-to-int52.js.default stress/fiat-int32-to-int52.js.dfg-eager stress/fiat-int32-to-int52.js.dfg-eager-no-cjit-validate stress/fiat-int32-to-int52.js.no-cjit-validate-phases stress/fiat-int32-to-int52.js.no-llint stress/fiat-value-to-int52-double-path.js.always-trigger-copy-phase stress/fiat-value-to-int52-double-path.js.default stress/fiat-value-to-int52-double-path.js.dfg-eager stress/fiat-value-to-int52-double-path.js.dfg-eager-no-cjit-validate stress/fiat-value-to-int52-double-path.js.no-cjit-validate-phases stress/fiat-value-to-int52-double-path.js.no-llint stress/fiat-value-to-int52-then-exit-not-double.js.always-trigger-copy-phase stress/fiat-value-to-int52-then-exit-not-double.js.default stress/fiat-value-to-int52-then-exit-not-double.js.dfg-eager stress/fiat-value-to-int52-then-exit-not-double.js.dfg-eager-no-cjit-validate stress/fiat-value-to-int52-then-exit-not-double.js.no-cjit-validate-phases stress/fiat-value-to-int52-then-exit-not-double.js.no-llint stress/fiat-value-to-int52-then-exit-not-int52.js.always-trigger-copy-phase stress/fiat-value-to-int52-then-exit-not-int52.js.default stress/fiat-value-to-int52-then-exit-not-int52.js.dfg-eager stress/fiat-value-to-int52-then-exit-not-int52.js.dfg-eager-no-cjit-validate stress/fiat-value-to-int52-then-exit-not-int52.js.no-cjit-validate-phases stress/fiat-value-to-int52-then-exit-not-int52.js.no-llint stress/fiat-value-to-int52-then-fail-to-fold.js.always-trigger-copy-phase stress/fiat-value-to-int52-then-fail-to-fold.js.default stress/fiat-value-to-int52-then-fail-to-fold.js.dfg-eager stress/fiat-value-to-int52-then-fail-to-fold.js.dfg-eager-no-cjit-validate stress/fiat-value-to-int52-then-fail-to-fold.js.no-cjit-validate-phases stress/fiat-value-to-int52-then-fail-to-fold.js.no-llint stress/fiat-value-to-int52-then-fold.js.always-trigger-copy-phase stress/fiat-value-to-int52-then-fold.js.default stress/fiat-value-to-int52-then-fold.js.dfg-eager stress/fiat-value-to-int52-then-fold.js.dfg-eager-no-cjit-validate stress/fiat-value-to-int52-then-fold.js.no-cjit-validate-phases stress/fiat-value-to-int52-then-fold.js.no-llint stress/fiat-value-to-int52.js.always-trigger-copy-phase stress/fiat-value-to-int52.js.default stress/fiat-value-to-int52.js.dfg-eager stress/fiat-value-to-int52.js.dfg-eager-no-cjit-validate stress/fiat-value-to-int52.js.no-cjit-validate-phases stress/fiat-value-to-int52.js.no-llint stress/int52-force-osr-exit-path.js.always-trigger-copy-phase stress/int52-force-osr-exit-path.js.default stress/int52-force-osr-exit-path.js.dfg-eager stress/int52-force-osr-exit-path.js.dfg-eager-no-cjit-validate stress/int52-force-osr-exit-path.js.no-cjit-validate-phases
Attachments
Add attachment proposed patch, testcase, etc.
Michael Saboff
Comment 1 2014-07-17 14:49:37 PDT
Here is the output from one failure, stress/int52-force-osr-exit-path.js.dfg-eager-no-cjit-validate: Found an Int52RepUse to a double result: @27 -> Check:Int52Rep:@23<Double> DFG for foo#BW9ZEJ:[0x10048af40->0x10048b3c0->0x1007cfb70, DFGFunctionCall, 36 (NeverInline)]: Fixpoint state: BeforeFixpoint; Form: ThreadedCPS; Unification state: GloballyUnified; Ref count state: EverythingIsLive Block #0 (bc#0): (OSR target) Execution count: 1.000000 Predecessors: Dominated by: #0 Dominates: #0 #1 #2 vars before: <empty> var links: arg4:@4 arg3:@3 arg2:@2 arg1:@1 arg0:@0 0: < 1:-> SetArgument(arg0(a), W:SideState, bc#0) predicting Otherobj 1: < 1:-> SetArgument(IsFlushed, arg1(B<Int32>/FlushedInt32), W:SideState, bc#0) predicting Int32 2: < 1:-> SetArgument(IsFlushed, arg2(C<Int32>/FlushedInt32), W:SideState, bc#0) predicting Int32 3: < 1:-> SetArgument(IsFlushed, arg3(D<Boolean>/FlushedBoolean), W:SideState, bc#0) predicting Bool 4: < 1:-> SetArgument(IsFlushed, arg4(E<Final>/FlushedCell), W:SideState, bc#0) predicting Final 5: < 1:-> JSConstant(JS|PureInt, Other, $1 = Undefined, bc#0) 6: < 1:-> MovHint(@5, loc0, W:SideState, bc#0) 7: < 1:-> SetLocal(@5, CanExit, loc0(F~<Other>/FlushedJSValue), W:Variables(-1), bc#0) predicting Other 8: < 1:-> GetLocal(@1, JS|PureNum|UseAsOther|CanExit, Int32, arg1(B<Int32>/FlushedInt32), R:Variables(7), bc#1) predicting Int32 9: < 1:-> GetLocal(@2, JS|PureNum|UseAsOther|CanExit, Int32, arg2(C<Int32>/FlushedInt32), R:Variables(8), bc#1) predicting Int32 49: < 1:-> Int52Rep(Check:Int32:@8, Int52|PureInt|CanExit, Int32, bc#1) 50: < 1:-> Int52Rep(Check:Int32:@9, Int52|PureInt|CanExit, Int32, bc#1) 10: < 1:-> ArithAdd(Check:Int52Rep:@49<Int52>, Check:Int52Rep:@50<Int52>, Int52|PureNum|UseAsOther|MayOverflowInBaseline|MayOverflowInDFG|CanExit, Int52, CheckOverflow, bc#1) 51: <!0:-> Phantom(@9, MustGen|CanExit, bc#1) 52: <!0:-> Phantom(@8, MustGen|CanExit, bc#1) 11: < 1:-> MovHint(Check:Int52Rep:@10<Int52>, loc0, W:SideState, bc#1) 12: < 1:-> SetLocal(Check:Int52Rep:@10<Int52>, CanExit, loc0(G<Int52>/FlushedInt52), W:Variables(-1), bc#6) predicting Int52 13: < 1:-> GetLocal(@3, JS|UseAsOther|CanExit, Bool, arg3(D<Boolean>/FlushedBoolean), R:Variables(9), bc#6) predicting Bool 14: <!0:-> Branch(Check:Boolean:@13, MustGen|CanExit, T:#1/w:1.000000, F:#2/w:1.000000, W:SideState, bc#6) vars after: <empty> var links: arg4:@4 arg3:@13 arg2:@9 arg1:@8 arg0:@0 loc0:@12 Block #1 (bc#9): Execution count: 1.000000 Predecessors: #0 Dominated by: #0 #1 Dominates: #1 Phi Nodes: @44<1>->(@12), @45<1>->(@4), @46<1>->(@1), @47<1>->(@2), @48<1>->(@3) vars before: <empty> var links: arg4:@45 arg3:@48 arg2:@47 arg1:@46 loc0:@44 15: < 1:-> GetLocal(@44, Int52|PureNum|UseAsOther|CanExit, Int52, loc0(G<Int52>/FlushedInt52), R:Variables(-1), bc#9) predicting Int52 16: < 1:-> MovHint(Check:Int52Rep:@15<Int52>, loc1, W:SideState, bc#9) 17: < 1:-> SetLocal(@53, CanExit, loc1(I~<Int52>/FlushedJSValue), W:Variables(-2), bc#12) predicting Int52 18: <!0:-> ForceOSRExit(MustGen|CanExit, W:SideState, bc#12) 19: < 1:-> GetLocal(@45, JS|UseAsOther|CanExit, Final, arg4(E<Final>/FlushedCell), R:Variables(10), bc#12) predicting Final 20: <!0:-> GetById(Check:Cell:@19, JS|MustGen|Clobbers|PureNum|UseAsOther|CanExit, id0{f}, R:World, W:World, bc#12) predicting None 21: < 1:-> MovHint(@20, loc2, W:SideState, bc#12) 22: < 1:-> SetLocal(@20, CanExit, loc2(K~/FlushedJSValue), W:Variables(-3), bc#21) predicting None 23: < 1:-> ArithSub(Check:DoubleRep:@55<Double>, Check:DoubleRep:@56<Double>, Double|PureNum|UseAsOther|CanExit, NotSet, bc#21) 24: < 1:-> MovHint(Check:DoubleRep:@23<Double>, loc1, W:SideState, bc#21) 25: < 1:-> SetLocal(@59, CanExit, loc1(L~/FlushedJSValue), W:Variables(-2), bc#26) predicting None 26: < 1:-> MovHint(Check:DoubleRep:@23<Double>, loc0, W:SideState, bc#26) 27: < 1:-> SetLocal(Check:Int52Rep:@23<Double>, CanExit, loc0(G<Int52>/FlushedInt52), W:Variables(-1), bc#29) predicting Int52 28: <!0:-> Jump(MustGen|CanExit, T:#2, W:SideState, bc#29) vars after: <empty> var links: arg4:@19 arg3:@48 arg2:@47 arg1:@46 loc0:@27 loc1:@25 loc2:@22 Block #2 (bc#29): Execution count: 1.000000 Predecessors: #0 #1 Dominated by: #0 #2 Dominates: #2 Phi Nodes: @39<1>->(@27, @12), @40<1>->(@45, @4), @41<1>->(@48, @3), @42<1>->(@47, @2), @43<1>->(@46, @1) vars before: <empty> var links: arg4:@34 arg3:@35 arg2:@36 arg1:@37 loc0:@39 29: < 1:-> GetLocal(@39, Int52|PureNum|UseAsOther|CanExit, Int52, loc0(G<Int52>/FlushedInt52), R:Variables(-1), bc#29) predicting Int52 30: < 1:-> JSConstant(JS|PureNum|UseAsOther, Int32, $0 = Int32: 1, bc#29) 31: < 1:-> ArithAdd(Check:Int52Rep:@29<Int52>, Check:Int52Rep:@30, Int52|UseAsOther|MayOverflowInBaseline|CanExit, Int52, CheckOverflow, bc#29) 32: < 1:-> MovHint(@31<Int52>, loc1, W:SideState, bc#29) 33: < 1:-> SetLocal(@31<Int52>, CanExit, loc1(O~<Int52>/FlushedJSValue), W:Variables(-2), bc#34) predicting Int52 34: <!0:-> Flush(@40, MustGen|IsFlushed, arg4(E<Final>/FlushedCell), W:SideState, bc#34) predicting Final 35: <!0:-> Flush(@41, MustGen|IsFlushed, arg3(D<Boolean>/FlushedBoolean), W:SideState, bc#34) predicting Bool 36: <!0:-> Flush(@42, MustGen|IsFlushed, arg2(C<Int32>/FlushedInt32), W:SideState, bc#34) predicting Int32 37: <!0:-> Flush(@43, MustGen|IsFlushed, arg1(B<Int32>/FlushedInt32), W:SideState, bc#34) predicting Int32 38: <!0:-> Return(@31<Int52>, MustGen|CanExit, W:SideState, bc#34) vars after: <empty> var links: arg4:@34 arg3:@35 arg2:@36 arg1:@37 loc0:@29<Int52> loc1:@33 1 0x186a02224 <redacted> 2 0x1868b3f74 <redacted> 3 0x1868b3c98 <redacted> 4 0x1868b3c30 <redacted> 5 0x186a3d6b0 <redacted> 6 0x186a3d308 <redacted> 7 0x186a0120c <redacted> 8 0x186b1a014 <redacted> 9 0x1432c8c5c 10 0x1432ca200 11 0x186ba3454 <redacted> 12 0x186b10c3c <redacted> 13 0x186852d84 <rRunning regress/script-tests/constant-test.js.no-llint [2014-07-15 12:49:48] INFO: edacted> 14 0x186850e30 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) 15 0x1000f7cb8 16 0x1000f7648 17 0x196772a08 <redacted> ./test_script_1950: line 2: 16616 Segmentation fault: 11 "$@" /System/Library/Frameworks/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --validateGraph\=true --thresholdForJITAfterWarmUp\=10 --thresholdForJITSoon\=10 --thresholdForOptimizeAfterWarmUp\=20 --thresholdForOptimizeAfterLongWarmUp\=20 --thresholdForOptimizeSoon\=20 --thresholdForFTLOptimizeAfterWarmUp\=20 --thresholdForFTLOptimizeSoon\=20 --enableConcurrentJIT\=false --thresholdForJITAfterWarmUp\=100 int52-force-osr-exit-path.js ERROR: Unexpected exit code: 139
Michael Saboff
Comment 2 2014-07-19 14:18:14 PDT
The test failures were due to running new tests on builds that didn't include the corresponding changes.
Note You need to log in before you can comment on or make changes to this bug.