Bug 137404 – REGRESSION(r174226): [JSC] Crash when running the perf test Speedometer/Full.html

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Carlos Alberto Lopez Perez]

The performance test Speedometer/Full.html is crashing since r174226 <http://trac.webkit.org/r174226>

I have double checked this: locally reverting r174226 fixes the issue.

I'm attaching a backtrace from the GTK port that I obtained running the following command on r174267:

$ Tools/Scripts/run-perf-tests  --platform gtk --release -2 Speedometer/Full.html

The issue is not GTK specific, it happens on all platforms:

 * https://build.webkit.org/builders/Apple%20MountainLion%20Release%20%28Perf%29/builds/10186
 * https://build.webkit.org/builders/Apple%20Mavericks%20Release%20%28Perf%29/builds/2725
 * https://build.webkit.org/builders/EFL%20Linux%2064-bit%20Release%20WK2%20%28Perf%29/builds/3378
 * https://build.webkit.org/builders/GTK%20Linux%2064-bit%20Release%20%28Perf%29/builds/944

[Carlos Alberto Lopez Perez]

Created attachment 239235 [details]
GDB Backtrace for the GTK port when running the perft test Speedometer/Full.html

[Oliver Hunt]

investigating

[Alexey Proskuryakov]

#0  0x00007f9b78a7c96d in JSC::ExecState::lexicalEnvironment() const ()
#1  0x00007f9b78b7f20c in JSC::Arguments::getOwnPropertySlotByIndex(JSC::JSObject*, JSC::ExecState*, unsigned int, JSC::PropertySlot&) ()
#2  0x00007f9b78d2c3b5 in JSC::LLInt::getByVal(JSC::ExecState*, JSC::JSValue, JSC::JSValue) ()
#3  0x00007f9b78d244e2 in llint_slow_path_get_by_val ()

[Oliver Hunt]

Ok, this is a stupid mistake on my part. Fixing.

[Oliver Hunt]

Created attachment 239342 [details]
Patch

[Michael Saboff]

Comment on attachment 239342 [details]
Patch

r=me

[Oliver Hunt]

Committed r174359: <http://trac.webkit.org/changeset/174359>

[Alexey Proskuryakov]

*** Bug 137452 has been marked as a duplicate of this bug. ***