Bug 141193 – REGRESSION(r179538): It made 2 tests fail on ARM traditional

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Csaba Osztrogonác]

Created attachment 245928 [details]
fails

** The following JSC stress test failures have been introduced:
	jsc-layout-tests.yaml/js/script-tests/dfg-inline-arguments-out-of-bounds.js.layout
	jsc-layout-tests.yaml/js/script-tests/dfg-inline-arguments-out-of-bounds.js.layout-dfg-eager-no-cjit
	jsc-layout-tests.yaml/js/script-tests/dfg-inline-arguments-out-of-bounds.js.layout-no-cjit
	jsc-layout-tests.yaml/js/script-tests/dfg-inline-arguments-out-of-bounds.js.layout-no-llint
	stress/get-my-argument-by-val-inlined-no-formal-parameters.js.always-trigger-copy-phase
	stress/get-my-argument-by-val-inlined-no-formal-parameters.js.default
	stress/get-my-argument-by-val-inlined-no-formal-parameters.js.dfg-eager
	stress/get-my-argument-by-val-inlined-no-formal-parameters.js.dfg-eager-no-cjit-validate
	stress/get-my-argument-by-val-inlined-no-formal-parameters.js.no-cjit-validate-phases
	stress/get-my-argument-by-val-inlined-no-formal-parameters.js.no-llint

Results for JSC stress tests:
    10 failures found.

Detailed fail log is attached.

[Csaba Osztrogonác]

I started to debug this issue, these tests fail only if DFG JIT 
is enabled, they pass with JSC_useDFGJIT=0 environment variable set,
so the bug is somewhere in DFG JIT.

[Csaba Osztrogonác]

It would be great to have a working disassembler for ARM traditional too
to be able debug this bug easily: bug123717

[Csaba Osztrogonác]

This regression will gone away once the monumental patch in bug141174 landed.

[Csaba Osztrogonác]

After bug141174 fixed the traditional bot became green.