Created attachment 245928 [details] fails ** The following JSC stress test failures have been introduced: jsc-layout-tests.yaml/js/script-tests/dfg-inline-arguments-out-of-bounds.js.layout jsc-layout-tests.yaml/js/script-tests/dfg-inline-arguments-out-of-bounds.js.layout-dfg-eager-no-cjit jsc-layout-tests.yaml/js/script-tests/dfg-inline-arguments-out-of-bounds.js.layout-no-cjit jsc-layout-tests.yaml/js/script-tests/dfg-inline-arguments-out-of-bounds.js.layout-no-llint stress/get-my-argument-by-val-inlined-no-formal-parameters.js.always-trigger-copy-phase stress/get-my-argument-by-val-inlined-no-formal-parameters.js.default stress/get-my-argument-by-val-inlined-no-formal-parameters.js.dfg-eager stress/get-my-argument-by-val-inlined-no-formal-parameters.js.dfg-eager-no-cjit-validate stress/get-my-argument-by-val-inlined-no-formal-parameters.js.no-cjit-validate-phases stress/get-my-argument-by-val-inlined-no-formal-parameters.js.no-llint Results for JSC stress tests: 10 failures found. Detailed fail log is attached.
I started to debug this issue, these tests fail only if DFG JIT is enabled, they pass with JSC_useDFGJIT=0 environment variable set, so the bug is somewhere in DFG JIT.
It would be great to have a working disassembler for ARM traditional too to be able debug this bug easily: bug123717
This regression will gone away once the monumental patch in bug141174 landed.
After bug141174 fixed the traditional bot became green.