After bug149061 we still have 20-40 crashes on the AArch64 JSC tester bot: https://build.webkit.org/builders/EFL%20Linux%20AArch64%20Release?numbuilds=200 Maybe http://trac.webkit.org/r192352 ( bug149061 / bug150936 ) didn't fix all issues caused by http://trac.webkit.org/r189575 or maybe it is a new regression happened during the 2 months long breakage. I just filed this bug report not to forget this regression, but won't have time to debug this issue this year. ** The following JSC stress test failures have been introduced: executableAllocationFuzz.yaml/executableAllocationFuzz/v8-raytrace.js.executable-allocation-fuzz-no-cjit jsc-layout-tests.yaml/js/script-tests/dfg-put-by-id-prototype-check.js.layout modules.yaml/modules/defaults.js.no-llint-modules modules.yaml/modules/destructuring-export.js.dfg-eager-no-cjit-validate-modules modules.yaml/modules/exported-function-may-be-called-before-module-is-executed.js.no-llint-modules modules.yaml/modules/fallback-ambiguous.js.no-llint-modules modules.yaml/modules/uncacheable-when-see-star.js.dfg-eager-modules mozilla-tests.yaml/ecma/Date/15.9.3.1-1.js.mozilla-baseline mozilla-tests.yaml/ecma/Date/15.9.5.28-1.js.mozilla-baseline mozilla-tests.yaml/js1_2/function/Number.js.mozilla-baseline mozilla-tests.yaml/js1_2/regexp/RegExp_input.js.mozilla-baseline mozilla-tests.yaml/js1_2/regexp/RegExp_leftContext.js.mozilla-baseline regress/script-tests/Float32Array-matrix-mult.js.dfg-eager-no-cjit-validate regress/script-tests/Float32Array-matrix-mult.js.dfg-maximal-flush-validate-no-cjit regress/script-tests/polymorphic-put-by-id.js.dfg-eager regress/script-tests/raytrace-with-try-catch.js.no-cjit-validate-phases stress/math-clz32-basics.js.dfg-eager stress/multi-put-by-offset-reallocation-butterfly-cse.js.no-llint stress/multi-put-by-offset-reallocation-cases.js.no-llint stress/redundant-array-bounds-checks-addition.js.dfg-maximal-flush-validate-no-cjit stress/v8-deltablue-strict.js.dfg-maximal-flush-validate-no-cjit stress/v8-earley-boyer-strict.js.no-llint stress/v8-raytrace-strict.js.always-trigger-copy-phase stress/v8-raytrace-strict.js.no-llint stress/v8-splay-strict.js.default v8-v6/v8-raytrace.js.dfg-maximal-flush-validate-no-cjit v8-v6/v8-regexp.js.no-llint v8-v6/v8-splay.js.dfg-eager v8-v6/v8-splay.js.no-llint
I tested, it is a regression caused by http://trac.webkit.org/changeset/189575. No failures before it, but 20-40 failures on r189575 + r192352.
These failures aren't exhibited anymore.