RESOLVED FIXED 165669
REGRESSION (r209554-209571): stress/poly-setter-combo crashing
https://bugs.webkit.org/show_bug.cgi?id=165669
Summary REGRESSION (r209554-209571): stress/poly-setter-combo crashing
Alexey Proskuryakov
Reported 2016-12-09 11:57:41 PST
Variations of stress/poly-setter-combo have started to crash yesterday. JSC changes in this range: https://trac.webkit.org/changeset/209560 (wasm) https://trac.webkit.org/changeset/209568 (SharedArrayBuffer) https://trac.webkit.org/changeset/209570 (Concurrent GC)
Attachments
crash log (53.38 KB, text/plain)
2016-12-09 11:59 PST, Alexey Proskuryakov
no flags
the patch (3.37 KB, patch)
2016-12-09 14:26 PST, Filip Pizlo
ggaren: review+
Filip Pizlo
Comment 1 2016-12-09 11:58:16 PST
Crash log?
Alexey Proskuryakov
Comment 2 2016-12-09 11:58:16 PST
Forgot to say, this is on 32-bit JSC test bots.
Filip Pizlo
Comment 3 2016-12-09 11:58:39 PST
(In reply to comment #1) > Crash log? Actually, no need to fish. I'm almost done building and will probably repro shortly..
Alexey Proskuryakov
Comment 4 2016-12-09 11:59:53 PST
Created attachment 296669 [details] crash log
Filip Pizlo
Comment 5 2016-12-09 12:03:35 PST
(In reply to comment #4) > Created attachment 296669 [details] > crash log Thank you!! This is an incredible crash log: it is a typical concurrent GC crash but it's in a config where concurrent GC is disabled. Looking more...
Filip Pizlo
Comment 6 2016-12-09 14:10:56 PST
I have a fix. This is a 32-bit-only bug, not a concurrent GC bug, and we need the fix regardless of whether the concurrent GC is enabled. Testing the fix now...
Filip Pizlo
Comment 7 2016-12-09 14:26:53 PST
Created attachment 296699 [details] the patch
Geoffrey Garen
Comment 8 2016-12-09 14:28:53 PST
Comment on attachment 296699 [details] the patch Ack! r=me
Filip Pizlo
Comment 9 2016-12-09 20:28:24 PST
Note You need to log in before you can comment on or make changes to this bug.