Bug 166873 - REGRESSION (r210522): ASSERTION FAILED: divot.offset >= divotStart.offset seen with stress/import-basic.js and stress/import-from-eval.js
Summary: REGRESSION (r210522): ASSERTION FAILED: divot.offset >= divotStart.offset see...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: Other
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Yusuke Suzuki
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-01-09 18:03 PST by Ryan Haddad
Modified: 2017-01-09 20:20 PST (History)
6 users (show)

See Also:

Attachments
Patch (1.57 KB, patch)
2017-01-09 18:24 PST, Yusuke Suzuki 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ryan Haddad 2017-01-09 18:03:19 PST 
stress/import-basic.js.default: ASSERTION FAILED: divot.offset >= divotStart.offset
stress/import-basic.js.default: /Volumes/Data/slave/elcapitan-debug/build/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h(518) : void JSC::BytecodeGenerator::emitExpressionInfo(const JSC::JSTextPosition &, const JSC::JSTextPosition &, const JSC::JSTextPosition &)
stress/import-basic.js.default: 1   0x104e48a20 WTFCrash
stress/import-basic.js.default: 2   0x103f7c478 JSC::BytecodeGenerator::emitExpressionInfo(JSC::JSTextPosition const&, JSC::JSTextPosition const&, JSC::JSTextPosition const&)
stress/import-basic.js.default: 3   0x103f69605 JSC::BytecodeGenerator::emitCall(JSC::OpcodeID, JSC::RegisterID*, JSC::RegisterID*, JSC::ExpectedFunction, JSC::CallArguments&, JSC::JSTextPosition const&, JSC::JSTextPosition const&, JSC::JSTextPosition const&, JSC::DebuggableCall)
stress/import-basic.js.default: 4   0x103f5c031 JSC::BytecodeGenerator::emitCall(JSC::RegisterID*, JSC::RegisterID*, JSC::ExpectedFunction, JSC::CallArguments&, JSC::JSTextPosition const&, JSC::JSTextPosition const&, JSC::JSTextPosition const&, JSC::DebuggableCall)
stress/import-basic.js.default: 5   0x104a56408 JSC::ImportNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
stress/import-basic.js.default: 6   0x103f8a6b2 JSC::BytecodeGenerator::emitNodeInTailPosition(JSC::RegisterID*, JSC::ExpressionNode*)
stress/import-basic.js.default: 7   0x103f775ae JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::ExpressionNode*)
stress/import-basic.js.default: 8   0x104a71135 JSC::AwaitExprNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
stress/import-basic.js.default: 9   0x103f8a6b2 JSC::BytecodeGenerator::emitNodeInTailPosition(JSC::RegisterID*, JSC::ExpressionNode*)
stress/import-basic.js.default: 10  0x103f775ae JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::ExpressionNode*)
stress/import-basic.js.default: 11  0x104a72739 JSC::DestructuringAssignmentNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
stress/import-basic.js.default: 12  0x103f8a6b2 JSC::BytecodeGenerator::emitNodeInTailPosition(JSC::RegisterID*, JSC::ExpressionNode*)
stress/import-basic.js.default: 13  0x103f775ae JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::ExpressionNode*)
stress/import-basic.js.default: 14  0x104a79fc4 JSC::BytecodeGenerator::emitNode(JSC::ExpressionNode*)
stress/import-basic.js.default: 15  0x104a69c28 JSC::DeclarationStatement::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
stress/import-basic.js.default: 16  0x104a7b452 JSC::BytecodeGenerator::emitNodeInTailPosition(JSC::RegisterID*, JSC::StatementNode*)
stress/import-basic.js.default: 17  0x104a7b31e JSC::SourceElements::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
stress/import-basic.js.default: 18  0x104a69a7c JSC::BlockNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
stress/import-basic.js.default: 19  0x104a7b452 JSC::BytecodeGenerator::emitNodeInTailPosition(JSC::RegisterID*, JSC::StatementNode*)
stress/import-basic.js.default: 20  0x104a7b31e JSC::SourceElements::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
stress/import-basic.js.default: 21  0x104a7b9ba JSC::ScopeNode::emitStatementsBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
stress/import-basic.js.default: 22  0x104a70853 JSC::FunctionNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
stress/import-basic.js.default: 23  0x103f54a55 JSC::BytecodeGenerator::generate()
stress/import-basic.js.default: 24  0x104d0f948 JSC::ParserError JSC::BytecodeGenerator::generate<JSC::FunctionNode*, JSC::UnlinkedFunctionCodeBlock*&, JSC::DebuggerMode&, JSC::VariableEnvironment const*>(JSC::VM&, JSC::FunctionNode*&&, JSC::UnlinkedFunctionCodeBlock*&&&, JSC::DebuggerMode&&&, JSC::VariableEnvironment const*&&)
stress/import-basic.js.default: 25  0x104d0e29c JSC::generateUnlinkedFunctionCodeBlock(JSC::VM&, JSC::UnlinkedFunctionExecutable*, JSC::SourceCode const&, JSC::CodeSpecializationKind, JSC::DebuggerMode, JSC::UnlinkedFunctionKind, JSC::ParserError&, JSC::SourceParseMode)
stress/import-basic.js.default: 26  0x104d0dbaa JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor(JSC::VM&, JSC::SourceCode const&, JSC::CodeSpecializationKind, JSC::DebuggerMode, JSC::ParserError&, JSC::SourceParseMode)
stress/import-basic.js.default: 27  0x104c780c4 JSC::ScriptExecutable::newCodeBlockFor(JSC::CodeSpecializationKind, JSC::JSFunction*, JSC::JSScope*, JSC::JSObject*&)
stress/import-basic.js.default: 28  0x104c787fb JSC::ScriptExecutable::prepareForExecutionImpl(JSC::VM&, JSC::JSFunction*, JSC::JSScope*, JSC::CodeSpecializationKind, JSC::CodeBlock*&)
stress/import-basic.js.default: 29  0x1047c9800 JSC::JSObject* JSC::ScriptExecutable::prepareForExecution<JSC::FunctionExecutable>(JSC::VM&, JSC::JSFunction*, JSC::JSScope*, JSC::CodeSpecializationKind, JSC::CodeBlock*&)
stress/import-basic.js.default: 30  0x104a01589 JSC::LLInt::setUpCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*)
stress/import-basic.js.default: 31  0x104a00fb6 JSC::LLInt::genericCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind)
stress/import-basic.js.default: test_script_8938: line 2: 39680 Segmentation fault: 11  ( "$@" ../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --useFunctionDotArguments\=true --maxPerThreadStackUsage\=1572864 --useFTLJIT\=true import-basic.js )
stress/import-basic.js.default: ERROR: Unexpected exit code: 139

** The following JSC stress test failures have been introduced:
	stress/import-basic.js.default
	stress/import-basic.js.dfg-eager
	stress/import-basic.js.dfg-eager-no-cjit-validate
	stress/import-basic.js.dfg-maximal-flush-validate-no-cjit
	stress/import-basic.js.ftl-eager
	stress/import-basic.js.ftl-eager-no-cjit
	stress/import-basic.js.ftl-no-cjit-no-inline-validate
	stress/import-basic.js.ftl-no-cjit-no-put-stack-validate
	stress/import-basic.js.ftl-no-cjit-small-pool
	stress/import-basic.js.ftl-no-cjit-validate-sampling-profiler
	stress/import-basic.js.no-cjit-validate-phases
	stress/import-basic.js.no-ftl
	stress/import-basic.js.no-llint
	stress/import-from-eval.js.default
	stress/import-from-eval.js.dfg-eager
	stress/import-from-eval.js.dfg-eager-no-cjit-validate
	stress/import-from-eval.js.dfg-maximal-flush-validate-no-cjit
	stress/import-from-eval.js.ftl-eager
	stress/import-from-eval.js.ftl-eager-no-cjit
	stress/import-from-eval.js.ftl-no-cjit-no-inline-validate
	stress/import-from-eval.js.ftl-no-cjit-no-put-stack-validate
	stress/import-from-eval.js.ftl-no-cjit-small-pool
	stress/import-from-eval.js.ftl-no-cjit-validate-sampling-profiler
	stress/import-from-eval.js.no-cjit-validate-phases
	stress/import-from-eval.js.no-ftl
	stress/import-from-eval.js.no-llint
Comment 2 Ryan Haddad 2017-01-09 18:06:09 PST 
The failing tests were added with https://trac.webkit.org/changeset/210522
Comment 3 Yusuke Suzuki 2017-01-09 18:24:10 PST 
Created attachment 298429 [details]
Patch
Comment 4 Yusuke Suzuki 2017-01-09 19:56:52 PST 
Comment on attachment 298429 [details]
Patch

Thanks!
Comment 5 WebKit Commit Bot 2017-01-09 20:20:45 PST 
Comment on attachment 298429 [details]
Patch

Clearing flags on attachment: 298429

Committed r210535: <http://trac.webkit.org/changeset/210535>
Comment 6 WebKit Commit Bot 2017-01-09 20:20:49 PST 
All reviewed patches have been landed.  Closing bug.