Bug 191271 - Multiple stress/regexp-compile-oom.js tests are failing on High Sierra Debug and Release JSC testers.
Summary: Multiple stress/regexp-compile-oom.js tests are failing on High Sierra Debug ...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Michael Saboff
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2018-11-05 10:03 PST by Matt Lewis
Modified: 2022-02-27 23:29 PST (History)
8 users (show)

See Also:


Attachments
Patch (11.44 KB, patch)
2018-11-05 16:58 PST, Michael Saboff
saam: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Matt Lewis 2018-11-05 10:03:21 PST
the JSC test stress/regexp-compile-oom.js.dfg-maximal-flush-validate-no-cjit on JSC release High Sierra nd about 15 failures on Debug as well:
	stress/regexp-compile-oom.js.default
	stress/regexp-compile-oom.js.dfg-eager
	stress/regexp-compile-oom.js.dfg-eager-no-cjit-validate
	stress/regexp-compile-oom.js.dfg-maximal-flush-validate-no-cjit
	stress/regexp-compile-oom.js.ftl-eager
	stress/regexp-compile-oom.js.ftl-eager-no-cjit
	stress/regexp-compile-oom.js.ftl-eager-no-cjit-b3o1
	stress/regexp-compile-oom.js.ftl-no-cjit-b3o1
	stress/regexp-compile-oom.js.ftl-no-cjit-no-inline-validate
	stress/regexp-compile-oom.js.ftl-no-cjit-no-put-stack-validate
	stress/regexp-compile-oom.js.ftl-no-cjit-small-pool
	stress/regexp-compile-oom.js.ftl-no-cjit-validate-sampling-profiler
	stress/regexp-compile-oom.js.no-cjit-validate-phases
	stress/regexp-compile-oom.js.no-ftl
	stress/regexp-compile-oom.js.no-llint


https://build.webkit.org/builders/Apple%20High%20Sierra%20Release%20JSC%20%28Tests%29/builds/6416/steps/jscore-test/logs/stdio
https://build.webkit.org/builders/Apple%20High%20Sierra%20Debug%20JSC%20%28Tests%29/builds/1687/steps/jscore-test/logs/stdio


This happened after:
https://trac.webkit.org/changeset/237763/webkit

Example assertion failure
 ASSERTION FAILED: !m_needExceptionCheck
stress/regexp-compile-oom.js.default: ./runtime/VM.cpp(1211) : void JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation &)
stress/regexp-compile-oom.js.default: 1   0x102b1d4a9 WTFCrash
stress/regexp-compile-oom.js.default: 2   0x102b1e3ab WTFCrashWithInfo(int, char const*, char const*, int)
stress/regexp-compile-oom.js.default: 3   0x1041b8cab JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation&)
stress/regexp-compile-oom.js.default: 4   0x1041911cd JSC::ThrowScope::~ThrowScope()
stress/regexp-compile-oom.js.default: 5   0x104191635 JSC::ThrowScope::~ThrowScope()
stress/regexp-compile-oom.js.default: 6   0x1038c22f4 JSC::RegExpObject::matchInline(JSC::ExecState*, JSC::JSGlobalObject*, JSC::JSString*)
stress/regexp-compile-oom.js.default: 7   0x104124e5d JSC::RegExpObject::match(JSC::ExecState*, JSC::JSGlobalObject*, JSC::JSString*)
stress/regexp-compile-oom.js.default: 8   0x1038a732d JSC::RegExpObject::test(JSC::ExecState*, JSC::JSGlobalObject*, JSC::JSString*)
stress/regexp-compile-oom.js.default: 9   0x104128a7a JSC::regExpProtoFuncTestFast(JSC::ExecState*)
stress/regexp-compile-oom.js.default: 10  0x40e76677177
stress/regexp-compile-oom.js.default: 11  0x102fd77f3 llint_entry
stress/regexp-compile-oom.js.default: 12  0x40eb6676cb7
stress/regexp-compile-oom.js.default: 13  0x40eb6676644
stress/regexp-compile-oom.js.default: 14  0x40eb6676644
stress/regexp-compile-oom.js.default: 15  0x40eb6676644
stress/regexp-compile-oom.js.default: 16  0x40eb6676644
stress/regexp-compile-oom.js.default: 17  0x40eb6676644
stress/regexp-compile-oom.js.default: 18  0x40eb6676644
stress/regexp-compile-oom.js.default: 19  0x40eb6676644
stress/regexp-compile-oom.js.default: 20  0x40eb6676644
stress/regexp-compile-oom.js.default: 21  0x40eb6676644
stress/regexp-compile-oom.js.default: 22  0x40eb6676644
stress/regexp-compile-oom.js.default: 23  0x40eb6676644
stress/regexp-compile-oom.js.default: 24  0x40eb6676644
stress/regexp-compile-oom.js.default: 25  0x40eb6676644
stress/regexp-compile-oom.js.default: 26  0x40eb6676644
stress/regexp-compile-oom.js.default: 27  0x40eb6676644
stress/regexp-compile-oom.js.default: 28  0x40eb6676644
stress/regexp-compile-oom.js.default: 29  0x40eb6676644
stress/regexp-compile-oom.js.default: 30  0x40eb6676644
stress/regexp-compile-oom.js.default: 31  0x40eb6676644
Comment 1 Guillaume Emont 2018-11-05 10:12:22 PST
Also fails on a bunch of our linux bots:
 - WPE Linux 64-bit Debug (Tests)
 - GTK Linux 64-bit Release Wayland (Tests)
 - GTK Linux 64-bit Release (Tests)
 - GTK Linux 64-bit Debug (Tests)
 - JSCOnly Linux MIPS32el Release
 - JSCOnly Linux ARMv7 Thumb2 Release
 - JSCOnly Linux ARMv7 Thumb2 SoftFP Release
Comment 2 Michael Saboff 2018-11-05 14:13:21 PST
Patch in the works.
Comment 3 Michael Saboff 2018-11-05 14:13:47 PST
<rdar://problem/39316988>
Comment 4 Michael Saboff 2018-11-05 16:58:43 PST
Created attachment 353926 [details]
Patch
Comment 5 Saam Barati 2018-11-05 20:19:01 PST
Comment on attachment 353926 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=353926&action=review

r=me

> JSTests/ChangeLog:8
> +        Added more test cases and made all test cases runn with the same deeply recursive stack

Typo: runn

> Source/JavaScriptCore/runtime/RegExpPrototype.cpp:502
> +    RETURN_IF_EXCEPTION(scope, encodedJSValue());

Maybe just release the scope before the above call since this is the last thing? That way we avoid the branch
Comment 6 Michael Saboff 2018-11-06 11:18:20 PST
(In reply to Saam Barati from comment #5)
> Comment on attachment 353926 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=353926&action=review
> 
> r=me
> 
> > JSTests/ChangeLog:8
> > +        Added more test cases and made all test cases runn with the same deeply recursive stack
> 
> Typo: runn

Fixed.

> > Source/JavaScriptCore/runtime/RegExpPrototype.cpp:502
> > +    RETURN_IF_EXCEPTION(scope, encodedJSValue());
> 
> Maybe just release the scope before the above call since this is the last
> thing? That way we avoid the branch

This is here because code called by RegExpConstructor::performMatch() can throw an exception.
Comment 7 Michael Saboff 2018-11-06 11:19:09 PST
Committed r237877: <https://trac.webkit.org/changeset/237877>