Bug 192018 – ASSERTION FAILED: capacity && isPageAligned(capacity) in JSC::CLoopStack::CLoopStack(JSC::VM&)

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Ryan Haddad]

The following assertion failure is seen on the 32-bit JSC bot:

stress/regress-191579.js.default: ASSERTION FAILED: capacity && isPageAligned(capacity)
stress/regress-191579.js.default: ./interpreter/CLoopStack.cpp(59) : JSC::CLoopStack::CLoopStack(JSC::VM &)
stress/regress-191579.js.default: 1   0x25d77b WTFCrash
stress/regress-191579.js.default: 2   0x25e3a4 WTFCrashWithInfo(int, char const*, char const*, int)
stress/regress-191579.js.default: 3   0x8e0c2c JSC::CLoopStack::CLoopStack(JSC::VM&)
stress/regress-191579.js.default: 4   0x8e1094 JSC::CLoopStack::CLoopStack(JSC::VM&)
stress/regress-191579.js.default: 5   0x8e804e JSC::Interpreter::Interpreter(JSC::VM&)
stress/regress-191579.js.default: 6   0x8e8144 JSC::Interpreter::Interpreter(JSC::VM&)
stress/regress-191579.js.default: 7   0xeb89d1 JSC::VM::VM(JSC::VM::VMType, JSC::HeapType)
stress/regress-191579.js.default: 8   0xebd7d1 JSC::VM::VM(JSC::VM::VMType, JSC::HeapType)
stress/regress-191579.js.default: 9   0xec04db JSC::VM::create(JSC::HeapType)
stress/regress-191579.js.default: 10  0x2207e int runJSC<jscmain(int, char**)::$_3>(CommandLine, bool, jscmain(int, char**)::$_3 const&)
stress/regress-191579.js.default: 11  0x20cb0 jscmain(int, char**)
stress/regress-191579.js.default: 12  0x20bd7 main
stress/regress-191579.js.default: 13  0xa73f4611 start
stress/regress-191579.js.default: test_script_1895: line 2: 36513 Segmentation fault: 11  ( "$@" ../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --useFunctionDotArguments\=true --validateExceptionChecks\=true --useDollarVM\=true --maxPerThreadStackUsage\=1572864 --maxPerThreadStackUsage\=400000 --useTypeProfiler\=true --exceptionStackTraceLimit\=1 --defaultErrorStackTraceLimit\=1 --useFTLJIT\=true regress-191579.js )
stress/regress-191579.js.default: ERROR: Unexpected exit code: 139

https://build.webkit.org/builders/Apple%20High%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/2925

[Ryan Haddad]

The test was added with https://trac.webkit.org/changeset/238141

[Mark Lam]

Created attachment 355798 [details]
proposed patch.

[WebKit Commit Bot]

Comment on attachment 355798 [details]
proposed patch.

Clearing flags on attachment: 355798

Committed r238595: <https://trac.webkit.org/changeset/238595>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/46295971>