Bug 197756 – testb3 failing with crash in JSC::B3::BasicBlock::appendNonTerminal

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Ryan Haddad]

Created attachment 369526 [details]
crash log

While looking at https://build.webkit.org/builders/Apple%20High%20Sierra%20Release%20JSC%20%28Tests%29/builds/9309/steps/jscore-test/logs/stdio I noticed that testb3 completed with rc=11

I found the following crash on the bot:

Thread 7 Crashed:: testb3 thread
0   com.apple.JavaScriptCore            0x0000000105b1e6e6 JSC::B3::BasicBlock::appendNonTerminal(JSC::B3::Value*) + 70
1   com.apple.JavaScriptCore            0x0000000105b8a28a JSC::B3::(anonymous namespace)::ReduceStrength::reduceValueStrength() + 730 (B3ReduceStrength.cpp:2165)
2   com.apple.JavaScriptCore            0x0000000105b885d0 JSC::B3::reduceStrength(JSC::B3::Procedure&) + 1424 (B3ReduceStrength.cpp:468)
3   com.apple.JavaScriptCore            0x0000000105b38763 JSC::B3::generateToAir(JSC::B3::Procedure&) + 195 (B3Generate.cpp:89)
4   com.apple.JavaScriptCore            0x0000000105b38680 JSC::B3::prepareForGeneration(JSC::B3::Procedure&) + 48 (B3Generate.cpp:63)
5   com.apple.JavaScriptCore            0x0000000105b236fa JSC::B3::compile(JSC::B3::Procedure&) + 74 (B3Compile.cpp:47)
6   testb3                              0x0000000104b51034 (anonymous namespace)::compileProc(JSC::B3::Procedure&, unsigned int) + 68 (testb3.cpp:129)
7   testb3                              0x0000000104d924e6 (anonymous namespace)::testCheckSelect() + 982 (testb3.cpp:12759)
8   testb3                              0x0000000104d920d8 (anonymous namespace)::run(char const*)::$_1360::operator()() const + 56 (testb3.cpp:18435)
9   testb3                              0x0000000104d92079 WTF::SharedTaskFunctor<void (), (anonymous namespace)::run(char const*)::$_1360>::run() + 25 (SharedTas
k.h:91)
10  testb3                              0x0000000104e4b748 (anonymous namespace)::run(char const*)::$_1623::operator()() const + 408 (testb3.cpp:18758)
11  testb3                              0x0000000104e4b539 WTF::Detail::CallableWrapper<(anonymous namespace)::run(char const*)::$_1623, void>::call() + 25 (Funct
ion.h:52)
12  com.apple.JavaScriptCore            0x000000010589cdf4 WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) + 212 (Threading.cpp:149)
13  com.apple.JavaScriptCore            0x000000010589ef49 WTF::wtfThreadEntryPoint(void*) + 9 (ThreadingPOSIX.cpp:201)
14  libsystem_pthread.dylib             0x00007fff79090661 _pthread_body + 340
15  libsystem_pthread.dylib             0x00007fff7909050d _pthread_start + 377
16  libsystem_pthread.dylib             0x00007fff7908fbf9 thread_start + 13

[Radar WebKit Bug Importer]

<rdar://problem/50641659>

[Ryan Haddad]

I don't know when this regressed.

[Robin Morisset]

*** Bug 197792 has been marked as a duplicate of this bug. ***

[Robin Morisset]

Created attachment 369586 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 369586 [details]
Patch

Clearing flags on attachment: 369586

Committed r245192: <https://trac.webkit.org/changeset/245192>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.