This is how I reproduce this failure with a release build on trunk r250085: $ while true; do VM=WebKitBuild/Release && DYLD_FRAMEWORK_PATH=$VM $VM/jsc --airForceBriggsAllocator=true --forcePolyProto=true --thresholdForJITAfterWarmUp=10 --thresholdForJITSoon=10 --thresholdForOptimizeAfterWarmUp=20 --thresholdForOptimizeAfterLongWarmUp=20 --thresholdForOptimizeSoon=20 --thresholdForFTLOptimizeAfterWarmUp=20 --thresholdForFTLOptimizeSoon=20 --thresholdForOMGOptimizeAfterWarmUp=20 --thresholdForOMGOptimizeSoon=20 --maximumEvalCacheableSourceLength=150000 --useEagerCodeBlockJettisonTiming=true --collectContinuously=true --useGenerationalGC=false JSTests/stress/ftl-put-by-id-setter-exception-interesting-live-state.js; done When the test fails, it prints the following to stdout: Exception: Error42
<rdar://problem/55521953>
I forgot to say that in order to make this issue reproduce more quickly, I kicked off a full WebKit build in the background (separate terminal window) to introduce some noise into the system.
Created attachment 379293 [details] Patch
Comment on attachment 379293 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=379293&action=review r=me > Source/JavaScriptCore/bytecode/AccessCase.cpp:238 > +bool AccessCase::doesCalls(Vector<JSCell*>* cellsToMarkIfDoesCalls) const let's implement Yusuke's idea of listing all types() as a switch both in here and in forEachDependentCell, so in the future, when someone adds a new type, they'll get a compile error unless they implement the type in these functions. > Source/JavaScriptCore/bytecode/PropertyCondition.cpp:354 > bool PropertyCondition::isStillLive(VM& vm) const If this is no longer called, let's remove it > Source/JavaScriptCore/jit/PolymorphicCallStubRoutine.cpp:132 > + bool isValid = true; nit: let's call this isStillLive
r=me too, nice!
Created attachment 379301 [details] Patch
Comment on attachment 379301 [details] Patch Clearing flags on attachment: 379301 Committed r250184: <https://trac.webkit.org/changeset/250184>
All reviewed patches have been landed. Closing bug.
*** Bug 183266 has been marked as a duplicate of this bug. ***