Bug 227334 – Turn off data ICs by default

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Saam Barati]

When running like:

jsc JSTests/stress/delete-property-inline-cache.js --useFTLJIT=false --useFunctionDotArguments=true --validateExceptionChecks=true --useDollarVM=true --maxPerThreadStackUsage=1572864 --validateGraph=true --validateBCE=true --airForceIRCAllocator=true --useFTLJIT=true --useConcurrentJIT=false --thresholdForJITAfterWarmUp=100 --scribbleFreeCells=true --thresholdForJITAfterWarmUp=10 --thresholdForJITSoon=10 --thresholdForOptimizeAfterWarmUp=20 --thresholdForOptimizeAfterLongWarmUp=20 --thresholdForOptimizeSoon=20 --thresholdForFTLOptimizeAfterWarmUp=20 --thresholdForFTLOptimizeSoon=20 --thresholdForOMGOptimizeAfterWarmUp=20 --thresholdForOMGOptimizeSoon=20 --maximumEvalCacheableSourceLength=150000 --useEagerCodeBlockJettisonTiming=true --repatchBufferingCountdown=0 --collectContinuously=true --useGenerationalGC=false --verifyGC=false --forceOSRExitToLLInt=true --useExecutableAllocationFuzz=true --fireExecutableAllocationFuzzRandomly=true --useConcurrentGC=1

Seems like a GC bug

[Saam Barati]

My guess is we have some GC issue w.r.t exceptions.

[Radar WebKit Bug Importer]

<rdar://problem/79802812>

[Saam Barati]

Bisecting current status:

GC bug:

272448 [ good ]
275867 [ good ]
277577 [ good ]
278417 [ good ]
278629 [ good? ]
278852 [ bad ]
279287 [ bad ]


Will continue bisecting today

[Saam Barati]

I think the bug is related to SSI Data ICs:
https://trac.webkit.org/changeset/278656/webkit

Working on confirming this now.

[Saam Barati]

Created attachment 432636 [details]
patch

[Yusuke Suzuki]

Comment on attachment 432636 [details]
patch

r=me

[Saam Barati]

Created attachment 432647 [details]
patch for landing

[EWS]

Committed r279449 (239305@main): <https://commits.webkit.org/239305@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 432647 [details].