Bug 230215 – [JSC][32bit] Crash in stress/has-own-property-name-cache-symbols-and-strings.js, not enough registers

• Status: RESOLVED
• Resolution: DUPLICATE
• Component: JavaScriptCore

[Xan Lopez]

Starting program: /home/igalia/xlopez/WebKit/WebKitBuild/Debug/bin/jsc -f JSTests/stress/has-own-property-name-cache-symbols-and-strings.js
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/arm-linux-gnueabihf/libthread_db.so.1".
[New Thread 0xf3fb8440 (LWP 17334)]

Thread 1 "jsc" received signal SIGABRT, Aborted.
__libc_do_syscall () at ../sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:47
47	../sysdeps/unix/sysv/linux/arm/libc-do-syscall.S: No such file or directory.
(gdb) bt
#0  __libc_do_syscall () at ../sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:47
#1  0xf5e6dea0 in __libc_signal_restore_set (set=0xfffed31c) at ../sysdeps/unix/sysv/linux/internal-signals.h:86
#2  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:48
#3  0xf5e5e7a2 in __GI_abort () at abort.c:79
#4  0xf6cc52ac in JSC::ScratchRegisterAllocator::allocateScratch<JSC::GPRInfo> (this=0xfffed640) at ../../Source/JavaScriptCore/jit/ScratchRegisterAllocator.cpp:97
#5  0xf6cbc10c in JSC::ScratchRegisterAllocator::allocateScratchGPR (this=0xfffed640) at ../../Source/JavaScriptCore/jit/ScratchRegisterAllocator.cpp:102
#6  0xf62d1ce0 in JSC::AccessCase::generateImpl (this=0xf3699300, state=...) at ../../Source/JavaScriptCore/bytecode/AccessCase.cpp:2276
#7  0xf62cfc4a in JSC::AccessCase::generateWithGuard (this=0xf3699300, state=..., fallThrough=...) at ../../Source/JavaScriptCore/bytecode/AccessCase.cpp:1755
#8  0xf63afcea in JSC::PolymorphicAccess::regenerate (this=0xf369cf20, locker=..., vm=..., globalObject=0xf20f9038, codeBlock=0xf1eac000, ecmaMode=..., stubInfo=...)
    at ../../Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp:672
#9  0xf63d7d34 in operator() (__closure=0xfffeec94) at ../../Source/JavaScriptCore/bytecode/StructureStubInfo.cpp:221
#10 0xf63d7e8e in JSC::StructureStubInfo::addAccessCase (this=0xf36f6948, locker=..., globalObject=0xf20f9038, codeBlock=0xf1eac000, ecmaMode=..., ident=..., 
    accessCase=...) at ../../Source/JavaScriptCore/bytecode/StructureStubInfo.cpp:245
#11 0xf6cb774a in JSC::tryCachePutBy (globalObject=0xf20f9038, codeBlock=0xf1eac000, baseValue=..., oldStructure=0xf1e9caf0, propertyName=..., slot=..., stubInfo=..., 
    putByKind=JSC::PutByKind::ByVal, putKind=JSC::PutKind::NotDirect) at ../../Source/JavaScriptCore/jit/Repatch.cpp:877
#12 0xf6cb790a in JSC::repatchPutBy (globalObject=0xf20f9038, codeBlock=0xf1eac000, baseValue=..., oldStructure=0xf1e9caf0, propertyName=..., slot=..., stubInfo=..., 
    putByKind=JSC::PutByKind::ByVal, putKind=JSC::PutKind::NotDirect) at ../../Source/JavaScriptCore/jit/Repatch.cpp:897
#13 0xf6c5b34c in JSC::putByValOptimize (globalObject=0xf20f9038, codeBlock=0xf1eac000, baseValue=..., subscript=..., value=..., stubInfo=0xf36f6948, profile=0xf20f6e48, 
    ecmaMode=...) at ../../Source/JavaScriptCore/jit/JITOperations.cpp:1055
#14 0xf6c5b4fe in JSC::operationPutByValNonStrictOptimize (globalObject=0xf20f9038, encodedBaseValue=-17416011584, encodedSubscript=-17415806032, encodedValue=-4294967271, 
    stubInfo=0xf36f6948, profile=0xf20f6e48) at ../../Source/JavaScriptCore/jit/JITOperations.cpp:1087
#15 0xf35fd662 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb) 

Probably also introduced by bug #229229.

[Xan Lopez]

*** This bug has been marked as a duplicate of bug 230241 ***