Bug 48912 - ARM JIT asserts when loading http://reader.google.com in debug mode
Summary: ARM JIT asserts when loading http://reader.google.com in debug mode
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Other Linux
: P4 Minor
Assignee: Gabor Loki
URL: http://reader.google.com
Keywords:
Depends on:
Blocks:
 
Reported: 2010-11-03 06:26 PDT by Jocelyn Turcotte
Modified: 2010-11-22 16:52 PST (History)
10 users (show)

See Also:


Attachments
ARM JIT asserts when loading http://reader.google.com in debug mode (3.50 KB, patch)
2010-11-09 00:34 PST, Gabor Loki
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Jocelyn Turcotte 2010-11-03 06:26:36 PDT
ASSERTION FAILED: differenceBetween(m_uninterruptedInstructionSequenceBegin, label()) == insnSpace
(../../../qtwebkit-webkit2-dev/JavaScriptCore/jit/JITInlineMethods.h:127 void JSC::JIT::endUninterruptedSequence(int, int))

It happens under JIT::compileGetByIdSlowCase, stubCall.call(dst) eventually calls ARMAssembler::dataTransfer32 which might generate 1 or 2 instructions depending on the value of "dst".
Comment 1 David Kilzer (:ddkilzer) 2010-11-04 09:44:27 PDT
I believe this is only an issue with the ARMAssembler, not the ARMv7Assembler.
Comment 2 Gabor Loki 2010-11-04 13:38:03 PDT
This issue is related to ARM JIT, not ARMv7 (Thumb-2) one. I will upload a patch soon.
Comment 3 Gabor Loki 2010-11-09 00:34:13 PST
Created attachment 73344 [details]
ARM JIT asserts when loading http://reader.google.com in debug mode
Comment 4 WebKit Commit Bot 2010-11-09 23:36:54 PST
Comment on attachment 73344 [details]
ARM JIT asserts when loading http://reader.google.com in debug mode

Clearing flags on attachment: 73344

Committed r71722: <http://trac.webkit.org/changeset/71722>
Comment 5 WebKit Commit Bot 2010-11-09 23:37:00 PST
All reviewed patches have been landed.  Closing bug.
Comment 6 WebKit Review Bot 2010-11-10 00:52:22 PST
http://trac.webkit.org/changeset/71722 might have broken GTK Linux 64-bit Debug
The following tests are not passing:
fast/events/tabindex-focus-blur-all.html
Comment 7 Gabor Loki 2010-11-10 01:23:33 PST
> http://trac.webkit.org/changeset/71722 might have broken GTK Linux 64-bit Debug
> The following tests are not passing:
> fast/events/tabindex-focus-blur-all.html

It should be a flaky test. This patch related to ARM.
Comment 8 Darin Adler 2010-11-10 09:15:21 PST
Comment on attachment 73344 [details]
ARM JIT asserts when loading http://reader.google.com in debug mode

View in context: https://bugs.webkit.org/attachment.cgi?id=73344&action=review

> JavaScriptCore/jit/JITInlineMethods.h:131
> +    /* There are several cases when the uninterrupted sequence is larger than
> +     * maximum required offset for pathing the same sequence. Eg.: if in a
> +     * uninterrupted sequence the last macroassembler's instruction is a stub
> +     * call, it emits store instruction(s) which should not be included in the
> +     * calculation of length of uninterrupted sequence. So, the insnSpace and
> +     * constSpace should be upper limit instead of hard limit.
> +     */

In the future, please use // comments, not /* comments, in WebKit code.