Bug 48912 – ARM JIT asserts when loading http://reader.google.com in debug mode

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Jocelyn Turcotte]

ASSERTION FAILED: differenceBetween(m_uninterruptedInstructionSequenceBegin, label()) == insnSpace
(../../../qtwebkit-webkit2-dev/JavaScriptCore/jit/JITInlineMethods.h:127 void JSC::JIT::endUninterruptedSequence(int, int))

It happens under JIT::compileGetByIdSlowCase, stubCall.call(dst) eventually calls ARMAssembler::dataTransfer32 which might generate 1 or 2 instructions depending on the value of "dst".

[David Kilzer (:ddkilzer)]

I believe this is only an issue with the ARMAssembler, not the ARMv7Assembler.

[Gabor Loki]

This issue is related to ARM JIT, not ARMv7 (Thumb-2) one. I will upload a patch soon.

[Gabor Loki]

Created attachment 73344 [details]
ARM JIT asserts when loading http://reader.google.com in debug mode

[WebKit Commit Bot]

Comment on attachment 73344 [details]
ARM JIT asserts when loading http://reader.google.com in debug mode

Clearing flags on attachment: 73344

Committed r71722: <http://trac.webkit.org/changeset/71722>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[WebKit Review Bot]

http://trac.webkit.org/changeset/71722 might have broken GTK Linux 64-bit Debug
The following tests are not passing:
fast/events/tabindex-focus-blur-all.html

[Gabor Loki]

> http://trac.webkit.org/changeset/71722 might have broken GTK Linux 64-bit Debug
> The following tests are not passing:
> fast/events/tabindex-focus-blur-all.html

It should be a flaky test. This patch related to ARM.

[Darin Adler]

Comment on attachment 73344 [details]
ARM JIT asserts when loading http://reader.google.com in debug mode

View in context: https://bugs.webkit.org/attachment.cgi?id=73344&action=review

> JavaScriptCore/jit/JITInlineMethods.h:131
> +    /* There are several cases when the uninterrupted sequence is larger than
> +     * maximum required offset for pathing the same sequence. Eg.: if in a
> +     * uninterrupted sequence the last macroassembler's instruction is a stub
> +     * call, it emits store instruction(s) which should not be included in the
> +     * calculation of length of uninterrupted sequence. So, the insnSpace and
> +     * constSpace should be upper limit instead of hard limit.
> +     */

In the future, please use // comments, not /* comments, in WebKit code.