Bug 69038 – REGRESSION(r96189): fast/dom/SelectorAPI/resig-SelectorsAPI-test.xhtml, inspector/console/console-format.html, inspector/console/console-dir-global.html failing on SnowLeopard Intel Debug (Tests)

• Status: RESOLVED
• Resolution: FIXED
• Component: Tools / Tests

[Simon Fraser (smfr)]

The following tests started failing on SnowLeopard Intel Debug (Tests) between r96185 and r96189 (inclusive):

    fast/dom/SelectorAPI/resig-SelectorsAPI-test.xhtml
    inspector/console/console-format.html
    inspector/console/console-dir-global.html

http://trac.webkit.org/log/trunk?rev=96189&stop_rev=96185&limit=6

http://build.webkit.org/results/SnowLeopard%20Intel%20Debug%20(Tests)/r96184%20(2342)/results.html passed
http://build.webkit.org/results/SnowLeopard%20Intel%20Debug%20(Tests)/r96189%20(2343)/results.html failed

[Ryosuke Niwa]

Confirmed. The failure of fast/dom/SelectorAPI/resig-SelectorsAPI-test.xhtml is caused by r96189.

[Filip Pizlo]

Boy, it sure looks like the world is messed up when you look at fast/dom/SelectorAPI/resig-SelectorsAPI-test.xhtml.  And it does not appear to be the fault of r96189 per se; it's just that that patch increases coverage enough that we can start to see some hairy bugs from previous work in DFG.

I'm still studying the failure but so far it looks like the following is going wrong:

1) GetMethod sometimes appears to the DFG to have no value profiling even though it has clearly executed at least once.  This is evident since other operations in the same basic block have value profiling.

2) The DEBUG_VERBOSE logic for GetScopedVar is totally wrong.  This is benign, but still, annoying.

3) This code causes systematic speculation failures because of polymorphic variable reuse, which should be fixed once https://bugs.webkit.org/show_bug.cgi?id=68593 is done.

4) The code that actually fails isn't even running in DFG anyway, though there is plenty of code that runs in DFG outside of what is actually failing.  So it's either memory corruption (which I see no other evidence for) or the code that is running in DFG is performing some manner of setup that ends up mattering later.

[Filip Pizlo]

Aha - found it.  When we predict an argument to be boolean we never check it.  https://bugs.webkit.org/show_bug.cgi?id=69059

[Brian Burg]

The selector test is no longer skipped on Mac (still EFL and GTK), and inspector tests were removed.