RESOLVED FIXED Bug 69038
REGRESSION(r96189): fast/dom/SelectorAPI/resig-SelectorsAPI-test.xhtml, inspector/console/console-format.html, inspector/console/console-dir-global.html failing on SnowLeopard Intel Debug (Tests)
https://bugs.webkit.org/show_bug.cgi?id=69038
Summary REGRESSION(r96189): fast/dom/SelectorAPI/resig-SelectorsAPI-test.xhtml, inspe...
Simon Fraser (smfr)
Reported 2011-09-28 16:05:25 PDT
The following tests started failing on SnowLeopard Intel Debug (Tests) between r96185 and r96189 (inclusive): fast/dom/SelectorAPI/resig-SelectorsAPI-test.xhtml inspector/console/console-format.html inspector/console/console-dir-global.html http://trac.webkit.org/log/trunk?rev=96189&stop_rev=96185&limit=6 http://build.webkit.org/results/SnowLeopard%20Intel%20Debug%20(Tests)/r96184%20(2342)/results.html passed http://build.webkit.org/results/SnowLeopard%20Intel%20Debug%20(Tests)/r96189%20(2343)/results.html failed
Attachments
Ryosuke Niwa
Comment 1 2011-09-28 18:53:15 PDT
Confirmed. The failure of fast/dom/SelectorAPI/resig-SelectorsAPI-test.xhtml is caused by r96189.
Filip Pizlo
Comment 2 2011-09-28 22:38:12 PDT
Boy, it sure looks like the world is messed up when you look at fast/dom/SelectorAPI/resig-SelectorsAPI-test.xhtml. And it does not appear to be the fault of r96189 per se; it's just that that patch increases coverage enough that we can start to see some hairy bugs from previous work in DFG. I'm still studying the failure but so far it looks like the following is going wrong: 1) GetMethod sometimes appears to the DFG to have no value profiling even though it has clearly executed at least once. This is evident since other operations in the same basic block have value profiling. 2) The DEBUG_VERBOSE logic for GetScopedVar is totally wrong. This is benign, but still, annoying. 3) This code causes systematic speculation failures because of polymorphic variable reuse, which should be fixed once https://bugs.webkit.org/show_bug.cgi?id=68593 is done. 4) The code that actually fails isn't even running in DFG anyway, though there is plenty of code that runs in DFG outside of what is actually failing. So it's either memory corruption (which I see no other evidence for) or the code that is running in DFG is performing some manner of setup that ends up mattering later.
Filip Pizlo
Comment 3 2011-09-28 22:42:41 PDT
Aha - found it. When we predict an argument to be boolean we never check it. https://bugs.webkit.org/show_bug.cgi?id=69059
Brian Burg
Comment 4 2014-12-17 16:41:55 PST
The selector test is no longer skipped on Mac (still EFL and GTK), and inspector tests were removed.
Note You need to log in before you can comment on or make changes to this bug.