For Version 5.1.1 (6534.51.22, r98912) OpenStreetMap is somewhat broken: 1. showing the data overlay doesn't work: - on the right side of http://www.openstreetmap.org/ there is a small (+) sign. - When you click on this a drawer with options opens. - now click onto the "data" overlay checkbox. -> nothing happens. -> check the normal release of Safari (or any other browser) to see the expected behaviour. 2. zooming into OpenStreetMap by double clicking into the map works unreliable - after a while the map display is either empty or no longer updated - reloading brings back a lower zoom level -> check the normal release of Safari (or any other browser) to see the expected behaviour.
r97664 is the last version to work without flaws, the next available version r98824 has the issues (up until today r100547)
Seems like in debug builds of ToT (r100874) we hit the following assertion: ASSERTION FAILED: dst != func /Volumes/Data/pizlo/tertiary/OpenSource/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp(1840) : JSC::RegisterID *JSC::BytecodeGenerator::emitCallVarargs(JSC::RegisterID *, JSC::RegisterID *, JSC::RegisterID *, JSC::RegisterID *, JSC::RegisterID *, unsigned int, unsigned int, unsigned int) 1 0x10d947c01 JSC::BytecodeGenerator::emitCallVarargs(JSC::RegisterID*, JSC::RegisterID*, JSC::RegisterID*, JSC::RegisterID*, JSC::RegisterID*, unsigned int, unsigned int, unsigned int) 2 0x10db1b6a5 JSC::ApplyFunctionCallDotNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*) 3 0x10d94f278 JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::Node*) 4 0x10db1fd13 JSC::ConditionalNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*) 5 0x10d94f278 JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::Node*) 6 0x10db20b95 JSC::AssignResolveNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*) 7 0x10d94f278 JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::Node*) 8 0x10db226cd JSC::ExprStatementNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*) 9 0x10d94f278 JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::Node*) 10 0x10db28324 JSC::SourceElements::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*) 11 0x10db2251f JSC::BlockNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*) 12 0x10d94f278 JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::Node*) 13 0x10db22a21 JSC::IfNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*) 14 0x10d94f278 JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::Node*) 15 0x10db28324 JSC::SourceElements::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*) 16 0x10db2251f JSC::BlockNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*) 17 0x10d94f278 JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::Node*) 18 0x10db28324 JSC::SourceElements::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*) 19 0x10db28945 JSC::ScopeNode::emitStatementsBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*) 20 0x10db2728c JSC::FunctionBodyNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*) 21 0x10d93daad JSC::BytecodeGenerator::generate() 22 0x10da106cd JSC::FunctionExecutable::produceCodeBlockFor(JSC::ScopeChainNode*, JSC::CompilationKind, JSC::CodeSpecializationKind, JSC::JSObject*&) 23 0x10da0f0f6 JSC::FunctionExecutable::compileForCallInternal(JSC::ExecState*, JSC::ScopeChainNode*, JSC::JITCode::JITType) 24 0x10d92e633 JSC::FunctionExecutable::compileForCall(JSC::ExecState*, JSC::ScopeChainNode*) 25 0x10da2e2d8 JSC::Interpreter::prepareForRepeatCall(JSC::FunctionExecutable*, JSC::ExecState*, JSC::JSFunction*, int, JSC::ScopeChainNode*) 26 0x10d92caea JSC::CachedCall::CachedCall(JSC::ExecState*, JSC::JSFunction*, int) 27 0x10d92bb8b JSC::CachedCall::CachedCall(JSC::ExecState*, JSC::JSFunction*, int) 28 0x10dbbbc00 _ZN3JSCL22stringProtoFuncReplaceEPNS_9ExecStateE 29 0x21511e601218 30 0x10da30679 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*) 31 0x10da2d0f6 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
Created attachment 116018 [details] the patch I believe this fixes it.
Comment on attachment 116018 [details] the patch Clearing flags on attachment: 116018 Committed r100879: <http://trac.webkit.org/changeset/100879>
All reviewed patches have been landed. Closing bug.
<rdar://problem/10476342>
Sorry to rain on your parade, the bug is not fixed. Try zooming into the map at http://www.openstreetmap.org/ by double clicking the map several times in a row.
Version r100927 is still affected I wanted to say.
(In reply to comment #7) > Sorry to rain on your parade, the bug is not fixed. Try zooming into the map at http://www.openstreetmap.org/ by double clicking the map several times in a row. Try to be polite and respectful in bug comments, being snarky isn't helpful
(In reply to comment #9) > (In reply to comment #7) > > Sorry to rain on your parade, the bug is not fixed. Try zooming into the map at http://www.openstreetmap.org/ by double clicking the map several times in a row. > > Try to be polite and respectful in bug comments, being snarky isn't helpful Sorry for that. I did not want to be snarky, I am not a native speaker, I wasn't aware that the idiom I used is considered snarky. I just used http://dict.leo.org/ to translate a colloquial german saying. Please excuse me.
(In reply to comment #8) > Version r100927 is still affected I wanted to say. It appears so. I'm looking into it now, but I wanted to see if you can confirm what I'm seeing: 1) Zooming and panning often results in the map getting totally corrupted, and eventually stops responding. Expected behavior is that this does not happen. 2) Changing the following line in Source/JavaScriptCore/runtime/Heuristics.cpp SET(maximumInliningDepth, 5); to: SET(maximumInliningDepth, 1); appears to "fix" the problem.
(In reply to comment #11) > (In reply to comment #8) > > Version r100927 is still affected I wanted to say. > > It appears so. I'm looking into it now, but I wanted to see if you can confirm what I'm seeing: > > 1) Zooming and panning often results in the map getting totally corrupted, and eventually stops responding. Expected behavior is that this does not happen. This is what I experienced to. The map gets corrupted and stops to respond to any action until you reload it. For the expected behaviour please try r97664 which doesn't fail even if the double clicks are done in a rapid manner. > > 2) Changing the following line in Source/JavaScriptCore/runtime/Heuristics.cpp > > SET(maximumInliningDepth, 5); > > to: > > SET(maximumInliningDepth, 1); > > appears to "fix" the problem. I can't comment on that one as I have no idea what it does.
Created attachment 116157 [details] the patch Sadly, I couldn't get this to repro in any simplified test case. :-(
(In reply to comment #8) > Version r100927 is still affected I wanted to say. I think my new patch fixes it. But please do let us know if you still find problems!
Landed in http://trac.webkit.org/changeset/100972
The issue seems to be solved. Thanks one more time!