Bug 84815 – http://bellard.org/jslinux/ triggers an assertion failure in the DFG JIT

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Oliver Hunt]

Go to the above url in a debug build, and i get:
0   com.apple.JavaScriptCore      	0x00000001055ec130 JSC::DFG::SpeculativeJIT::forwardSpeculationCheck(JSC::DFG::ExitKind, JSC::DFG::JSValueSource, unsigned int, JSC::AbstractMacroAssembler<JSC::X86Assembler>::Jump, JSC::ValueRecovery const&) + 848 (DFGSpeculativeJIT.h:1889)
1   com.apple.JavaScriptCore      	0x00000001055df197 JSC::DFG::SpeculativeJIT::compileUInt32ToNumber(JSC::DFG::Node&) + 647 (DFGSpeculativeJIT.cpp:1734)
2   com.apple.JavaScriptCore      	0x00000001056045a0 JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node&) + 5696 (DFGSpeculativeJIT64.cpp:2114)
3   com.apple.JavaScriptCore      	0x00000001055db550 JSC::DFG::SpeculativeJIT::compile(JSC::DFG::BasicBlock&) + 1984 (DFGSpeculativeJIT.cpp:1025)
4   com.apple.JavaScriptCore      	0x00000001055dd725 JSC::DFG::SpeculativeJIT::compile() + 213 (DFGSpeculativeJIT.cpp:1256)
5   com.apple.JavaScriptCore      	0x00000001055b2e3b JSC::DFG::JITCompiler::compileBody(JSC::DFG::SpeculativeJIT&) + 107 (DFGJITCompiler.cpp:81)
6   com.apple.JavaScriptCore      	0x00000001055b3e15 JSC::DFG::JITCompiler::compileFunction(JSC::JITCode&, JSC::MacroAssemblerCodePtr&) + 277 (DFGJITCompiler.cpp:237)
7   com.apple.JavaScriptCore      	0x00000001055a87dd JSC::DFG::compile(JSC::DFG::CompileMode, JSC::JSGlobalData&, JSC::CodeBlock*, JSC::JITCode&, JSC::MacroAssemblerCodePtr*) + 573 (DFGDriver.cpp:79)
8   com.apple.JavaScriptCore      	0x00000001055a8594 JSC::DFG::tryCompileFunction(JSC::JSGlobalData&, JSC::CodeBlock*, JSC::JITCode&, JSC::MacroAssemblerCodePtr&) + 52 (DFGDriver.cpp:97)
9   com.apple.JavaScriptCore      	0x000000010562378e JSC::jitCompileFunctionIfAppropriate(JSC::JSGlobalData&, WTF::OwnPtr<JSC::FunctionCodeBlock>&, JSC::JITCode&, JSC::MacroAssemblerCodePtr&, JSC::SharedSymbolTable*&, JSC::JITCode::JITType, JSC::JITCompilationEffort) + 222 (JITDriver.h:91)
10  com.apple.JavaScriptCore      	0x00000001056240f6 JSC::prepareFunctionForExecution(JSC::JSGlobalData&, WTF::OwnPtr<JSC::FunctionCodeBlock>&, JSC::JITCode&, JSC::MacroAssemblerCodePtr&, JSC::SharedSymbolTable*&, JSC::JITCode::JITType, JSC::CodeSpecializationKind) + 246 (ExecutionHarness.h:64)
11  com.apple.JavaScriptCore      	0x000000010561fdb2 JSC::FunctionExecutable::compileForCallInternal(JSC::ExecState*, JSC::ScopeChainNode*, JSC::JITCode::JITType) + 802 (Executable.cpp:554)
12  com.apple.JavaScriptCore      	0x000000010561fa24 JSC::FunctionExecutable::compileOptimizedForCall(JSC::ExecState*, JSC::ScopeChainNode*) + 324 (Executable.cpp:465)
13  com.apple.JavaScriptCore      	0x0000000105544349 JSC::FunctionExecutable::compileOptimizedFor(JSC::ExecState*, JSC::ScopeChainNode*, JSC::CodeSpecializationKind) + 329 (Executable.h:588)
14  com.apple.JavaScriptCore      	0x000000010553d804 JSC::FunctionCodeBlock::compileOptimized(JSC::ExecState*, JSC::ScopeChainNode*) + 148 (CodeBlock.cpp:2302)
15  com.apple.JavaScriptCore      	0x000000010567ed1a cti_optimize_from_ret + 250 (JITStubs.cpp:2075)
16  com.apple.JavaScriptCore      	0x0000000105686aa0 0x1054c7000 + 1833632
17  com.apple.JavaScriptCore      	0x000000010564dd19 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*) + 105 (JITCode.h:127)
18  com.apple.JavaScriptCore      	0x000000010564a1df JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 1855 (Interpreter.cpp:1306)
19  com.apple.JavaScriptCore      	0x000000010552f048 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 296 (CallData.cpp:39)
20  com.apple.JavaScriptCore      	0x00000001056a0286 JSC::boundFunctionCall(JSC::ExecState*) + 646 (JSBoundFunction.cpp:56)
21  com.apple.JavaScriptCore      	0x000000010564a4be JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 2590 (Interpreter.cpp:1335)

[Filip Pizlo]

Created attachment 138852 [details]
the patch

Can I get an RS for a test case as well?

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/115237