[GTK] Assert failure in fast/canvas/canvas-createImageData.html for 64bit Debug bot

[Simon Pena]

Created attachment 148759 [details]
Crash log for DumpRenderTree

After revision r120897 <http://trac.webkit.org/changeset/r120897>, the test crashes at the following assertion:

ASSERT(isCellSpeculation(value.m_type));

in the JSC::DFG::AbstractState::execute method of Source/JavaScriptCore/dfg/DFGAbstractState.cpp

This test currently fails in GTK Linux 64bits Debug bot (see http://build.webkit.org/builders/GTK%20Linux%2064-bit%20Debug/builds/34242/steps/layout-test/logs/stdio), but passes on EFL Linux 64-bit Debug bot, as seen in http://build.webkit.org/builders/EFL%20Linux%2064-bit%20Debug/builds/1701/steps/layout-test/logs/stdio

[Filip Pizlo]

Looks like a legitimate bug.  I will investigate.

[Filip Pizlo]

Can someone from GTK+ put a value.dump(stdout) or value.dump(WTF::dataFile()) or something statement, preferably conditional on the "assertion" failing.  And post the resulting log output here.  That way I can see what is going on.

[Simon Pena]

(In reply to comment #1)
> Looks like a legitimate bug.  I will investigate.

It seems you already fixed this in r121215 <http://trac.webkit.org/changeset/r121215>, when the assertion was modified to be

ASSERT(value.isClear() || isCellSpeculation(value.m_type)); // Value could be clear if we've proven must-exit due to a speculation statically known to be bad.

So this bug is already fixed. I'll be confirming that the debug bot now passes the test fast/canvas/canvas-createImageData.html, but you shouldn't need to do anything else. Thanks!

[Simon Pena]

(In reply to comment #3)
> [...]
> So this bug is already fixed. I'll be confirming that the debug bot now passes the test fast/canvas/canvas-createImageData.html, but you shouldn't need to do anything else. Thanks!

Yes, the bot passes the test, so I'll remove its crash from the TestExpectations.

[Simon Pena]

Created attachment 149488 [details]
Patch

[WebKit Review Bot]

Comment on attachment 149488 [details]
Patch

Rejecting attachment 149488 [details] from commit-queue.

Failed to run "['/mnt/git/webkit-commit-queue/Tools/Scripts/webkit-patch', '--status-host=queues.webkit.org', '-..." exit_code: 2

Last 500 characters of output:
s/Scripts/svn-apply', u'--force']" exit_code: 1 cwd: /mnt/git/webkit-commit-queue/

Parsed 2 diffs from patch file(s).
patching file LayoutTests/ChangeLog
Hunk #1 succeeded at 1 with fuzz 3.
patching file LayoutTests/platform/gtk/TestExpectations
Hunk #1 FAILED at 360.
1 out of 1 hunk FAILED -- saving rejects to file LayoutTests/platform/gtk/TestExpectations.rej

Failed to run "[u'/mnt/git/webkit-commit-queue/Tools/Scripts/svn-apply', u'--force']" exit_code: 1 cwd: /mnt/git/webkit-commit-queue/

Full output: http://queues.webkit.org/results/13090443

[Simon Pena]

Created attachment 149494 [details]
Patch

[Simon Pena]

(In reply to comment #7)
> Created an attachment (id=149494) [details]
> Patch

Rebased against latest TestExpectations

[WebKit Review Bot]

Comment on attachment 149494 [details]
Patch

Clearing flags on attachment: 149494

Committed r121252: <http://trac.webkit.org/changeset/121252>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.