[Webkit-unassigned] [Bug 69038] REGRESSION(r96189): fast/dom/SelectorAPI/resig-SelectorsAPI-test.xhtml, inspector/console/console-format.html, inspector/console/console-dir-global.html failing on SnowLeopard Intel Debug (Tests)

Wed Sep 28 22:38:12 PDT 2011

https://bugs.webkit.org/show_bug.cgi?id=69038

--- Comment #2 from Filip Pizlo <fpizlo at apple.com>  2011-09-28 22:38:12 PST ---
Boy, it sure looks like the world is messed up when you look at fast/dom/SelectorAPI/resig-SelectorsAPI-test.xhtml.  And it does not appear to be the fault of r96189 per se; it's just that that patch increases coverage enough that we can start to see some hairy bugs from previous work in DFG.

I'm still studying the failure but so far it looks like the following is going wrong:

1) GetMethod sometimes appears to the DFG to have no value profiling even though it has clearly executed at least once.  This is evident since other operations in the same basic block have value profiling.

2) The DEBUG_VERBOSE logic for GetScopedVar is totally wrong.  This is benign, but still, annoying.

3) This code causes systematic speculation failures because of polymorphic variable reuse, which should be fixed once https://bugs.webkit.org/show_bug.cgi?id=68593 is done.

4) The code that actually fails isn't even running in DFG anyway, though there is plenty of code that runs in DFG outside of what is actually failing.  So it's either memory corruption (which I see no other evidence for) or the code that is running in DFG is performing some manner of setup that ends up mattering later.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.