[Webkit-unassigned] [Bug 94191] New: JSC: 2 regex assertion failures in webkit tests with LLint interpreter

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=94191

           Summary: JSC: 2 regex assertion failures in webkit tests with
                    LLint interpreter
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: mark.lam at apple.com


If you disable the JITs and run interpreted only on a debug build, 2 regex tests will crash with assertion failures:

Regressions: Unexpected crashes : (2)
  fast/js/regexp-non-greedy-parentheses.html = CRASH
  fast/regex/parentheses.html = CRASH

To reproduce:
1. Apply the following patch to runtime/Options.cpp.  This will disable the JITs:

Index: Source/JavaScriptCore/runtime/Options.cpp
===================================================================
--- Source/JavaScriptCore/runtime/Options.cpp    (revision 125744)
+++ Source/JavaScriptCore/runtime/Options.cpp    (working copy)
@@ -138,6 +138,9 @@
     ; // Deconfuse editors that do auto indentation
 #endif

+    useJIT() = false;
+    useDFGJIT() = false;
+
     // Do range checks where needed and make corrections to the options:
     ASSERT(thresholdForOptimizeAfterLongWarmUp() >= thresholdForOptimizeAfterWarmUp());
     ASSERT(thresholdForOptimizeAfterWarmUp() >= thresholdForOptimizeSoon());

2. Do a debug build.
3. Run the webkit JS tests:

$ ./Tools/Scripts/run-webkit-tests --debug fast/js/ fast/regex/ ietestcenter/Javascript/ sputnik/

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.