[Webkit-unassigned] [Bug 135026] REGRESSION: New int52 test failure on ARM64, possibly due to r171096
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Thu Jul 17 14:49:22 PDT 2014
https://bugs.webkit.org/show_bug.cgi?id=135026
--- Comment #1 from Michael Saboff <msaboff at apple.com> 2014-07-17 14:49:37 PST ---
Here is the output from one failure, stress/int52-force-osr-exit-path.js.dfg-eager-no-cjit-validate:
Found an Int52RepUse to a double result: @27 -> Check:Int52Rep:@23<Double>
DFG for foo#BW9ZEJ:[0x10048af40->0x10048b3c0->0x1007cfb70, DFGFunctionCall, 36 (NeverInline)]:
Fixpoint state: BeforeFixpoint; Form: ThreadedCPS; Unification state: GloballyUnified; Ref count state: EverythingIsLive
Block #0 (bc#0): (OSR target)
Execution count: 1.000000
Predecessors:
Dominated by: #0
Dominates: #0 #1 #2
vars before: <empty>
var links: arg4:@4 arg3:@3 arg2:@2 arg1:@1 arg0:@0
0: < 1:-> SetArgument(arg0(a), W:SideState, bc#0) predicting Otherobj
1: < 1:-> SetArgument(IsFlushed, arg1(B<Int32>/FlushedInt32), W:SideState, bc#0) predicting Int32
2: < 1:-> SetArgument(IsFlushed, arg2(C<Int32>/FlushedInt32), W:SideState, bc#0) predicting Int32
3: < 1:-> SetArgument(IsFlushed, arg3(D<Boolean>/FlushedBoolean), W:SideState, bc#0) predicting Bool
4: < 1:-> SetArgument(IsFlushed, arg4(E<Final>/FlushedCell), W:SideState, bc#0) predicting Final
5: < 1:-> JSConstant(JS|PureInt, Other, $1 = Undefined, bc#0)
6: < 1:-> MovHint(@5, loc0, W:SideState, bc#0)
7: < 1:-> SetLocal(@5, CanExit, loc0(F~<Other>/FlushedJSValue), W:Variables(-1), bc#0) predicting Other
8: < 1:-> GetLocal(@1, JS|PureNum|UseAsOther|CanExit, Int32, arg1(B<Int32>/FlushedInt32), R:Variables(7), bc#1) predicting Int32
9: < 1:-> GetLocal(@2, JS|PureNum|UseAsOther|CanExit, Int32, arg2(C<Int32>/FlushedInt32), R:Variables(8), bc#1) predicting Int32
49: < 1:-> Int52Rep(Check:Int32:@8, Int52|PureInt|CanExit, Int32, bc#1)
50: < 1:-> Int52Rep(Check:Int32:@9, Int52|PureInt|CanExit, Int32, bc#1)
10: < 1:-> ArithAdd(Check:Int52Rep:@49<Int52>, Check:Int52Rep:@50<Int52>, Int52|PureNum|UseAsOther|MayOverflowInBaseline|MayOverflowInDFG|CanExit, Int52, CheckOverflow, bc#1)
51: <!0:-> Phantom(@9, MustGen|CanExit, bc#1)
52: <!0:-> Phantom(@8, MustGen|CanExit, bc#1)
11: < 1:-> MovHint(Check:Int52Rep:@10<Int52>, loc0, W:SideState, bc#1)
12: < 1:-> SetLocal(Check:Int52Rep:@10<Int52>, CanExit, loc0(G<Int52>/FlushedInt52), W:Variables(-1), bc#6) predicting Int52
13: < 1:-> GetLocal(@3, JS|UseAsOther|CanExit, Bool, arg3(D<Boolean>/FlushedBoolean), R:Variables(9), bc#6) predicting Bool
14: <!0:-> Branch(Check:Boolean:@13, MustGen|CanExit, T:#1/w:1.000000, F:#2/w:1.000000, W:SideState, bc#6)
vars after: <empty>
var links: arg4:@4 arg3:@13 arg2:@9 arg1:@8 arg0:@0 loc0:@12
Block #1 (bc#9):
Execution count: 1.000000
Predecessors: #0
Dominated by: #0 #1
Dominates: #1
Phi Nodes: @44<1>->(@12), @45<1>->(@4), @46<1>->(@1), @47<1>->(@2), @48<1>->(@3)
vars before: <empty>
var links: arg4:@45 arg3:@48 arg2:@47 arg1:@46 loc0:@44
15: < 1:-> GetLocal(@44, Int52|PureNum|UseAsOther|CanExit, Int52, loc0(G<Int52>/FlushedInt52), R:Variables(-1), bc#9) predicting Int52
16: < 1:-> MovHint(Check:Int52Rep:@15<Int52>, loc1, W:SideState, bc#9)
17: < 1:-> SetLocal(@53, CanExit, loc1(I~<Int52>/FlushedJSValue), W:Variables(-2), bc#12) predicting Int52
18: <!0:-> ForceOSRExit(MustGen|CanExit, W:SideState, bc#12)
19: < 1:-> GetLocal(@45, JS|UseAsOther|CanExit, Final, arg4(E<Final>/FlushedCell), R:Variables(10), bc#12) predicting Final
20: <!0:-> GetById(Check:Cell:@19, JS|MustGen|Clobbers|PureNum|UseAsOther|CanExit, id0{f}, R:World, W:World, bc#12) predicting None
21: < 1:-> MovHint(@20, loc2, W:SideState, bc#12)
22: < 1:-> SetLocal(@20, CanExit, loc2(K~/FlushedJSValue), W:Variables(-3), bc#21) predicting None
23: < 1:-> ArithSub(Check:DoubleRep:@55<Double>, Check:DoubleRep:@56<Double>, Double|PureNum|UseAsOther|CanExit, NotSet, bc#21)
24: < 1:-> MovHint(Check:DoubleRep:@23<Double>, loc1, W:SideState, bc#21)
25: < 1:-> SetLocal(@59, CanExit, loc1(L~/FlushedJSValue), W:Variables(-2), bc#26) predicting None
26: < 1:-> MovHint(Check:DoubleRep:@23<Double>, loc0, W:SideState, bc#26)
27: < 1:-> SetLocal(Check:Int52Rep:@23<Double>, CanExit, loc0(G<Int52>/FlushedInt52), W:Variables(-1), bc#29) predicting Int52
28: <!0:-> Jump(MustGen|CanExit, T:#2, W:SideState, bc#29)
vars after: <empty>
var links: arg4:@19 arg3:@48 arg2:@47 arg1:@46 loc0:@27 loc1:@25 loc2:@22
Block #2 (bc#29):
Execution count: 1.000000
Predecessors: #0 #1
Dominated by: #0 #2
Dominates: #2
Phi Nodes: @39<1>->(@27, @12), @40<1>->(@45, @4), @41<1>->(@48, @3), @42<1>->(@47, @2), @43<1>->(@46, @1)
vars before: <empty>
var links: arg4:@34 arg3:@35 arg2:@36 arg1:@37 loc0:@39
29: < 1:-> GetLocal(@39, Int52|PureNum|UseAsOther|CanExit, Int52, loc0(G<Int52>/FlushedInt52), R:Variables(-1), bc#29) predicting Int52
30: < 1:-> JSConstant(JS|PureNum|UseAsOther, Int32, $0 = Int32: 1, bc#29)
31: < 1:-> ArithAdd(Check:Int52Rep:@29<Int52>, Check:Int52Rep:@30, Int52|UseAsOther|MayOverflowInBaseline|CanExit, Int52, CheckOverflow, bc#29)
32: < 1:-> MovHint(@31<Int52>, loc1, W:SideState, bc#29)
33: < 1:-> SetLocal(@31<Int52>, CanExit, loc1(O~<Int52>/FlushedJSValue), W:Variables(-2), bc#34) predicting Int52
34: <!0:-> Flush(@40, MustGen|IsFlushed, arg4(E<Final>/FlushedCell), W:SideState, bc#34) predicting Final
35: <!0:-> Flush(@41, MustGen|IsFlushed, arg3(D<Boolean>/FlushedBoolean), W:SideState, bc#34) predicting Bool
36: <!0:-> Flush(@42, MustGen|IsFlushed, arg2(C<Int32>/FlushedInt32), W:SideState, bc#34) predicting Int32
37: <!0:-> Flush(@43, MustGen|IsFlushed, arg1(B<Int32>/FlushedInt32), W:SideState, bc#34) predicting Int32
38: <!0:-> Return(@31<Int52>, MustGen|CanExit, W:SideState, bc#34)
vars after: <empty>
var links: arg4:@34 arg3:@35 arg2:@36 arg1:@37 loc0:@29<Int52> loc1:@33
1 0x186a02224 <redacted>
2 0x1868b3f74 <redacted>
3 0x1868b3c98 <redacted>
4 0x1868b3c30 <redacted>
5 0x186a3d6b0 <redacted>
6 0x186a3d308 <redacted>
7 0x186a0120c <redacted>
8 0x186b1a014 <redacted>
9 0x1432c8c5c
10 0x1432ca200
11 0x186ba3454 <redacted>
12 0x186b10c3c <redacted>
13 0x186852d84 <rRunning regress/script-tests/constant-test.js.no-llint
[2014-07-15 12:49:48] INFO: edacted>
14 0x186850e30 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*)
15 0x1000f7cb8
16 0x1000f7648
17 0x196772a08 <redacted>
./test_script_1950: line 2: 16616 Segmentation fault: 11 "$@" /System/Library/Frameworks/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --validateGraph\=true --thresholdForJITAfterWarmUp\=10 --thresholdForJITSoon\=10 --thresholdForOptimizeAfterWarmUp\=20 --thresholdForOptimizeAfterLongWarmUp\=20 --thresholdForOptimizeSoon\=20 --thresholdForFTLOptimizeAfterWarmUp\=20 --thresholdForFTLOptimizeSoon\=20 --enableConcurrentJIT\=false --thresholdForJITAfterWarmUp\=100 int52-force-osr-exit-path.js
ERROR: Unexpected exit code: 139
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list