[Webkit-unassigned] [Bug 151440] New: REGRESSION(r192599): It made 34 JSC tests crash on ARM Linux

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=151440

            Bug ID: 151440
           Summary: REGRESSION(r192599): It made 34 JSC tests crash on ARM
                    Linux
    Classification: Unclassified
           Product: WebKit
           Version: Other
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Critical
          Priority: P1
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: ossy at webkit.org
                CC: ggaren at apple.com, mark.lam at apple.com
            Blocks: 108645, 151415

https://trac.webkit.org/changeset/192599 made 34 JSC stress tests
crash at least on ARM Linux platforms. (ARMv7 - ARM and Thumb2
instruction sets too; AArch64)

Maybe these tests fail on iOS too, but unfortunately 
there is no public iOS buildbot, so I don't know.

- https://build.webkit.org/builders/EFL%20Linux%20ARMv7%20Traditional%20Release/builds/16061
- https://build.webkit.org/builders/EFL%20Linux%20ARMv7%20Thumb2%20Release/builds/16212
- https://build.webkit.org/builders/EFL%20Linux%20AArch64%20Release/builds/4416
  (note: there were 25-30 failures on AArch64 before this change)

** The following JSC stress test failures have been introduced:
    jsc-layout-tests.yaml/js/script-tests/dfg-arguments-alias-one-block-osr-exit.js.layout
    jsc-layout-tests.yaml/js/script-tests/dfg-arguments-alias-one-block-osr-exit.js.layout-dfg-eager-no-cjit
    jsc-layout-tests.yaml/js/script-tests/dfg-arguments-alias-one-block-osr-exit.js.layout-no-cjit
    jsc-layout-tests.yaml/js/script-tests/dfg-arguments-alias-one-block-osr-exit.js.layout-no-llint
    jsc-layout-tests.yaml/js/script-tests/dfg-arguments-alias-one-block-overwrite-arguments.js.layout
    jsc-layout-tests.yaml/js/script-tests/dfg-arguments-alias-one-block-overwrite-arguments.js.layout-dfg-eager-no-cjit
    jsc-layout-tests.yaml/js/script-tests/dfg-arguments-alias-one-block-overwrite-arguments.js.layout-no-cjit
    jsc-layout-tests.yaml/js/script-tests/dfg-arguments-alias-one-block-overwrite-arguments.js.layout-no-llint
    jsc-layout-tests.yaml/js/script-tests/dfg-double-use-of-post-simplification-double-prediction.js.layout
    jsc-layout-tests.yaml/js/script-tests/dfg-double-use-of-post-simplification-double-prediction.js.layout-dfg-eager-no-cjit
    jsc-layout-tests.yaml/js/script-tests/dfg-double-use-of-post-simplification-double-prediction.js.layout-no-cjit
    jsc-layout-tests.yaml/js/script-tests/dfg-double-use-of-post-simplification-double-prediction.js.layout-no-llint
    regress/script-tests/v8-raytrace-with-empty-try-catch.js.dfg-maximal-flush-validate-no-cjit
    stress/double-rep-with-null.js.always-trigger-copy-phase
    stress/double-rep-with-null.js.default
    stress/double-rep-with-undefined.js.dfg-maximal-flush-validate-no-cjit
    stress/double-rep-with-undefined.js.no-cjit-validate-phases
    stress/double-rep-with-undefined.js.no-llint
    stress/op_add.js.always-trigger-copy-phase
    stress/op_add.js.default
    stress/op_add.js.dfg-eager
    stress/op_add.js.dfg-eager-no-cjit-validate
    stress/op_add.js.dfg-maximal-flush-validate-no-cjit
    stress/op_add.js.no-cjit-validate-phases
    stress/op_add.js.no-llint
    stress/op_sub.js.always-trigger-copy-phase
    stress/op_sub.js.default
    stress/op_sub.js.dfg-eager
    stress/op_sub.js.dfg-eager-no-cjit-validate
    stress/op_sub.js.dfg-maximal-flush-validate-no-cjit
    stress/op_sub.js.no-cjit-validate-phases
    stress/op_sub.js.no-llint
    stress/v8-raytrace-strict.js.dfg-maximal-flush-validate-no-cjit
    v8-v6/v8-raytrace.js.dfg-maximal-flush-validate-no-cjit

I'll try to create debug backtraces in the following week to help fixing this regression.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20151119/70b5fda5/attachment-0001.html>