[Webkit-unassigned] [Bug 209824] New: REGRESSION: ASSERTION FAILED: regExpObjectNode in JSC::DFG::StrengthReductionPhase::handleNode

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Tue Mar 31 11:49:03 PDT 2020


https://bugs.webkit.org/show_bug.cgi?id=209824

            Bug ID: 209824
           Summary: REGRESSION: ASSERTION FAILED: regExpObjectNode in
                    JSC::DFG::StrengthReductionPhase::handleNode
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: ryanhaddad at apple.com

36 tests are asserting on the Debug JSC queue:

 ASSERTION FAILED: regExpObjectNode
 ./dfg/DFGStrengthReductionPhase.cpp(542) : void JSC::DFG::StrengthReductionPhase::handleNode()
 1   0x10a4c7c29 WTFCrash
 2   0x10ac2601b WTFCrashWithInfo(int, char const*, char const*, int)
 3   0x10b514e36 JSC::DFG::StrengthReductionPhase::handleNode()
 4   0x10b512942 JSC::DFG::StrengthReductionPhase::run()
 5   0x10b512704 bool JSC::DFG::runAndLog<JSC::DFG::StrengthReductionPhase>(JSC::DFG::StrengthReductionPhase&)
 6   0x10b504a2b bool JSC::DFG::runPhase<JSC::DFG::StrengthReductionPhase>(JSC::DFG::Graph&)
 7   0x10b5049f5 JSC::DFG::performStrengthReduction(JSC::DFG::Graph&)
 8   0x10b413440 JSC::DFG::Plan::compileInThreadImpl()
 9   0x10b40ff48 JSC::DFG::Plan::compileInThread(JSC::DFG::ThreadData*)
 10  0x10b56b1fe JSC::DFG::Worklist::ThreadBody::work()
 11  0x10a4de593 WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0::operator()() const
 12  0x10a4de17e WTF::Detail::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0, void>::call()
 13  0x10a4f2252 WTF::Function<void ()>::operator()() const
 14  0x10a5a6b78 WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*)
 15  0x10a5b3fa8 WTF::wtfThreadEntryPoint(void*)
 16  0x7fff70703109 _pthread_start
 17  0x7fff706feb8b thread_start

** The following JSC stress test failures have been introduced:
        microbenchmarks/emscripten-cube2hash.js.ftl-eager
        microbenchmarks/emscripten-cube2hash.js.ftl-eager-no-cjit
        microbenchmarks/emscripten-cube2hash.js.ftl-eager-no-cjit-b3o1
        stress/ftl-regexp-exec.js.bytecode-cache
        stress/ftl-regexp-exec.js.default
        stress/ftl-regexp-exec.js.ftl-eager
        stress/ftl-regexp-exec.js.ftl-eager-no-cjit
        stress/ftl-regexp-exec.js.ftl-eager-no-cjit-b3o1
        stress/ftl-regexp-exec.js.ftl-no-cjit-b3o0
        stress/ftl-regexp-exec.js.ftl-no-cjit-no-inline-validate
        stress/ftl-regexp-exec.js.ftl-no-cjit-no-put-stack-validate
        stress/ftl-regexp-exec.js.ftl-no-cjit-small-pool
        stress/ftl-regexp-exec.js.ftl-no-cjit-validate-sampling-profiler
        stress/phantom-regexp-regexp-exec.js.bytecode-cache
        stress/phantom-regexp-regexp-exec.js.default
        stress/phantom-regexp-regexp-exec.js.ftl-eager
        stress/phantom-regexp-regexp-exec.js.ftl-eager-no-cjit
        stress/phantom-regexp-regexp-exec.js.ftl-eager-no-cjit-b3o1
        stress/phantom-regexp-regexp-exec.js.ftl-no-cjit-b3o0
        stress/phantom-regexp-regexp-exec.js.ftl-no-cjit-no-inline-validate
        stress/phantom-regexp-regexp-exec.js.ftl-no-cjit-no-put-stack-validate
        stress/phantom-regexp-regexp-exec.js.ftl-no-cjit-small-pool
        stress/phantom-regexp-regexp-exec.js.ftl-no-cjit-validate-sampling-profiler
        stress/regexp-exec-effect-after-exception.js.ftl-eager
        stress/regexp-exec-effect-after-exception.js.ftl-eager-no-cjit
        stress/regexp-exec-effect-after-exception.js.ftl-eager-no-cjit-b3o1
        stress/regexp-exec-effect-after-exception.js.ftl-no-cjit-b3o0
        stress/regexp-exec-effect-after-exception.js.ftl-no-cjit-no-inline-validate
        stress/regexp-exec-effect-after-exception.js.ftl-no-cjit-no-put-stack-validate
        stress/regexp-exec-effect-after-exception.js.ftl-no-cjit-validate-sampling-profiler
        stress/v8-regexp-strict.js.ftl-eager
        stress/v8-regexp-strict.js.ftl-eager-no-cjit
        stress/v8-regexp-strict.js.ftl-eager-no-cjit-b3o1
        v8-v6/v8-regexp.js.ftl-eager
        v8-v6/v8-regexp.js.ftl-eager-no-cjit
        v8-v6/v8-regexp.js.ftl-eager-no-cjit-b3o1

https://build.webkit.org/builders/Apple-Catalina-Debug-JSC-Tests/builds/596/steps/jscore-test/logs/stdio

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200331/fb5d6f69/attachment-0001.htm>


More information about the webkit-unassigned mailing list