[Webkit-unassigned] [Bug 230215] New: [JSC][32bit] Crash in stress/has-own-property-name-cache-symbols-and-strings.js, not enough registers

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=230215

            Bug ID: 230215
           Summary: [JSC][32bit] Crash in
                    stress/has-own-property-name-cache-symbols-and-strings
                    .js, not enough registers
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: xan.lopez at gmail.com

Starting program: /home/igalia/xlopez/WebKit/WebKitBuild/Debug/bin/jsc -f JSTests/stress/has-own-property-name-cache-symbols-and-strings.js
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/arm-linux-gnueabihf/libthread_db.so.1".
[New Thread 0xf3fb8440 (LWP 17334)]

Thread 1 "jsc" received signal SIGABRT, Aborted.
__libc_do_syscall () at ../sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:47
47      ../sysdeps/unix/sysv/linux/arm/libc-do-syscall.S: No such file or directory.
(gdb) bt
#0  __libc_do_syscall () at ../sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:47
#1  0xf5e6dea0 in __libc_signal_restore_set (set=0xfffed31c) at ../sysdeps/unix/sysv/linux/internal-signals.h:86
#2  __GI_raise (sig=sig at entry=6) at ../sysdeps/unix/sysv/linux/raise.c:48
#3  0xf5e5e7a2 in __GI_abort () at abort.c:79
#4  0xf6cc52ac in JSC::ScratchRegisterAllocator::allocateScratch<JSC::GPRInfo> (this=0xfffed640) at ../../Source/JavaScriptCore/jit/ScratchRegisterAllocator.cpp:97
#5  0xf6cbc10c in JSC::ScratchRegisterAllocator::allocateScratchGPR (this=0xfffed640) at ../../Source/JavaScriptCore/jit/ScratchRegisterAllocator.cpp:102
#6  0xf62d1ce0 in JSC::AccessCase::generateImpl (this=0xf3699300, state=...) at ../../Source/JavaScriptCore/bytecode/AccessCase.cpp:2276
#7  0xf62cfc4a in JSC::AccessCase::generateWithGuard (this=0xf3699300, state=..., fallThrough=...) at ../../Source/JavaScriptCore/bytecode/AccessCase.cpp:1755
#8  0xf63afcea in JSC::PolymorphicAccess::regenerate (this=0xf369cf20, locker=..., vm=..., globalObject=0xf20f9038, codeBlock=0xf1eac000, ecmaMode=..., stubInfo=...)
    at ../../Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp:672
#9  0xf63d7d34 in operator() (__closure=0xfffeec94) at ../../Source/JavaScriptCore/bytecode/StructureStubInfo.cpp:221
#10 0xf63d7e8e in JSC::StructureStubInfo::addAccessCase (this=0xf36f6948, locker=..., globalObject=0xf20f9038, codeBlock=0xf1eac000, ecmaMode=..., ident=..., 
    accessCase=...) at ../../Source/JavaScriptCore/bytecode/StructureStubInfo.cpp:245
#11 0xf6cb774a in JSC::tryCachePutBy (globalObject=0xf20f9038, codeBlock=0xf1eac000, baseValue=..., oldStructure=0xf1e9caf0, propertyName=..., slot=..., stubInfo=..., 
    putByKind=JSC::PutByKind::ByVal, putKind=JSC::PutKind::NotDirect) at ../../Source/JavaScriptCore/jit/Repatch.cpp:877
#12 0xf6cb790a in JSC::repatchPutBy (globalObject=0xf20f9038, codeBlock=0xf1eac000, baseValue=..., oldStructure=0xf1e9caf0, propertyName=..., slot=..., stubInfo=..., 
    putByKind=JSC::PutByKind::ByVal, putKind=JSC::PutKind::NotDirect) at ../../Source/JavaScriptCore/jit/Repatch.cpp:897
#13 0xf6c5b34c in JSC::putByValOptimize (globalObject=0xf20f9038, codeBlock=0xf1eac000, baseValue=..., subscript=..., value=..., stubInfo=0xf36f6948, profile=0xf20f6e48, 
    ecmaMode=...) at ../../Source/JavaScriptCore/jit/JITOperations.cpp:1055
#14 0xf6c5b4fe in JSC::operationPutByValNonStrictOptimize (globalObject=0xf20f9038, encodedBaseValue=-17416011584, encodedSubscript=-17415806032, encodedValue=-4294967271, 
    stubInfo=0xf36f6948, profile=0xf20f6e48) at ../../Source/JavaScriptCore/jit/JITOperations.cpp:1087
#15 0xf35fd662 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb) 

Probably also introduced by bug #229229.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210913/8070b4f2/attachment-0001.htm>