<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - [DFG] call-varargs-from-inlined-code-with-odd-number-of-arguments.js fails in POSIX environment if SamplingProfiler is enabled"
href="https://bugs.webkit.org/show_bug.cgi?id=153704">153704</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[DFG] call-varargs-from-inlined-code-with-odd-number-of-arguments.js fails in POSIX environment if SamplingProfiler is enabled
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>WebKit Nightly Build
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>OS</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>JavaScriptCore
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>utatane.tea@gmail.com
</td>
</tr></table>
<p>
<div>
<pre>I think, the signaling patch itself does not have problems and DFG or elsewhere have some problem...
I uploaded some very very simple patch in <a class="bz_bug_link
bz_status_NEW "
title="NEW - Enable SamplingProfiler on POSIX environment"
href="show_bug.cgi?id=153584">https://bugs.webkit.org/show_bug.cgi?id=153584</a>
That just emit signal in ::suspend and do nothing in ::resume. Signal handler does nothing.
And SamplingProfiler just calls suspend and resume periodically.
Anything special is not done in the above testing patch. It just emits signals. Signal handler does nothing.
Even in the above situation, call-varargs-from-inlined-code-with-odd-number-of-arguments.js sometimes fails. So I think the following situation.
1. Signal handler is set with SA_RESTART. But some system calls does not restart. For example, sleep, usleep are the cases in UNIX. We need to fix this anyway (I'll open the bug for that)
2. So, in some place, sleep is interrupted.
3. As a result, the path that is rarely taken may be taken. For example, if you set some threshold time for invoking DFG, it may not be executed in the usual test cases. But due to interrupted sleep, it may be invoked.
4. And since this path has some issue, it causes the test failure, the result becomes NaN.
So I think there are some issues in DFG because when disabling DFG (with env variables), the issue does not occur.
And when disabling FTL, the issue occur.
I opened 2 issues.
1. Making non-restarted syscalls signal-safe. (Like sleep) [<a class="bz_bug_link
bz_status_NEW "
title="NEW - Make non-restartable system calls EINTR aware"
href="show_bug.cgi?id=153703">https://bugs.webkit.org/show_bug.cgi?id=153703</a>]
2. Tracking call-varargs-from-inlined-code-with-odd-number-of-arguments.js issue [this one]</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>