160082 2016-07-22 03:51:21 -0700 REGRESSION(r203537): It made many tests crash on ARMv7 Linux platforms 2016-07-25 02:15:08 -0700 1 1 1 Unclassified WebKit JavaScriptCore Other Unspecified Unspecified RESOLVED FIXED P1 Critical --- 108645 159649 1 ossy webkit-unassigned benjamin cgarcia clopez commit-queue keith_miller mark.lam msaboff ossy saam oldest_to_newest 1213543 0 ossy 2016-07-22 03:51:21 -0700 GTK Linux ARM Release (Thumb2): - before: https://build.webkit.org/builders/GTK%20Linux%20ARM%20Release/builds/11651 - after: https://build.webkit.org/builders/GTK%20Linux%20ARM%20Release/builds/11662 (still running) JSCOnly Linux ARMv7 Thumb2 Release: - before: https://build.webkit.org/builders/JSCOnly%20Linux%20ARMv7%20Thumb2%20Release/builds/1232 - after: https://build.webkit.org/builders/JSCOnly%20Linux%20ARMv7%20Thumb2%20Release/builds/1243 (still running) /JSCOnly Linux ARMv7 Traditional Release: - before: https://build.webkit.org/builders/JSCOnly%20Linux%20ARMv7%20Traditional%20Release/builds/1613 - after: https://build.webkit.org/builders/JSCOnly%20Linux%20ARMv7%20Traditional%20Release/builds/1623 (still running) 1213545 1 ossy 2016-07-22 04:47:54 -0700 Managed to get a crash backtrace: Running sunspider-1.0/access-fannkuch.js.no-llint sunspider-1.0/access-fannkuch.js.no-llint: ASSERTION FAILED: !(reinterpret_cast<intptr_t>(target) & 1) sunspider-1.0/access-fannkuch.js.no-llint: ../../Source/JavaScriptCore/assembler/ARMv7Assembler.h(2757) : static void JSC::ARMv7Assembler::linkJumpAbsolute(uint16_t*, const uint16_t*, void*) sunspider-1.0/access-fannkuch.js.no-llint: 1 0xb63d0028 WTFCrash sunspider-1.0/access-fannkuch.js.no-llint: 2 0xb5c54616 JSC::ARMv7Assembler::linkJumpAbsolute(unsigned short*, unsigned short const*, void*) sunspider-1.0/access-fannkuch.js.no-llint: 3 0xb5c544ce JSC::ARMv7Assembler::linkJump(void*, JSC::AssemblerLabel, void*) sunspider-1.0/access-fannkuch.js.no-llint: 4 0xb5c554a4 JSC::AbstractMacroAssembler<JSC::ARMv7Assembler, JSC::MacroAssemblerARMv7>::linkJump(void*, JSC::AbstractMacroAssembler<JSC::ARMv7Assembler, JSC::MacroAssemblerARMv7>::Jump, JSC::CodeLocationLabel) sunspider-1.0/access-fannkuch.js.no-llint: 5 0xb5c55144 JSC::LinkBuffer::link(JSC::AbstractMacroAssembler<JSC::ARMv7Assembler, JSC::MacroAssemblerARMv7>::Jump, JSC::CodeLocationLabel) sunspider-1.0/access-fannkuch.js.no-llint: 6 0xb609a95e JSC::JITMathIC<JSC::JITAddGenerator>::generateOutOfLine(JSC::VM&, JSC::CodeBlock*, JSC::FunctionPtr) sunspider-1.0/access-fannkuch.js.no-llint: 7 0xb6094d52 sunspider-1.0/access-fannkuch.js.no-llint: Segmentation fault sunspider-1.0/access-fannkuch.js.no-llint: ERROR: Unexpected exit code: 139 FAIL: sunspider-1.0/access-fannkuch.js.no-llint 1213547 2 ossy 2016-07-22 04:58:38 -0700 (In reply to comment #1) > Managed to get a crash backtrace: > > Running sunspider-1.0/access-fannkuch.js.no-llint > sunspider-1.0/access-fannkuch.js.no-llint: ASSERTION FAILED: > !(reinterpret_cast<intptr_t>(target) & 1) > sunspider-1.0/access-fannkuch.js.no-llint: > ../../Source/JavaScriptCore/assembler/ARMv7Assembler.h(2757) : static void > JSC::ARMv7Assembler::linkJumpAbsolute(uint16_t*, const uint16_t*, void*) > sunspider-1.0/access-fannkuch.js.no-llint: 1 0xb63d0028 WTFCrash > sunspider-1.0/access-fannkuch.js.no-llint: 2 0xb5c54616 > JSC::ARMv7Assembler::linkJumpAbsolute(unsigned short*, unsigned short > const*, void*) > sunspider-1.0/access-fannkuch.js.no-llint: 3 0xb5c544ce > JSC::ARMv7Assembler::linkJump(void*, JSC::AssemblerLabel, void*) > sunspider-1.0/access-fannkuch.js.no-llint: 4 0xb5c554a4 > JSC::AbstractMacroAssembler<JSC::ARMv7Assembler, > JSC::MacroAssemblerARMv7>::linkJump(void*, > JSC::AbstractMacroAssembler<JSC::ARMv7Assembler, > JSC::MacroAssemblerARMv7>::Jump, JSC::CodeLocationLabel) > sunspider-1.0/access-fannkuch.js.no-llint: 5 0xb5c55144 > JSC::LinkBuffer::link(JSC::AbstractMacroAssembler<JSC::ARMv7Assembler, > JSC::MacroAssemblerARMv7>::Jump, JSC::CodeLocationLabel) > sunspider-1.0/access-fannkuch.js.no-llint: 6 0xb609a95e > JSC::JITMathIC<JSC::JITAddGenerator>::generateOutOfLine(JSC::VM&, > JSC::CodeBlock*, JSC::FunctionPtr) > sunspider-1.0/access-fannkuch.js.no-llint: 7 0xb6094d52 > sunspider-1.0/access-fannkuch.js.no-llint: Segmentation fault > sunspider-1.0/access-fannkuch.js.no-llint: ERROR: Unexpected exit code: 139 > FAIL: sunspider-1.0/access-fannkuch.js.no-llint It is an assertion on ARMv7 Thumb2 Linux. Didn't you notice the same crashes on your internal ARMv7 tester bots. ( Maybe it is a silly question, because they are completely broken 2 days ago after Filip's hacking. :) ) 1213553 3 ossy 2016-07-22 06:01:47 -0700 GDB backtrace: Program received signal SIGSEGV, Segmentation fault. 0xb64b0032 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:323 323 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0xb64b0032 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:323 #1 0xb5d34616 in JSC::ARMv7Assembler::linkJumpAbsolute (writeTarget=0xb2c40eb8, instruction=0xb2c40eb8, target=0xb6f3db41) at ../../Source/JavaScriptCore/assembler/ARMv7Assembler.h:2757 #2 0xb5d344ce in JSC::ARMv7Assembler::linkJump (code=0xb2c40eae, from=..., to=0xb6f3db41) at ../../Source/JavaScriptCore/assembler/ARMv7Assembler.h:2231 #3 0xb5d354a4 in JSC::AbstractMacroAssembler<JSC::ARMv7Assembler, JSC::MacroAssemblerARMv7>::linkJump (code=0xb2c40eae, jump=..., target=...) at ../../Source/JavaScriptCore/assembler/AbstractMacroAssembler.h:970 #4 0xb5d35144 in JSC::LinkBuffer::link (this=0xbeffe734, jump=..., label=...) at ../../Source/JavaScriptCore/assembler/LinkBuffer.h:143 #5 0xb617a95e in JSC::JITMathIC<JSC::JITAddGenerator>::generateOutOfLine (this=0xb2bdf240, vm=..., codeBlock=0xb27abd40, callReplacement=...) at ../../Source/JavaScriptCore/jit/JITMathIC.h:131 #6 0xb6174d52 in JSC::operationValueAddProfiledOptimize (exec=0xbeffeaa8, encodedOp1=-18480168992, encodedOp2=-18480170592, arithProfile=0xb1bf9ed4, addIC=0xb2bdf240) at ../../Source/JavaScriptCore/jit/JITOperations.cpp:2300 #7 0xb2c43394 in ?? () Backtrace stopped: previous frame identical to this frame (corrupt stack?) 1213555 4 ossy 2016-07-22 06:09:43 -0700 crash log on ARMv7 with ARM instruction set: Running stress/exit-after-int52-to-double.js.default stress/exit-after-int52-to-double.js.default: ASSERTION FAILED: linkBuffer.isValid() stress/exit-after-int52-to-double.js.default: ../../Source/JavaScriptCore/jit/JITMathIC.h(130) : void JSC::JITMathIC<Generator>::generateOutOfLine(JSC::VM&, JSC::CodeBlock*, JSC::FunctionPtr) [with GeneratorType = JSC::JITAddGenerator] stress/exit-after-int52-to-double.js.default: 1 0xb6394fb0 WTFCrash stress/exit-after-int52-to-double.js.default: 2 0xb5ea3104 JSC::JITMathIC<JSC::JITAddGenerator>::generateOutOfLine(JSC::VM&, JSC::CodeBlock*, JSC::FunctionPtr) stress/exit-after-int52-to-double.js.default: 3 0xb5e9a0b8 stress/exit-after-int52-to-double.js.default: Segmentation fault stress/exit-after-int52-to-double.js.default: ERROR: Unexpected exit code: 139 FAIL: stress/exit-after-int52-to-double.js.default 1213556 5 ossy 2016-07-22 06:13:19 -0700 (In reply to comment #4) > crash log on ARMv7 with ARM instruction set: > > Running stress/exit-after-int52-to-double.js.default > stress/exit-after-int52-to-double.js.default: ASSERTION FAILED: > linkBuffer.isValid() > stress/exit-after-int52-to-double.js.default: > ../../Source/JavaScriptCore/jit/JITMathIC.h(130) : void > JSC::JITMathIC<Generator>::generateOutOfLine(JSC::VM&, JSC::CodeBlock*, > JSC::FunctionPtr) [with GeneratorType = JSC::JITAddGenerator] > stress/exit-after-int52-to-double.js.default: 1 0xb6394fb0 WTFCrash > stress/exit-after-int52-to-double.js.default: 2 0xb5ea3104 > JSC::JITMathIC<JSC::JITAddGenerator>::generateOutOfLine(JSC::VM&, > JSC::CodeBlock*, JSC::FunctionPtr) > stress/exit-after-int52-to-double.js.default: 3 0xb5e9a0b8 > stress/exit-after-int52-to-double.js.default: Segmentation fault > stress/exit-after-int52-to-double.js.default: ERROR: Unexpected exit code: > 139 > FAIL: stress/exit-after-int52-to-double.js.default It seems it is a similar to bug159720 . Can't we disable this new feature somehow similar to https://trac.webkit.org/changeset/203272 ? I can't debug new and new regressions at a pace you add them. :-/ And it seems nobody else help maintaining ARM Linux ports ... 1213588 6 saam 2016-07-22 09:08:29 -0700 I ran armv7 locally before I landed on iOS and all jsc stress tests passed. I'll check our bots. It's only failing debug tests? Or release tests too? 1213591 7 ossy 2016-07-22 09:12:09 -0700 (In reply to comment #6) > I ran armv7 locally before I landed on iOS and all jsc stress tests passed. > I'll check our bots. It's only failing debug tests? Or release tests too? All ARM buildbots on build.webkit.org are release bots, there are 1016 crashes on the GTK bot, 113 on the JSCOnly bot. Both of them are ARMv7 Thumb2 tester. And there are 4141 crashes on the JSCOnly ARMv7 traditional (ARM instruction set) bot. I generated the debug crash backtraces locally. 1213593 8 saam 2016-07-22 09:17:29 -0700 It's probably this line that's crashing: linkBuffer.link(jump, CodeLocationLabel(m_code.code().executableAddress())); Maybe we should be linking the dataAddress? That begs the question of why I didn't see the same crash. 1213602 9 saam 2016-07-22 09:30:56 -0700 I think the line I posted is the bug. I'll look into it when I get into the office. Ossy can you try this fix locally that just does: linkBuffer.link(jump, CodeLocationLabel(m_code.code())); 1213604 10 ossy 2016-07-22 09:35:15 -0700 (In reply to comment #9) > I think the line I posted is the bug. I'll look into it when I get into the > office. > > Ossy can you try this fix locally that just does: > > linkBuffer.link(jump, CodeLocationLabel(m_code.code())); Sure, will check in 10 minutes. 1213611 11 ossy 2016-07-22 09:59:55 -0700 (In reply to comment #10) > (In reply to comment #9) > > I think the line I posted is the bug. I'll look into it when I get into the > > office. > > > > Ossy can you try this fix locally that just does: > > > > linkBuffer.link(jump, CodeLocationLabel(m_code.code())); > > Sure, will check in 10 minutes. I checked, it seems it fixes the ARMv7 Thumb2 issue. 1213651 12 saam 2016-07-22 11:30:40 -0700 (In reply to comment #11) > (In reply to comment #10) > > (In reply to comment #9) > > > I think the line I posted is the bug. I'll look into it when I get into the > > > office. > > > > > > Ossy can you try this fix locally that just does: > > > > > > linkBuffer.link(jump, CodeLocationLabel(m_code.code())); > > > > Sure, will check in 10 minutes. > > I checked, it seems it fixes the ARMv7 Thumb2 issue. Ok. I'll test locally too and then put a patch up for review. FWIW, this is the behavior that PolymorphicAccess uses, and that's well tested code. We should adopt this behavior regardless. I'm just curious if I hit asserts from this as well on iOS armv7. 1213705 13 284366 saam 2016-07-22 13:14:34 -0700 Created attachment 284366 patch 1213710 14 284366 keith_miller 2016-07-22 13:24:45 -0700 Comment on attachment 284366 patch r=me. 1213726 15 saam 2016-07-22 13:39:42 -0700 fixed in: https://trac.webkit.org/changeset/203615 1214129 16 ossy 2016-07-25 02:15:08 -0700 (In reply to comment #15) > fixed in: > https://trac.webkit.org/changeset/203615 ARM traditional crashes are still valid, I filed a new bug report for it: bug160157 . 284366 2016-07-22 13:14:34 -0700 2016-07-22 13:24:45 -0700 patch patch.diff text/plain 1802 saam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjAzNjEwKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE5IEBA CisyMDE2LTA3LTIyICBTYWFtIEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUuY29tPgorCisgICAgICAg IFJFR1JFU1NJT04ocjIwMzUzNyk6IEl0IG1hZGUgbWFueSB0ZXN0cyBjcmFzaCBvbiBBUk12NyBM aW51eCBwbGF0Zm9ybXMKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcu Y2dpP2lkPTE2MDA4MgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisg ICAgICAgIFdlIHdlcmUgaW1wcm9wZXJseSBsaW5raW5nIHRoZSBKdW1wIGluIHRoZSBsaW5rIGJ1 ZmZlci4KKyAgICAgICAgSXQgY2F1c2VkIHVzIHRvIGJlIGxpbmtpbmcgYWdhaW5zdCB0aGUgZXhl Y3V0YWJsZSBhZGRyZXNzCisgICAgICAgIHdoaWNoIGFsd2F5cyBoYXMgYml0IDAgc2V0LiBXZSBz aG91bGRuJ3QgYmUgZG9pbmcgdGhhdC4KKyAgICAgICAgVGhpcyBwYXRjaCBmaXhlcyB0aGlzLCBi eSB1c2luZyB0aGUgc2FtZSBpZGlvbSB0aGF0CisgICAgICAgIFBvbHltb3JwaGljQWNjZXNzIHVz ZXMgdG8gbGluayBhIGp1bXAgdG8gb3V0IG9mIGxpbmUgY29kZS4KKworICAgICAgICAqIGppdC9K SVRNYXRoSUMuaDoKKyAgICAgICAgKEpTQzo6SklUTWF0aElDOjpnZW5lcmF0ZU91dE9mTGluZSk6 CisKIDIwMTYtMDctMjIgIFBlciBBcm5lIFZvbGxhbiAgPHB2b2xsYW5AYXBwbGUuY29tPgogCiAg ICAgICAgIFtXaW5dIGpzYy5leGUgc29tZXRpbWVzIG5ldmVyIGV4aXRzLgpJbmRleDogU291cmNl L0phdmFTY3JpcHRDb3JlL2ppdC9KSVRNYXRoSUMuaAo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2 YVNjcmlwdENvcmUvaml0L0pJVE1hdGhJQy5oCShyZXZpc2lvbiAyMDM2MDMpCisrKyBTb3VyY2Uv SmF2YVNjcmlwdENvcmUvaml0L0pJVE1hdGhJQy5oCSh3b3JraW5nIGNvcHkpCkBAIC0xMjgsNyAr MTI4LDcgQEAgcHVibGljOgogICAgICAgICAgICAgUkVMRUFTRV9BU1NFUlQoaml0Lm1fYXNzZW1i bGVyLmJ1ZmZlcigpLmNvZGVTaXplKCkgPD0gc3RhdGljX2Nhc3Q8c2l6ZV90PihtX2lubGluZVNp emUpKTsKICAgICAgICAgICAgIExpbmtCdWZmZXIgbGlua0J1ZmZlcihqaXQsIG1faW5saW5lU3Rh cnQuZGF0YUxvY2F0aW9uKCksIGppdC5tX2Fzc2VtYmxlci5idWZmZXIoKS5jb2RlU2l6ZSgpLCBK SVRDb21waWxhdGlvbk11c3RTdWNjZWVkLCBuZWVkc0JyYW5jaENvbXBhY3Rpb24pOwogICAgICAg ICAgICAgUkVMRUFTRV9BU1NFUlQobGlua0J1ZmZlci5pc1ZhbGlkKCkpOwotICAgICAgICAgICAg bGlua0J1ZmZlci5saW5rKGp1bXAsIENvZGVMb2NhdGlvbkxhYmVsKG1fY29kZS5jb2RlKCkuZXhl Y3V0YWJsZUFkZHJlc3MoKSkpOworICAgICAgICAgICAgbGlua0J1ZmZlci5saW5rKGp1bXAsIENv ZGVMb2NhdGlvbkxhYmVsKG1fY29kZS5jb2RlKCkpKTsKICAgICAgICAgICAgIEZJTkFMSVpFX0NP REUobGlua0J1ZmZlciwgKCJKSVRNYXRoSUM6IGxpbmtpbmcgY29uc3RhbnQganVtcCB0byBvdXQg b2YgbGluZSBzdHViIikpOwogICAgICAgICB9CiAgICAgfQo=