94191 2012-08-15 23:51:10 -0700 JSC: 2 regex assertion failures in webkit tests with LLint interpreter 2013-02-26 03:39:57 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified NEW InRadar P2 Normal --- 1 mark.lam webkit-unassigned mark.lam ossy rgabor zherczeg oldest_to_newest 696794 0 mark.lam 2012-08-15 23:51:10 -0700 If you disable the JITs and run interpreted only on a debug build, 2 regex tests will crash with assertion failures: Regressions: Unexpected crashes : (2) fast/js/regexp-non-greedy-parentheses.html = CRASH fast/regex/parentheses.html = CRASH To reproduce: 1. Apply the following patch to runtime/Options.cpp. This will disable the JITs: Index: Source/JavaScriptCore/runtime/Options.cpp =================================================================== --- Source/JavaScriptCore/runtime/Options.cpp (revision 125744) +++ Source/JavaScriptCore/runtime/Options.cpp (working copy) @@ -138,6 +138,9 @@ ; // Deconfuse editors that do auto indentation #endif + useJIT() = false; + useDFGJIT() = false; + // Do range checks where needed and make corrections to the options: ASSERT(thresholdForOptimizeAfterLongWarmUp() >= thresholdForOptimizeAfterWarmUp()); ASSERT(thresholdForOptimizeAfterWarmUp() >= thresholdForOptimizeSoon()); 2. Do a debug build. 3. Run the webkit JS tests: $ ./Tools/Scripts/run-webkit-tests --debug fast/js/ fast/regex/ ietestcenter/Javascript/ sputnik/ 696797 1 mark.lam 2012-08-15 23:57:35 -0700 rdar://problem/12108184 696798 2 mark.lam 2012-08-15 23:58:59 -0700 Correction: rdar://problem/12110946 841849 3 ossy 2013-02-26 03:39:57 -0800 cc-ing Gábor and Zoltán, maybe you are interested in this LLINT bug.