Bug 126219 - js/dom/dfg-custom-getter-throw.html and js/dom/dfg-custom-getter-throw-inlined.html hit assertions after r161051
Summary: js/dom/dfg-custom-getter-throw.html and js/dom/dfg-custom-getter-throw-inline...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar, Regression
Depends on:
Blocks: 45994
  Show dependency tree / graph
 
Reported: 2013-12-24 12:34 PST by Ryosuke Niwa
Modified: 2014-03-06 18:25 PST (History)
6 users (show)

See Also:

Attachments
The version of js/dom/dfg-custom-getter-throw.html that reproduces the assertion failure (834 bytes, text/html)
2013-12-24 12:53 PST, Ryosuke Niwa 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ryosuke Niwa 2013-12-24 12:34:24 PST 
js/dom/dfg-custom-getter-throw.html
and
js/dom/dfg-custom-getter-throw-inlined.html
have started hitting assertions after http://trac.webkit.org/changeset/161051

ASSERTION FAILED: exec == topCallFrame || exec == exec->lexicalGlobalObject()->globalExec() || exec == exec->vmEntryGlobalObject()->globalExec()
/Volumes/Data/slave/mavericks-debug/build/Source/JavaScriptCore/runtime/VM.cpp(634) : JSC::JSValue JSC::VM::throwException(JSC::ExecState *, JSC::JSValue)
1   0x10da505b0 WTFCrash
2   0x10d9f14af JSC::VM::throwException(JSC::ExecState*, JSC::JSValue)
3   0x10f6cb39f WebCore::setDOMException(JSC::ExecState*, int)
4   0x10fbe6119 WebCore::JSXMLHttpRequest::responseText(JSC::ExecState*) const
5   0x10fbe0d3f WebCore::jsXMLHttpRequestResponseText(JSC::ExecState*, long long, long long, JSC::PropertyName)
6   0x3ed880e68ffa

http://build.webkit.org/results/Apple%20Mavericks%20Debug%20WK2%20(Tests)/r161053%20(1201)/results.html
Comment 1 Ryosuke Niwa 2013-12-24 12:36:05 PST 
Looks like this is a fairly recent regression in JSC.

I certainly did not encounter it at r158715, and reverting the WebCore code change in r161051 confirms that the assertion failure exists without the patch.
Comment 2 Ryosuke Niwa 2013-12-24 12:53:20 PST 
Created attachment 219979 [details]
The version of js/dom/dfg-custom-getter-throw.html that reproduces the assertion failure
Comment 3 Radar WebKit Bug Importer 2013-12-24 12:54:32 PST 
<rdar://problem/15723849>
Comment 4 Ryosuke Niwa 2013-12-24 12:57:00 PST 
Committed r161059: <http://trac.webkit.org/changeset/161059>
Comment 5 Ryosuke Niwa 2013-12-24 12:58:48 PST 
Sorry, didn't mean to close this bug.
Comment 6 Mark Lam 2014-03-06 16:07:16 PST 
Testing with a recent build (r165197), I don't see this issue manifest anymore.  There also have been numerous changes and bug fixes in the area of exception handling and stack management since the time this bug was filed.  Those changes appear to have resolved the issue. 

There doesn't seem to be anything left to do for this bug.  Will close.
Comment 7 Alexey Proskuryakov 2014-03-06 17:47:05 PST 
Mark, did you unskip the skipped tests?
Comment 8 Mark Lam 2014-03-06 18:25:36 PST 
(In reply to comment #7)
> Mark, did you unskip the skipped tests?

They were already unskipped.  See https://bugs.webkit.org/show_bug.cgi?id=126219#c4.