Bug 211313

Summary: REGRESSION: stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js fails on ARM (thumb2 only?)
Product: WebKit Reporter: Pablo Saavedra <psaavedra>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: NEW ---    
Severity: Normal CC: ap, ashvayka, fpizlo, keith_miller, saam
Priority: P2    
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=211304
https://bugs.webkit.org/show_bug.cgi?id=211205
https://bugs.webkit.org/show_bug.cgi?id=211020

Description Pablo Saavedra 2020-05-01 12:46:37 PDT 
* Related to: https://bugs.webkit.org/show_bug.cgi?id=211304
* Regression appears after https://bugs.webkit.org/show_bug.cgi?id=211205
Comment 1 Alexey Shvayka 2020-05-01 13:03:29 PDT 
I wonder if it is https://bugs.webkit.org/show_bug.cgi?id=211020 to blame for regression? The change for ArrayBuffer is barely observable though and the test was flaky before r260992.
Comment 2 Pablo Saavedra 2020-05-02 05:10:06 PDT 
(In reply to Alexey Shvayka from comment #1)
> I wonder if it is https://bugs.webkit.org/show_bug.cgi?id=211020 to blame
> for regression? The change for ArrayBuffer is barely observable though and
> the test was flaky before r260992.

Yes, https://bugs.webkit.org/show_bug.cgi?id=211020 looks like a more porbable candidate.
Comment 3 Pablo Saavedra 2020-05-02 05:10:21 PDT 
*probable
Comment 4 Alexey Shvayka 2020-05-02 07:06:52 PDT 
Can I somehow obtain a crash log from EWS or reproduce the failure locally?
Comment 5 Alexey Proskuryakov 2020-05-06 14:04:25 PDT 
The test was skipped in https://trac.webkit.org/r261010. It was skipped for all ARM, which seems wrong, as we never had evidence of this affecting iOS.

Index: /trunk/JSTests/stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js
===================================================================
--- /trunk/JSTests/stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js	(revision 261009)
+++ /trunk/JSTests/stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js	(revision 261010)
@@ -1,2 +1,3 @@
+//@ skip if ["arm"].include?($architecture)
 //@ requireOptions("-e", "let iterations=40000") if ["mips"].include?($architecture)
 //@ runDefault("--jitPolicyScale=0")
Comment 6 Pablo Saavedra 2020-05-08 03:58:43 PDT 
(In reply to Alexey Proskuryakov from comment #5)
> The test was skipped in https://trac.webkit.org/r261010. It was skipped for
> all ARM, which seems wrong, as we never had evidence of this affecting iOS.
> 
> Index:
> /trunk/JSTests/stress/array-buffer-view-watchpoint-can-be-fired-in-really-
> add-in-dfg.js
> ===================================================================
> ---
> /trunk/JSTests/stress/array-buffer-view-watchpoint-can-be-fired-in-really-
> add-in-dfg.js	(revision 261009)
> +++
> /trunk/JSTests/stress/array-buffer-view-watchpoint-can-be-fired-in-really-
> add-in-dfg.js	(revision 261010)
> @@ -1,2 +1,3 @@
> +//@ skip if ["arm"].include?($architecture)
>  //@ requireOptions("-e", "let iterations=40000") if
> ["mips"].include?($architecture)
>  //@ runDefault("--jitPolicyScale=0")

I think I rushed myself when I skipped the test with not enough information to fill the issue. I just re-added the test again. Let's see the results for the next builds.