Bug 251190

Summary:	REGRESSION(259117@main?): [BigSur+ Debug JSC ] Multiple map/set JavaScript tests are constant failures with ERROR: Unexpected exit code: 139
Product:	WebKit	Reporter:	Robert Jenner <jenner>
Component:	JavaScriptCore	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED DUPLICATE
Severity:	Normal	CC:	keith_miller, webkit-bot-watchers-bugzilla, webkit-bug-importer, ysuzuki
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Description Robert Jenner 2023-01-25 18:49:46 PST

The following map related JSC tests are constant failures on BigSur debug and higher:

jsc-layout-tests.yaml/js/script-tests/basic-map.js.layout
jsc-layout-tests.yaml/js/script-tests/basic-map.js.layout-dfg-eager-no-cjit
jsc-layout-tests.yaml/js/script-tests/basic-map.js.layout-ftl-eager-no-cjit
jsc-layout-tests.yaml/js/script-tests/basic-map.js.layout-ftl-no-cjit
jsc-layout-tests.yaml/js/script-tests/basic-map.js.layout-no-cjit
jsc-layout-tests.yaml/js/script-tests/basic-map.js.layout-no-ftl
jsc-layout-tests.yaml/js/script-tests/basic-map.js.layout-no-llint
jsc-layout-tests.yaml/js/script-tests/basic-set.js.layout
jsc-layout-tests.yaml/js/script-tests/basic-set.js.layout-dfg-eager-no-cjit
jsc-layout-tests.yaml/js/script-tests/basic-set.js.layout-ftl-eager-no-cjit
jsc-layout-tests.yaml/js/script-tests/basic-set.js.layout-ftl-no-cjit
jsc-layout-tests.yaml/js/script-tests/basic-set.js.layout-no-cjit
jsc-layout-tests.yaml/js/script-tests/basic-set.js.layout-no-ftl
jsc-layout-tests.yaml/js/script-tests/basic-set.js.layout-no-llint
jsc-layout-tests.yaml/js/script-tests/map-grow-with-holes.js.layout
jsc-layout-tests.yaml/js/script-tests/map-grow-with-holes.js.layout-dfg-eager-no-cjit
jsc-layout-tests.yaml/js/script-tests/map-grow-with-holes.js.layout-ftl-eager-no-cjit
jsc-layout-tests.yaml/js/script-tests/map-grow-with-holes.js.layout-ftl-no-cjit
jsc-layout-tests.yaml/js/script-tests/map-grow-with-holes.js.layout-no-cjit
jsc-layout-tests.yaml/js/script-tests/map-grow-with-holes.js.layout-no-ftl
jsc-layout-tests.yaml/js/script-tests/map-grow-with-holes.js.layout-no-llint
jsc-layout-tests.yaml/js/script-tests/symbol-in-map.js.layout
jsc-layout-tests.yaml/js/script-tests/symbol-in-map.js.layout-dfg-eager-no-cjit
jsc-layout-tests.yaml/js/script-tests/symbol-in-map.js.layout-ftl-eager-no-cjit
jsc-layout-tests.yaml/js/script-tests/symbol-in-map.js.layout-ftl-no-cjit
jsc-layout-tests.yaml/js/script-tests/symbol-in-map.js.layout-no-cjit
jsc-layout-tests.yaml/js/script-tests/symbol-in-map.js.layout-no-ftl
jsc-layout-tests.yaml/js/script-tests/symbol-in-map.js.layout-no-llint
microbenchmarks/map-rehash.js.bytecode-cache
microbenchmarks/map-rehash.js.default
microbenchmarks/map-rehash.js.dfg-eager
microbenchmarks/map-rehash.js.dfg-eager-no-cjit-validate
microbenchmarks/map-rehash.js.eager-jettison-no-cjit
microbenchmarks/map-rehash.js.ftl-eager
microbenchmarks/map-rehash.js.ftl-eager-no-cjit-b3o1
microbenchmarks/map-rehash.js.ftl-no-cjit-b3o0
microbenchmarks/map-rehash.js.ftl-no-cjit-no-inline-validate
microbenchmarks/map-rehash.js.ftl-no-cjit-no-put-stack-validate
microbenchmarks/map-rehash.js.ftl-no-cjit-small-pool
microbenchmarks/map-rehash.js.ftl-no-cjit-validate-sampling-profiler
microbenchmarks/map-rehash.js.lockdown
microbenchmarks/map-rehash.js.mini-mode
microbenchmarks/map-rehash.js.no-cjit-validate-phases
microbenchmarks/map-rehash.js.no-ftl
microbenchmarks/map-rehash.js.no-llint
slowMicrobenchmarks.yaml/slowMicrobenchmarks/large-map-iteration-with-mutation.js.ftl-no-cjit-validate-sampling-profiler
stress/bigint-and-map-set.js.bytecode-cache
stress/bigint-and-map-set.js.default
stress/bigint-and-map-set.js.dfg-eager
stress/bigint-and-map-set.js.dfg-eager-no-cjit-validate
stress/bigint-and-map-set.js.eager-jettison-no-cjit
stress/bigint-and-map-set.js.ftl-eager
stress/bigint-and-map-set.js.ftl-eager-no-cjit-b3o1
stress/bigint-and-map-set.js.ftl-no-cjit-b3o0
stress/bigint-and-map-set.js.ftl-no-cjit-no-inline-validate
stress/bigint-and-map-set.js.ftl-no-cjit-no-put-stack-validate
stress/bigint-and-map-set.js.ftl-no-cjit-small-pool
stress/bigint-and-map-set.js.ftl-no-cjit-validate-sampling-profiler
stress/bigint-and-map-set.js.lockdown
stress/bigint-and-map-set.js.mini-mode
stress/bigint-and-map-set.js.no-cjit-validate-phases
stress/bigint-and-map-set.js.no-ftl
stress/bigint-and-map-set.js.no-llint
stress/elidable-new-object-roflcopter-then-exit.js.lockdown
stress/map-cse-correctness.js.bytecode-cache
stress/map-cse-correctness.js.default
stress/map-cse-correctness.js.dfg-eager
stress/map-cse-correctness.js.dfg-eager-no-cjit-validate
stress/map-cse-correctness.js.eager-jettison-no-cjit
stress/map-cse-correctness.js.ftl-eager
stress/map-cse-correctness.js.ftl-eager-no-cjit-b3o1
stress/map-cse-correctness.js.ftl-no-cjit-b3o0
stress/map-cse-correctness.js.ftl-no-cjit-no-inline-validate
stress/map-cse-correctness.js.ftl-no-cjit-no-put-stack-validate
stress/map-cse-correctness.js.ftl-no-cjit-small-pool
stress/map-cse-correctness.js.ftl-no-cjit-validate-sampling-profiler
stress/map-cse-correctness.js.lockdown
stress/map-cse-correctness.js.mini-mode
stress/map-cse-correctness.js.no-cjit-validate-phases
stress/map-cse-correctness.js.no-ftl
stress/map-cse-correctness.js.no-llint
stress/map-delete.js.lockdown
stress/map-iteration.js.bytecode-cache
stress/map-iteration.js.default
stress/map-iteration.js.dfg-eager
stress/map-iteration.js.dfg-eager-no-cjit-validate
stress/map-iteration.js.eager-jettison-no-cjit
stress/map-iteration.js.ftl-eager
stress/map-iteration.js.ftl-eager-no-cjit-b3o1
stress/map-iteration.js.ftl-no-cjit-b3o0
stress/map-iteration.js.ftl-no-cjit-no-inline-validate
stress/map-iteration.js.ftl-no-cjit-no-put-stack-validate
stress/map-iteration.js.ftl-no-cjit-small-pool
stress/map-iteration.js.ftl-no-cjit-validate-sampling-profiler
stress/map-iteration.js.lockdown
stress/map-iteration.js.mini-mode
stress/map-iteration.js.no-cjit-validate-phases
stress/map-iteration.js.no-ftl
stress/map-iteration.js.no-llint
stress/map-rehash-2.js.bytecode-cache
stress/map-rehash-2.js.default
stress/map-rehash-2.js.dfg-eager
stress/map-rehash-2.js.eager-jettison-no-cjit
stress/map-rehash-2.js.ftl-eager
stress/map-rehash-2.js.ftl-no-cjit-b3o0
stress/map-rehash-2.js.ftl-no-cjit-no-inline-validate
stress/map-rehash-2.js.ftl-no-cjit-no-put-stack-validate
stress/map-rehash-2.js.ftl-no-cjit-small-pool
stress/map-rehash-2.js.ftl-no-cjit-validate-sampling-profiler
stress/map-rehash-2.js.lockdown
stress/map-rehash-2.js.mini-mode
stress/map-rehash-2.js.no-cjit-validate-phases
stress/map-rehash-2.js.no-ftl
stress/map-rehash-2.js.no-llint
stress/map-rehash.js.bytecode-cache
stress/map-rehash.js.default
stress/map-rehash.js.dfg-eager
stress/map-rehash.js.ftl-eager
stress/map-rehash.js.ftl-eager-no-cjit-b3o1
stress/map-rehash.js.ftl-no-cjit-validate-sampling-profiler
stress/map-rehash.js.lockdown
stress/map-rehash.js.mini-mode
stress/map-rehash.js.no-ftl
stress/map-rehash.js.no-llint
stress/modify-map-during-iteration.js.bytecode-cache
stress/modify-map-during-iteration.js.default
stress/modify-map-during-iteration.js.dfg-eager
stress/modify-map-during-iteration.js.dfg-eager-no-cjit-validate
stress/modify-map-during-iteration.js.eager-jettison-no-cjit
stress/modify-map-during-iteration.js.ftl-eager
stress/modify-map-during-iteration.js.ftl-eager-no-cjit-b3o1
stress/modify-map-during-iteration.js.ftl-no-cjit-b3o0
stress/modify-map-during-iteration.js.ftl-no-cjit-no-inline-validate
stress/modify-map-during-iteration.js.ftl-no-cjit-no-put-stack-validate
stress/modify-map-during-iteration.js.ftl-no-cjit-small-pool
stress/modify-map-during-iteration.js.ftl-no-cjit-validate-sampling-profiler
stress/modify-map-during-iteration.js.lockdown
stress/modify-map-during-iteration.js.mini-mode
stress/modify-map-during-iteration.js.no-cjit-validate-phases
stress/modify-map-during-iteration.js.no-ftl
stress/modify-map-during-iteration.js.no-llint
stress/modify-set-during-iteration.js.bytecode-cache
stress/modify-set-during-iteration.js.default
stress/modify-set-during-iteration.js.dfg-eager
stress/modify-set-during-iteration.js.dfg-eager-no-cjit-validate
stress/modify-set-during-iteration.js.eager-jettison-no-cjit
stress/modify-set-during-iteration.js.ftl-eager
stress/modify-set-during-iteration.js.ftl-eager-no-cjit-b3o1
stress/modify-set-during-iteration.js.ftl-no-cjit-b3o0
stress/modify-set-during-iteration.js.ftl-no-cjit-no-inline-validate
stress/modify-set-during-iteration.js.ftl-no-cjit-no-put-stack-validate
stress/modify-set-during-iteration.js.ftl-no-cjit-small-pool
stress/modify-set-during-iteration.js.ftl-no-cjit-validate-sampling-profiler
stress/modify-set-during-iteration.js.lockdown
stress/modify-set-during-iteration.js.mini-mode
stress/modify-set-during-iteration.js.no-cjit-validate-phases
stress/modify-set-during-iteration.js.no-ftl
stress/modify-set-during-iteration.js.no-llint

History is easiest to observe by looking at the test runs here:
https://build.webkit.org/#/builders/378

Comment 1 Radar WebKit Bug Importer 2023-01-25 18:50:10 PST

<rdar://problem/104677541>

Comment 2 Robert Jenner 2023-01-25 18:51:37 PST

Other tests that started to fail at the same point, but don't appear to reference maps or set in their name are as follows:

airjs-tests.yaml/stress-test.js.bytecode-cache
airjs-tests.yaml/stress-test.js.default
airjs-tests.yaml/stress-test.js.dfg-eager
airjs-tests.yaml/stress-test.js.dfg-eager-no-cjit-validate
airjs-tests.yaml/stress-test.js.eager-jettison-no-cjit
airjs-tests.yaml/stress-test.js.ftl-eager
airjs-tests.yaml/stress-test.js.ftl-eager-no-cjit-b3o1
airjs-tests.yaml/stress-test.js.ftl-no-cjit-b3o0
airjs-tests.yaml/stress-test.js.ftl-no-cjit-no-inline-validate
airjs-tests.yaml/stress-test.js.ftl-no-cjit-no-put-stack-validate
airjs-tests.yaml/stress-test.js.ftl-no-cjit-small-pool
airjs-tests.yaml/stress-test.js.ftl-no-cjit-validate-sampling-profiler
airjs-tests.yaml/stress-test.js.mini-mode
airjs-tests.yaml/stress-test.js.no-cjit-validate-phases
airjs-tests.yaml/stress-test.js.no-ftl
airjs-tests.yaml/stress-test.js.no-llint
wasm.yaml/wasm/v8/many-memories-no-trap-handler.js.wasm-eager-jettison

Comment 3 Robert Jenner 2023-01-25 18:53:56 PST

While there is a fairly large range in-between test runs, with the most recent pass occurring at 259088@main, and the first failure occurring at the next test run after that which was 259117@main. It does appear that 259117@main does modify map and set:

https://commits.webkit.org/259117@main

I would think that would be a likely culprit?

Comment 4 Ryan Haddad 2023-01-26 08:59:51 PST

For some reason a new bug was filed to land the fix.

*** This bug has been marked as a duplicate of bug 251191 ***