Looking. Can you get debug symbols for the crashes you're seeing?

Sure. Here you are: $ WebKitBuild/Debug/bin/DumpRenderTree GNU gdb (Ubuntu/Linaro 7.4-2012.02-0ubuntu2) 7.4-2012.02 Copyright (C) 2012 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "i686-linux-gnu". For bug reporting instructions, please see: <http://bugs.launchpad.net/gdb-linaro/>... Reading symbols from /home/oszi/WebKit/WebKitBuild/Debug/bin/DumpRenderTree...done. (gdb) run LayoutTests/fast/js/dfg-add-not-number.html Starting program: /home/oszi/WebKit/WebKitBuild/Debug/bin/DumpRenderTree LayoutTests/fast/js/dfg-add-not-number.html [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1". [New Thread 0xf01ffb40 (LWP 17229)] [New Thread 0xef7ffb40 (LWP 17238)] [Thread 0xef7ffb40 (LWP 17238) exited] [New Thread 0xef7ffb40 (LWP 17248)] [New Thread 0xee983b40 (LWP 17249)] SHOULD NEVER BE REACHED /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp(917) : JSC::DFG::GPRReg JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal(JSC::DFG::Node*, JSC::DataFormat&, JSC::DFG::SpeculationDirection) [with bool strict = false, JSC::DFG::GPRReg = JSC::X86Registers::RegisterID] Program received signal SIGSEGV, Segmentation fault. 0xf34b6b19 in ?? () from /lib/i386-linux-gnu/libgcc_s.so.1 (gdb) bt #0 0xf34b6b19 in ?? () from /lib/i386-linux-gnu/libgcc_s.so.1 #1 0xf34b76e1 in _Unwind_Backtrace () from /lib/i386-linux-gnu/libgcc_s.so.1 #2 0xf33fc007 in backtrace () from /lib/i386-linux-gnu/libc.so.6 #3 0xf62eee21 in WTFGetBacktrace (stack=0xffff69e8, size=0xffff6a6c) at /home/oszi/WebKit/Source/WTF/wtf/Assertions.cpp:249 #4 0xf62eee5d in WTFReportBacktrace () at /home/oszi/WebKit/Source/WTF/wtf/Assertions.cpp:278 #5 0xf6127fbe in JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal<false> (this=0xffff94e4, node=0xedf100e4, returnFormat=@0xffff6bf0: JSC::DataFormatNone, direction=JSC::DFG::BackwardSpeculation) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:917 #6 0xf6106b6c in JSC::DFG::SpeculativeJIT::fillSpeculateInt (this=0xffff94e4, node=0xedf100e4, returnFormat=@0xffff6bf0: JSC::DataFormatNone, direction=JSC::DFG::BackwardSpeculation) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:927 #7 0xf60f738d in JSC::DFG::SpeculateIntegerOperand::gpr (this=0xffff6be4) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:2680 #8 0xf60f7225 in JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand (this=0xffff6be4, jit=0xffff94e4, use=..., direction=JSC::DFG::BackwardSpeculation) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:2656 #9 0xf60e9ce1 in JSC::DFG::SpeculativeJIT::compileAdd (this=0xffff94e4, node=0xedf1017c) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2981 #10 0xf610e29f in JSC::DFG::SpeculativeJIT::compile (this=0xffff94e4, node=0xedf1017c) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:2178 #11 0xf60e34ff in JSC::DFG::SpeculativeJIT::compile (this=0xffff94e4, block=...) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:1725 #12 0xf60e3bda in JSC::DFG::SpeculativeJIT::compile (this=0xffff94e4) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:1838 #13 0xf60aec4b in JSC::DFG::JITCompiler::compileBody (this=0xffffa72c, speculative=...) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp:108 #14 0xf60afe1a in JSC::DFG::JITCompiler::compileFunction (this=0xffffa72c, entry=..., entryWithArityCheck=...) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp:302 #15 0xf60a216e in JSC::DFG::compile (compileMode=JSC::DFG::CompileFunction, exec=0xeea001f0, codeBlock=0x8194f60, jitCode=..., jitCodeWithArityCheck=0xedfded44, osrEntryBytecodeIndex=0) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGDriver.cpp:173 #16 0xf60a1989 in JSC::DFG::tryCompileFunction (exec=0xeea001f0, codeBlock=0x8194f60, jitCode=..., jitCodeWithArityCheck=..., bytecodeIndex=0) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGDriver.cpp:191 #17 0xf6232a6c in JSC::jitCompileFunctionIfAppropriate (exec=0xeea001f0, codeBlock=..., jitCode=..., jitCodeWithArityCheck=..., jitType=JSC::JITCode::DFGJIT, bytecodeIndex=0, effort=JSC::JITCompilationCanFail) at /home/oszi/WebKit/Source/JavaScriptCore/jit/JITDriver.h:95 #18 0xf6232d28 in JSC::prepareFunctionForExecution (exec=0xeea001f0, codeBlock=..., jitCode=..., jitCodeWithArityCheck=..., jitType=JSC::JITCode::DFGJIT, bytecodeIndex=0, kind=JSC::CodeForCall) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/ExecutionHarness.h:68 #19 0xf6231098 in JSC::FunctionExecutable::compileForCallInternal (this=0xedfded18, exec=0xeea001f0, scope=0xeef7f838, jitType=JSC::JITCode::DFGJIT, bytecodeIndex=0) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/Executable.cpp:538 #20 0xf62308a9 in JSC::FunctionExecutable::compileOptimizedForCall (this=0xedfded18, exec=0xeea001f0, scope=0xeef7f838, bytecodeIndex=0) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/Executable.cpp:463 #21 0xf5fa4708 in JSC::FunctionExecutable::compileOptimizedFor (this=0xedfded18, exec=0xeea001f0, scope=0xeef7f838, bytecodeIndex=0, kind=JSC::CodeForCall) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/Executable.h:678 #22 0xf5f9f3ed in JSC::FunctionCodeBlock::compileOptimized (this=0x818d4d8, exec=0xeea001f0, scope=0xeef7f838, bytecodeIndex=0) at /home/oszi/WebKit/Source/JavaScriptCore/bytecode/CodeBlock.cpp:2846 #23 0xf6185c02 in JSC::cti_optimize (args=0xffffacf0) at /home/oszi/WebKit/Source/JavaScriptCore/jit/JITStubs.cpp:1892 #24 0xf6182a6a in JSC::tryCacheGetByID (callFrame=0x0, codeBlock=0xfffffffb, returnAddress=..., baseValue=..., propertyName=..., slot=..., stubInfo=0x80b7c44) at /home/oszi/WebKit/Source/JavaScriptCore/jit/JITStubs.cpp:989 #25 0x5a800000 in ?? () #26 0x00000000 in ?? () (gdb)

Created attachment 189007 [details] possible patch Can y'all see if this fixes the bugs, on your end? I'm running tests on my end now as well.

(In reply to comment #2) > Sure. Here you are: > > $ WebKitBuild/Debug/bin/DumpRenderTree > GNU gdb (Ubuntu/Linaro 7.4-2012.02-0ubuntu2) 7.4-2012.02 > Copyright (C) 2012 Free Software Foundation, Inc. > License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> > This is free software: you are free to change and redistribute it. > There is NO WARRANTY, to the extent permitted by law. Type "show copying" > and "show warranty" for details. > This GDB was configured as "i686-linux-gnu". > For bug reporting instructions, please see: > <http://bugs.launchpad.net/gdb-linaro/>... > Reading symbols from /home/oszi/WebKit/WebKitBuild/Debug/bin/DumpRenderTree...done. > (gdb) run LayoutTests/fast/js/dfg-add-not-number.html > Starting program: /home/oszi/WebKit/WebKitBuild/Debug/bin/DumpRenderTree LayoutTests/fast/js/dfg-add-not-number.html > [Thread debugging using libthread_db enabled] > Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1". > [New Thread 0xf01ffb40 (LWP 17229)] > [New Thread 0xef7ffb40 (LWP 17238)] > [Thread 0xef7ffb40 (LWP 17238) exited] > [New Thread 0xef7ffb40 (LWP 17248)] > [New Thread 0xee983b40 (LWP 17249)] > SHOULD NEVER BE REACHED > /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp(917) : JSC::DFG::GPRReg JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal(JSC::DFG::Node*, JSC::DataFormat&, JSC::DFG::SpeculationDirection) [with bool strict = false, JSC::DFG::GPRReg = JSC::X86Registers::RegisterID] > > Program received signal SIGSEGV, Segmentation fault. > 0xf34b6b19 in ?? () from /lib/i386-linux-gnu/libgcc_s.so.1 > (gdb) bt > #0 0xf34b6b19 in ?? () from /lib/i386-linux-gnu/libgcc_s.so.1 > #1 0xf34b76e1 in _Unwind_Backtrace () from /lib/i386-linux-gnu/libgcc_s.so.1 > #2 0xf33fc007 in backtrace () from /lib/i386-linux-gnu/libc.so.6 > #3 0xf62eee21 in WTFGetBacktrace (stack=0xffff69e8, size=0xffff6a6c) at /home/oszi/WebKit/Source/WTF/wtf/Assertions.cpp:249 > #4 0xf62eee5d in WTFReportBacktrace () at /home/oszi/WebKit/Source/WTF/wtf/Assertions.cpp:278 > #5 0xf6127fbe in JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal<false> (this=0xffff94e4, node=0xedf100e4, > returnFormat=@0xffff6bf0: JSC::DataFormatNone, direction=JSC::DFG::BackwardSpeculation) > at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:917 > #6 0xf6106b6c in JSC::DFG::SpeculativeJIT::fillSpeculateInt (this=0xffff94e4, node=0xedf100e4, returnFormat=@0xffff6bf0: JSC::DataFormatNone, > direction=JSC::DFG::BackwardSpeculation) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:927 > #7 0xf60f738d in JSC::DFG::SpeculateIntegerOperand::gpr (this=0xffff6be4) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:2680 > #8 0xf60f7225 in JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand (this=0xffff6be4, jit=0xffff94e4, use=..., > direction=JSC::DFG::BackwardSpeculation) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:2656 > #9 0xf60e9ce1 in JSC::DFG::SpeculativeJIT::compileAdd (this=0xffff94e4, node=0xedf1017c) > at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2981 > #10 0xf610e29f in JSC::DFG::SpeculativeJIT::compile (this=0xffff94e4, node=0xedf1017c) > at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:2178 > #11 0xf60e34ff in JSC::DFG::SpeculativeJIT::compile (this=0xffff94e4, block=...) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:1725 > #12 0xf60e3bda in JSC::DFG::SpeculativeJIT::compile (this=0xffff94e4) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:1838 > #13 0xf60aec4b in JSC::DFG::JITCompiler::compileBody (this=0xffffa72c, speculative=...) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp:108 > #14 0xf60afe1a in JSC::DFG::JITCompiler::compileFunction (this=0xffffa72c, entry=..., entryWithArityCheck=...) > at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp:302 > #15 0xf60a216e in JSC::DFG::compile (compileMode=JSC::DFG::CompileFunction, exec=0xeea001f0, codeBlock=0x8194f60, jitCode=..., > jitCodeWithArityCheck=0xedfded44, osrEntryBytecodeIndex=0) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGDriver.cpp:173 > #16 0xf60a1989 in JSC::DFG::tryCompileFunction (exec=0xeea001f0, codeBlock=0x8194f60, jitCode=..., jitCodeWithArityCheck=..., bytecodeIndex=0) > at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGDriver.cpp:191 > #17 0xf6232a6c in JSC::jitCompileFunctionIfAppropriate (exec=0xeea001f0, codeBlock=..., jitCode=..., jitCodeWithArityCheck=..., > jitType=JSC::JITCode::DFGJIT, bytecodeIndex=0, effort=JSC::JITCompilationCanFail) at /home/oszi/WebKit/Source/JavaScriptCore/jit/JITDriver.h:95 > #18 0xf6232d28 in JSC::prepareFunctionForExecution (exec=0xeea001f0, codeBlock=..., jitCode=..., jitCodeWithArityCheck=..., jitType=JSC::JITCode::DFGJIT, > bytecodeIndex=0, kind=JSC::CodeForCall) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/ExecutionHarness.h:68 > #19 0xf6231098 in JSC::FunctionExecutable::compileForCallInternal (this=0xedfded18, exec=0xeea001f0, scope=0xeef7f838, jitType=JSC::JITCode::DFGJIT, > bytecodeIndex=0) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/Executable.cpp:538 > #20 0xf62308a9 in JSC::FunctionExecutable::compileOptimizedForCall (this=0xedfded18, exec=0xeea001f0, scope=0xeef7f838, bytecodeIndex=0) > at /home/oszi/WebKit/Source/JavaScriptCore/runtime/Executable.cpp:463 > #21 0xf5fa4708 in JSC::FunctionExecutable::compileOptimizedFor (this=0xedfded18, exec=0xeea001f0, scope=0xeef7f838, bytecodeIndex=0, kind=JSC::CodeForCall) > at /home/oszi/WebKit/Source/JavaScriptCore/runtime/Executable.h:678 > #22 0xf5f9f3ed in JSC::FunctionCodeBlock::compileOptimized (this=0x818d4d8, exec=0xeea001f0, scope=0xeef7f838, bytecodeIndex=0) > at /home/oszi/WebKit/Source/JavaScriptCore/bytecode/CodeBlock.cpp:2846 > #23 0xf6185c02 in JSC::cti_optimize (args=0xffffacf0) at /home/oszi/WebKit/Source/JavaScriptCore/jit/JITStubs.cpp:1892 > #24 0xf6182a6a in JSC::tryCacheGetByID (callFrame=0x0, codeBlock=0xfffffffb, returnAddress=..., baseValue=..., propertyName=..., slot=..., > stubInfo=0x80b7c44) at /home/oszi/WebKit/Source/JavaScriptCore/jit/JITStubs.cpp:989 > #25 0x5a800000 in ?? () > #26 0x00000000 in ?? () > (gdb) Yep - that's what I'm seeing, too.

Created attachment 189008 [details] better patch fixed another case

Created attachment 189011 [details] better patch Picking off bugs as I find them...

(In reply to comment #6) > Created an attachment (id=189011) [details] > better patch > > Picking off bugs as I find them... fast/js tests pass for me on 32 bit with this patch.

cc JSC reviewers

Comment on attachment 189011 [details] better patch r=me

Comment on attachment 189011 [details] better patch Clearing flags on attachment: 189011 Committed r143314: <http://trac.webkit.org/changeset/143314>

All reviewed patches have been landed. Closing bug.