[tomeu@cizrna (master) build]$ ./Programs/GtkLauncher --enable-webgl=1 --enable-accelerated-compositing=1 http://uglyhack.appspot.com/boingy/ ** Message: console message: http://uglyhack.appspot.com/boingy/ @99: THREE.WebGLRenderer ASSERTION FAILED: at(m_compileIndex).canExit() || m_isCheckingArgumentTypes ../Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h(2128) : void JSC::DFG::SpeculativeJIT::speculationCheck(JSC::DFG::ExitKind, JSC::DFG::JSValueSource, JSC::DFG::NodeIndex, JSC::AbstractMacroAssembler<JSC::X86Assembler>::Jump) Program received signal SIGSEGV, Segmentation fault. 0x00007ffff23e71f1 in JSC::DFG::SpeculativeJIT::speculationCheck (this=0x7fffffff96b0, kind=JSC::DFG::BadType, jsValueSource=..., nodeIndex=169, jumpToFail=...) at ../Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:2129 2129 ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes); (gdb) bt #0 0x00007ffff23e71f1 in JSC::DFG::SpeculativeJIT::speculationCheck (this=0x7fffffff96b0, kind=JSC::DFG::BadType, jsValueSource=..., nodeIndex=169, jumpToFail=...) at ../Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:2129 #1 0x00007ffff23ccef0 in JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality (this=0x7fffffff96b0, leftChild=..., rightChild=..., branchNodeIndex=172, classInfo= 0x7ffff29d91e0, speculatedTypeChecker= 0x7ffff230405a <JSC::isFinalObjectSpeculation(unsigned int)>) at ../Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:1665 #2 0x00007ffff23fd21a in JSC::DFG::SpeculativeJIT::compilePeepHoleBranch (this= 0x7fffffff96b0, node=..., condition=JSC::MacroAssemblerX86Common::Equal, doubleCondition=JSC::MacroAssemblerX86Common::DoubleEqual, operation= 0x7ffff23a96ea <JSC::DFG::operationCompareEq(JSC::ExecState*, JSC::EncodedJSValue, JSC::EncodedJSValue)>) at ../Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:891 #3 0x00007ffff2406e90 in JSC::DFG::SpeculativeJIT::compare (this=0x7fffffff96b0, node=..., condition=JSC::MacroAssemblerX86Common::Equal, doubleCondition=JSC::MacroAssemblerX86Common::DoubleEqual, operation= 0x7ffff23a96ea <JSC::DFG::operationCompareEq(JSC::ExecState*, JSC::EncodedJSValue, JSC::EncodedJSValue)>) at ../Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2656 #4 0x00007ffff23d1117 in JSC::DFG::SpeculativeJIT::compile (this=0x7fffffff96b0, node=...) at ../Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:2358 #5 0x00007ffff23fe1da in JSC::DFG::SpeculativeJIT::compile (this=0x7fffffff96b0, block=...) at ../Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:1106 #6 0x00007ffff23ff7ef in JSC::DFG::SpeculativeJIT::compile (this=0x7fffffff96b0) at ../Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:1328 #7 0x00007ffff239f82c in JSC::DFG::JITCompiler::compileBody (this=0x7fffffffa670, speculative=...) at ../Source/JavaScriptCore/dfg/DFGJITCompiler.cpp:91 #8 0x00007ffff23a07ad in JSC::DFG::JITCompiler::compileFunction (this=0x7fffffffa670, entry=..., entryWithArityCheck=...) at ../Source/JavaScriptCore/dfg/DFGJITCompiler.cpp:268 #9 0x00007ffff239628a in JSC::DFG::compile (compileMode=JSC::DFG::CompileFunction, exec= 0x7fff7fc00370, codeBlock=0x23ab6d0, jitCode=..., jitCodeWithArityCheck=0x7fffa02fc878) at ../Source/JavaScriptCore/dfg/DFGDriver.cpp:123 #10 0x00007ffff2395a6d in JSC::DFG::tryCompileFunction (exec=0x7fff7fc00370, codeBlock= 0x23ab6d0, jitCode=..., jitCodeWithArityCheck=...) at ../Source/JavaScriptCore/dfg/DFGDriver.cpp:141 #11 0x00007ffff252648f in JSC::jitCompileFunctionIfAppropriate (exec=0x7fff7fc00370, codeBlock=..., jitCode=..., jitCodeWithArityCheck=..., symbolTable= @0x7fffa02fc8e8: 0x2340e90, jitType=JSC::JITCode::DFGJIT, effort=JSC::JITCompilationCanFail) at ../Source/JavaScriptCore/jit/JITDriver.h:95 #12 0x00007ffff2526744 in JSC::prepareFunctionForExecution (exec=0x7fff7fc00370, codeBlock=..., jitCode=..., jitCodeWithArityCheck=..., symbolTable= @0x7fffa02fc8e8: 0x2340e90, jitType=JSC::JITCode::DFGJIT, kind=JSC::CodeForCall) at ../Source/JavaScriptCore/runtime/ExecutionHarness.h:64 #13 0x00007ffff252458e in JSC::FunctionExecutable::compileForCallInternal (this= 0x7fffa02fc820, exec=0x7fff7fc00370, scopeChainNode=0x7fffa8102ec0, jitType=JSC::JITCode::DFGJIT) at ../Source/JavaScriptCore/runtime/Executable.cpp:529 #14 0x00007ffff25239df in JSC::FunctionExecutable::compileOptimizedForCall (this= 0x7fffa02fc820, exec=0x7fff7fc00370, scopeChainNode=0x7fffa8102ec0) ---Type <return> to continue, or q <return> to quit---q at ../Source/JavaScripQuit (gdb) set height 0 (gdb) bt #0 0x00007ffff23e71f1 in JSC::DFG::SpeculativeJIT::speculationCheck (this=0x7fffffff96b0, kind=JSC::DFG::BadType, jsValueSource=..., nodeIndex=169, jumpToFail=...) at ../Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:2129 #1 0x00007ffff23ccef0 in JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality (this=0x7fffffff96b0, leftChild=..., rightChild=..., branchNodeIndex=172, classInfo= 0x7ffff29d91e0, speculatedTypeChecker= 0x7ffff230405a <JSC::isFinalObjectSpeculation(unsigned int)>) at ../Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:1665 #2 0x00007ffff23fd21a in JSC::DFG::SpeculativeJIT::compilePeepHoleBranch (this= 0x7fffffff96b0, node=..., condition=JSC::MacroAssemblerX86Common::Equal, doubleCondition=JSC::MacroAssemblerX86Common::DoubleEqual, operation= 0x7ffff23a96ea <JSC::DFG::operationCompareEq(JSC::ExecState*, JSC::EncodedJSValue, JSC::EncodedJSValue)>) at ../Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:891 #3 0x00007ffff2406e90 in JSC::DFG::SpeculativeJIT::compare (this=0x7fffffff96b0, node=..., condition=JSC::MacroAssemblerX86Common::Equal, doubleCondition=JSC::MacroAssemblerX86Common::DoubleEqual, operation= 0x7ffff23a96ea <JSC::DFG::operationCompareEq(JSC::ExecState*, JSC::EncodedJSValue, JSC::EncodedJSValue)>) at ../Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2656 #4 0x00007ffff23d1117 in JSC::DFG::SpeculativeJIT::compile (this=0x7fffffff96b0, node=...) at ../Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:2358 #5 0x00007ffff23fe1da in JSC::DFG::SpeculativeJIT::compile (this=0x7fffffff96b0, block=...) at ../Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:1106 #6 0x00007ffff23ff7ef in JSC::DFG::SpeculativeJIT::compile (this=0x7fffffff96b0) at ../Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:1328 #7 0x00007ffff239f82c in JSC::DFG::JITCompiler::compileBody (this=0x7fffffffa670, speculative=...) at ../Source/JavaScriptCore/dfg/DFGJITCompiler.cpp:91 #8 0x00007ffff23a07ad in JSC::DFG::JITCompiler::compileFunction (this=0x7fffffffa670, entry=..., entryWithArityCheck=...) at ../Source/JavaScriptCore/dfg/DFGJITCompiler.cpp:268 #9 0x00007ffff239628a in JSC::DFG::compile (compileMode=JSC::DFG::CompileFunction, exec= 0x7fff7fc00370, codeBlock=0x23ab6d0, jitCode=..., jitCodeWithArityCheck=0x7fffa02fc878) at ../Source/JavaScriptCore/dfg/DFGDriver.cpp:123 #10 0x00007ffff2395a6d in JSC::DFG::tryCompileFunction (exec=0x7fff7fc00370, codeBlock= 0x23ab6d0, jitCode=..., jitCodeWithArityCheck=...) at ../Source/JavaScriptCore/dfg/DFGDriver.cpp:141 #11 0x00007ffff252648f in JSC::jitCompileFunctionIfAppropriate (exec=0x7fff7fc00370, codeBlock=..., jitCode=..., jitCodeWithArityCheck=..., symbolTable= @0x7fffa02fc8e8: 0x2340e90, jitType=JSC::JITCode::DFGJIT, effort=JSC::JITCompilationCanFail) at ../Source/JavaScriptCore/jit/JITDriver.h:95 #12 0x00007ffff2526744 in JSC::prepareFunctionForExecution (exec=0x7fff7fc00370, codeBlock=..., jitCode=..., jitCodeWithArityCheck=..., symbolTable= @0x7fffa02fc8e8: 0x2340e90, jitType=JSC::JITCode::DFGJIT, kind=JSC::CodeForCall) at ../Source/JavaScriptCore/runtime/ExecutionHarness.h:64 #13 0x00007ffff252458e in JSC::FunctionExecutable::compileForCallInternal (this= 0x7fffa02fc820, exec=0x7fff7fc00370, scopeChainNode=0x7fffa8102ec0, jitType=JSC::JITCode::DFGJIT) at ../Source/JavaScriptCore/runtime/Executable.cpp:529 #14 0x00007ffff25239df in JSC::FunctionExecutable::compileOptimizedForCall (this= 0x7fffa02fc820, exec=0x7fff7fc00370, scopeChainNode=0x7fffa8102ec0) at ../Source/JavaScriptCore/runtime/Executable.cpp:440 #15 0x00007ffff22d977b in JSC::FunctionExecutable::compileOptimizedFor (this=0x7fffa02fc820, exec=0x7fff7fc00370, scopeChainNode=0x7fffa8102ec0, kind=JSC::CodeForCall) at ../Source/JavaScriptCore/runtime/Executable.h:611 #16 0x00007ffff22d5ea1 in JSC::FunctionCodeBlock::compileOptimized (this=0x2354b00, exec= 0x7fff7fc00370, scopeChainNode=0x7fffa8102ec0) at ../Source/JavaScriptCore/bytecode/CodeBlock.cpp:2690 #17 0x00007ffff247bdff in JSC::cti_optimize (args=0x7fffffffca90) at ../Source/JavaScriptCore/jit/JITStubs.cpp:1990 #18 0x00007ffff2478387 in JSC::JITThunks::tryCacheGetByID (callFrame=0xffffc9a0, codeBlock= Python Exception <class 'gdb.error'> There is no member or method named m_hashAndFlags.: 0x7ffff22d977b, returnAddress=..., baseValue=..., propertyName=, slot=..., stubInfo= 0x7fff00000000) at ../Source/JavaScriptCore/jit/JITStubs.cpp:975 #19 0x00007fffffffcac0 in ?? () #20 0x00007fff00000000 in ?? () #21 0x00007fffa801c180 in ?? () #22 0x0000000000000002 in ?? () #23 0x00007fff00000004 in ?? () #24 0x00007fff7c177de0 in ?? () #25 0x00007fffffffcaf0 in ?? () #26 0x00007ffff229fa43 in JSC::JSValue::decode (ptr=0x45e7e8c78948104d) at ../Source/JavaScriptCore/runtime/JSValueInlineMethods.h:336 Backtrace stopped: previous frame inner to this frame (corrupt stack?)