squirrelfish-dev

Download

squirrelfish-dev@lists.macosforge.org

March 2013

2 participants
2 discussions

[webkit-help] [squirrelfish-dev] JIT Optimize Property Access failed
by talking1239＠gmail.com 05 Mar '13

05 Mar '13

Hi I enable ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS feature and find that it will crash when go back the home page after run follow test case, I think it is caused by the optimize propery access, so anyone know that it is caused by the arch related code or jit Infrastructure code? and if i disable ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS feature, it will run correctly. Any help explaining this would be much appreciated! test case: var Origin = new Object(); function Init() { Origin.V = [150] } for ( var i = 20; i <= 160; i *= 2 ) { //Init(i); } Init(); Init(); Init(); Origin = null; Callstack: JAVASCRIPTCORE!const JSC::JSArray::`vftable' + 2 bytes JAVASCRIPTCORE!JSC::Heap::sweep() line 1104 + 14 bytes JAVASCRIPTCORE!JSC::Heap::collectAllGarbage() line 1306 WEBKIT!WebCore::collect(void * 0x00000000) line 47 WEBKIT!WebCore::GCController::gcTimerFired(WebCore::Timer<WebCore::GCController> * 0x06a905a0 {m_object=??? m_function=??? }) line 70 WEBKIT!WebCore::Timer<WebCore::PageCache>::fired() line 98 + 20 bytes WEBKIT!WebCore::ThreadTimers::sharedTimerFiredInternal() line 115 WEBKIT!WebCore::ThreadTimers::sharedTimerFired() line 91 -- BGs/Felix Shi -- BGs/Felix Shi

2 3

Re: [squirrelfish] [webkit-dev] [webkit-help] [squirrelfish-dev] How to debug the JIT when it crash
by talking1239＠gmail.com 05 Mar '13

05 Mar '13

Hi Arunprasad, Thanks for your tips. My environment as following: CPU: SH4; SVN revision: 65000 OS: WINCE Tool Chain: MSVS+PB JS test case: I cann’t get the single js test case. But I can reproduce it as this steps[First access the http://image.baidu.com/, then access http://maps.google.de, wait 2-5 minitues, it will crash. The crash type is “access violation”]. I have try to debug it, find that the crash was caused by the jit, if we disable the JIT feature, the browser will not crash. As the test case is very complex and it is hard to be simplify, so I don’t know how to debug it. I try to print all the emitted instructions, but it is too many for me to analyze, after the instructions were emitted, the instruction will be repatch or relink, so anybody can give me some suggestion for how to debug it. Thanks. From: talking1239+caf_=talking1239=126.com(a)gmail.com [mailto:talking1239+caf_=talking1239=126.com@gmail.com] On Behalf Of Arunprasad Rajkumar Sent: 2013年3月4日 20:28 To: talking1239(a)gmail.com Cc: webkit-help(a)lists.webkit.org; squirrelfish-dev(a)lists.webkit.org; webkit-dev(a)lists.webkit.org Subject: Re: [webkit-dev] [webkit-help] [squirrelfish-dev] How to debug the JIT when it crash It will be good to mention CPU, WebKit SVN revision, OS, Tool Chain, JS test case name(Sun Spider,..?)..etc so that people can give more suggestions. On 4 March 2013 16:11, <talking1239(a)gmail.com> wrote: Hi All, apologies for the spam. right now I am trying to fix the jit crash bug, but I don't know how to start it, can anyone give me some suggestion? when javascript engine run some special test case, it will run crash. I have print all the emited instructions, but the instructions will be repatch or relink after it run, so is exist an way or steps for debugging it? Thanks in advance! -- BGs/Felix Shi _______________________________________________ webkit-dev mailing list webkit-dev(a)lists.webkit.org https://lists.webkit.org/mailman/listinfo/webkit-dev -- Arunprasad Rajkumar <http://in.linkedin.com/in/ararunprasad> http://in.linkedin.com/in/ararunprasad

1 0