181200 2017-12-31 16:59:30 -0800 Incorrect assertion inside AccessCase 2018-01-02 19:59:21 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 saam saam benjamin commit-queue fpizlo ggaren gskachkov jfbastien keith_miller mark.lam msaboff rmorisset ticaiolima webkit-bug-importer ysuzuki oldest_to_newest 1385009 0 saam 2017-12-31 16:59:30 -0800 In a setter like: ``` o.f = o; ``` The DFG will often assign the same registers to the baseGPR (o in o.f) and the valueRegsPayloadGPR (o in the RHS). The code totally works when these are assigned to the same register. However, we're asserting that they're not the same register. 1385010 1 saam 2017-12-31 17:00:09 -0800 <rdar://problem/35494754> 1385011 2 330269 saam 2017-12-31 17:05:00 -0800 Created attachment 330269 patch 1385051 3 330269 ysuzuki 2018-01-01 10:05:08 -0800 Comment on attachment 330269 patch r=me 1385371 4 330269 commit-queue 2018-01-02 19:59:19 -0800 Comment on attachment 330269 patch Clearing flags on attachment: 330269 Committed r226351: <https://trac.webkit.org/changeset/226351> 1385372 5 commit-queue 2018-01-02 19:59:21 -0800 All reviewed patches have been landed. Closing bug. 330269 2017-12-31 17:05:00 -0800 2018-01-02 19:59:19 -0800 patch c-backup.diff text/plain 3234 saam SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyMjYzMTQpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDE2IEBACisyMDE3LTEyLTMxICBTYWFtIEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUu Y29tPgorCisgICAgICAgIEluY29ycmVjdCBhc3NlcnRpb24gaW5zaWRlIEFjY2Vzc0Nhc2UKKyAg ICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE4MTIwMAorICAg ICAgICA8cmRhcjovL3Byb2JsZW0vMzU0OTQ3NTQ+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9C T0RZIChPT1BTISkuCisKKyAgICAgICAgKiBzdHJlc3Mvc2V0dGVyLXNhbWUtYmFzZS1hbmQtcmhz LWludmFsaWQtYXNzZXJ0aW9uLWluc2lkZS1hY2Nlc3MtY2FzZS5qczogQWRkZWQuCisgICAgICAg IChjdG9yKToKKyAgICAgICAgKHRoZUZ1bmMpOgorICAgICAgICAocnVuKToKKwogMjAxNy0xMi0y OCAgU2FhbSBCYXJhdGkgIDxzYmFyYXRpQGFwcGxlLmNvbT4KIAogICAgICAgICBBc3NlcnRpb24g dXNlZCB0byBkZXRlcm1pbmUgaWYgc29tZXRoaW5nIGlzIGFuIGFzeW5jIGdlbmVyYXRvciBpcyB3 cm9uZwpJbmRleDogSlNUZXN0cy9zdHJlc3Mvc2V0dGVyLXNhbWUtYmFzZS1hbmQtcmhzLWludmFs aWQtYXNzZXJ0aW9uLWluc2lkZS1hY2Nlc3MtY2FzZS5qcwo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKU1Rlc3Rz L3N0cmVzcy9zZXR0ZXItc2FtZS1iYXNlLWFuZC1yaHMtaW52YWxpZC1hc3NlcnRpb24taW5zaWRl LWFjY2Vzcy1jYXNlLmpzCShub25leGlzdGVudCkKKysrIEpTVGVzdHMvc3RyZXNzL3NldHRlci1z YW1lLWJhc2UtYW5kLXJocy1pbnZhbGlkLWFzc2VydGlvbi1pbnNpZGUtYWNjZXNzLWNhc2UuanMJ KHdvcmtpbmcgY29weSkKQEAgLTAsMCArMSwxNyBAQAorZnVuY3Rpb24gY3RvcigpIHt9CitjdG9y LnByb3RvdHlwZS5fX2RlZmluZVNldHRlcl9fKCJmIiwgZnVuY3Rpb24gKCkgeyB9KTsKKworZnVu Y3Rpb24gdGhlRnVuYyhvKSB7CisgICAgby5mID0gbzsKK30KK25vSW5saW5lKHRoZUZ1bmMpOwor ZnVuY3Rpb24gcnVuKG8pIHsKKyAgICB0aGVGdW5jKG8pOworfQorCitmb3IgKGxldCBpID0gMDsg aSA8IDEwMDAwMDsgKytpKSB7CisgICAgcnVuKG5ldyBjdG9yKCkpCisgICAgbGV0IG8gPSBuZXcg Y3RvcigpOworICAgIG8uZyA9IDU0OworICAgIHJ1bihvKTsKK30KSW5kZXg6IFNvdXJjZS9KYXZh U2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3Jl L0NoYW5nZUxvZwkocmV2aXNpb24gMjI2MzE0KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL0No YW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI1IEBACisyMDE3LTEyLTMxICBTYWFt IEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUuY29tPgorCisgICAgICAgIEluY29ycmVjdCBhc3NlcnRp b24gaW5zaWRlIEFjY2Vzc0Nhc2UKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hv d19idWcuY2dpP2lkPTE4MTIwMAorICAgICAgICA8cmRhcjovL3Byb2JsZW0vMzU0OTQ3NTQ+CisK KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQ29uc2lkZXIg YSBQdXRCeUlkIGNvbXBpbGVkIHRvIGEgc2V0dGVyIGluIGEgZnVuY3Rpb24gbGlrZSBzbzoKKyAg ICAgICAgCisgICAgICAgIGBgYAorICAgICAgICBmdW5jdGlvbiBmb28obykgeyBvLmYgPSBvOyB9 CisgICAgICAgIGBgYAorICAgICAgICAKKyAgICAgICAgVGhlIERGRyB3aWxsIG9mdGVuIGFzc2ln biB0aGUgc2FtZSByZWdpc3RlcnMgdG8gdGhlIGJhc2VHUFIgKG8gaW4gby5mKSBhbmQgdGhlCisg ICAgICAgIHZhbHVlUmVnc1BheWxvYWRHUFIgKG8gaW4gdGhlIFJIUykuIFRoZSBjb2RlIHRvdGFs bHkgd29ya3Mgd2hlbiB0aGVzZSBhcmUgYXNzaWduZWQKKyAgICAgICAgdG8gdGhlIHNhbWUgcmVn aXN0ZXIuIEhvd2V2ZXIsIHdlJ3JlIGFzc2VydGluZyB0aGF0IHRoZXkncmUgbm90IHRoZSBzYW1l IHJlZ2lzdGVyLgorICAgICAgICBUaGlzIHBhdGNoIGp1c3QgcmVtb3ZlcyB0aGlzIGludmFsaWQg YXNzZXJ0aW9uLgorCisgICAgICAgICogYnl0ZWNvZGUvQWNjZXNzQ2FzZS5jcHA6CisgICAgICAg IChKU0M6OkFjY2Vzc0Nhc2U6OmdlbmVyYXRlSW1wbCk6CisKIDIwMTctMTItMzAgIFl1c3VrZSBT dXp1a2kgIDx1dGF0YW5lLnRlYUBnbWFpbC5jb20+CiAKICAgICAgICAgW0pTQ10gUmVtb3ZlIHVu dXNlZCBKU1R5cGVzCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvZGUvQWNjZXNz Q2FzZS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2J5dGVjb2RlL0Fj Y2Vzc0Nhc2UuY3BwCShyZXZpc2lvbiAyMjYzMTQpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUv Ynl0ZWNvZGUvQWNjZXNzQ2FzZS5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTY5Miw3ICs2OTIsNyBA QCB2b2lkIEFjY2Vzc0Nhc2U6OmdlbmVyYXRlSW1wbChBY2Nlc3NHZW5lCiAgICAgICAgIGlmICht X3R5cGUgPT0gR2V0dGVyIHx8IG1fdHlwZSA9PSBTZXR0ZXIpIHsKICAgICAgICAgICAgIGF1dG8m IGFjY2VzcyA9IHRoaXMtPmFzPEdldHRlclNldHRlckFjY2Vzc0Nhc2U+KCk7CiAgICAgICAgICAg ICBBU1NFUlQoYmFzZUdQUiAhPSBsb2FkZWRWYWx1ZUdQUik7Ci0gICAgICAgICAgICBBU1NFUlQo bV90eXBlICE9IFNldHRlciB8fCAoYmFzZUdQUiAhPSB2YWx1ZVJlZ3NQYXlsb2FkR1BSICYmIGxv YWRlZFZhbHVlR1BSICE9IHZhbHVlUmVnc1BheWxvYWRHUFIpKTsKKyAgICAgICAgICAgIEFTU0VS VChtX3R5cGUgIT0gU2V0dGVyIHx8IHZhbHVlUmVnc1BheWxvYWRHUFIgIT0gbG9hZGVkVmFsdWVH UFIpOwogCiAgICAgICAgICAgICAvLyBDcmVhdGUgYSBKUyBjYWxsIHVzaW5nIGEgSlMgY2FsbCBp bmxpbmUgY2FjaGUuIEFzc3VtZSB0aGF0OgogICAgICAgICAgICAgLy8K