228839 2021-08-05 12:40:25 -0700 Assertion failure when checking array in DFG (32 bits) 2021-08-05 19:00:17 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 mikhail webkit-unassigned ews-watchlist keith_miller mark.lam msaboff saam tzagallo webkit-bug-importer ysuzuki oldest_to_newest 1782310 0 435014 mikhail 2021-08-05 12:40:25 -0700 Created attachment 435014 Testcase The failure: ASSERTION FAILED: typeFilterFor(node->child1().useKind()) & SpecEmpty ../../Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp(861) : void JSC::DFG::SpeculativeJIT::checkArray(JSC::DFG::Node*) Aborted It happens because in 32 bits empty value doesn't pass the cell check. From SpeculatedType.h: static constexpr SpeculatedType SpecCellCheck = is64Bit() ? (SpecCell | SpecEmpty) : SpecCell; So when we reach the assertion, SpecEmpty is not set. There is no assertion failure when running jsc in release mode. 1782322 1 435018 mikhail 2021-08-05 13:21:58 -0700 Created attachment 435018 Patch 1782420 2 435018 ysuzuki 2021-08-05 18:54:17 -0700 Comment on attachment 435018 Patch r=me 1782422 3 ews-feeder 2021-08-05 18:59:47 -0700 Committed r280716 (240307@main): <https://commits.webkit.org/240307@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 435018. 1782423 4 webkit-bug-importer 2021-08-05 19:00:17 -0700 <rdar://problem/81595896> 435014 2021-08-05 12:40:25 -0700 2021-08-05 12:40:25 -0700 Testcase testcase.js text/javascript 169 mikhail ZnVuY3Rpb24gX19mXzAoKSB7IHJldHVybiBhcmd1bWVudHMgfQoKZnVuY3Rpb24gX19mXzEoX192 XzQpIHsKICB2YXIgX192XzYKICBpZihfX3ZfNCkKICAgIF9fdl82ID0gX19mXzAoKQoKICB7fQoK ICBfX3ZfNlsyXQp9Cgpmb3IgKGkgPSAwOyBpIDwgMTAwOyArK2kpIHsKICBfX2ZfMSgxKQp9Cg== 435018 2021-08-05 13:21:58 -0700 2021-08-05 18:59:48 -0700 Patch bug-228839-20210805202157.patch text/plain 2789 mikhail U3VidmVyc2lvbiBSZXZpc2lvbjogMjgwNTg5CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCA1 MDBlNWQ4OWJjMjRjMDk0NmU4Njc0MWRkZTU4YzMxNjJlNDgyOWNiLi5jYzVlMWE2ZDM0YTVkN2Mz YTIzNzI1N2VkZGEwNGI2NGE1ODhiZjgzIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxNiBAQAorMjAyMS0wOC0wNSAgTWlraGFpbCBSLiBHYWRlbGhhICA8bWlraGFpbEBpZ2Fs aWEuY29tPgorCisgICAgICAgIEFzc2VydGlvbiBmYWlsdXJlIHdoZW4gY2hlY2tpbmcgYXJyYXkg aW4gREZHICgzMiBiaXRzKQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1 Zy5jZ2k/aWQ9MjI4ODM5CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisK KyAgICAgICAgU2luY2UgZW1wdHkgdmFsdWVzIGRvbid0IHBhc3MgdGhlIGNlbGwgY2hlY2sgaW4g MzIgYml0cywgd2UgbmVlZCB0bworICAgICAgICBndWFyZCB0aGUgU3BlY0VtcHR5IGNoZWNrIHRv IG9ubHkgaGFwcGVuIGluIDY0IGJpdHMgYXJjaHMKKworICAgICAgICAqIGRmZy9ERkdTcGVjdWxh dGl2ZUpJVC5jcHA6CisgICAgICAgIChKU0M6OkRGRzo6U3BlY3VsYXRpdmVKSVQ6OmNoZWNrQXJy YXkpOgorCiAyMDIxLTA4LTAyICBZaWppYSBIdWFuZyAgPHlpamlhX2h1YW5nQGFwcGxlLmNvbT4K IAogICAgICAgICBBZGQgYSBuZXcgcGF0dGVybiB0byBpbnN0cnVjdGlvbiBzZWxlY3RvciB0byB1 dGlsaXplIFVNVUxMIHN1cHBvcnRlZCBieSBBUk02NApkaWZmIC0tZ2l0IGEvU291cmNlL0phdmFT Y3JpcHRDb3JlL2RmZy9ERkdTcGVjdWxhdGl2ZUpJVC5jcHAgYi9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvZGZnL0RGR1NwZWN1bGF0aXZlSklULmNwcAppbmRleCAyOTJjZWY2MWExZWQxNTE4YTYwODcx MzQyZDY0NGVkOTc4YjFlNWI4Li45ZjAwM2FiMGRmOWQyODhlYjM0ZTgzYjk3YzY0YWM5YzdlODEz NTM5IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1NwZWN1bGF0aXZl SklULmNwcAorKysgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1NwZWN1bGF0aXZlSklU LmNwcApAQCAtODU4LDcgKzg1OCw5IEBAIHZvaWQgU3BlY3VsYXRpdmVKSVQ6OmNoZWNrQXJyYXko Tm9kZSogbm9kZSkKICAgICAKICAgICBpZiAoYXJyYXlNb2RlLmFscmVhZHlDaGVja2VkKG1faml0 LmdyYXBoKCksIG5vZGUsIG1fc3RhdGUuZm9yTm9kZShub2RlLT5jaGlsZDEoKSkpKSB7CiAgICAg ICAgIC8vIFdlIGNhbiBwdXJnZSBFbXB0eSBjaGVjayBjb21wbGV0ZWx5IGluIHRoaXMgY2FzZSBv ZiBDaGVja0FycmF5T3JFbXB0eSBzaW5jZSBDZWxsVXNlIG9ubHkgYWNjZXB0cyBTcGVjQ2VsbCB8 IFNwZWNFbXB0eS4KKyNpZiBVU0UoSlNWQUxVRTY0KQogICAgICAgICBBU1NFUlQodHlwZUZpbHRl ckZvcihub2RlLT5jaGlsZDEoKS51c2VLaW5kKCkpICYgU3BlY0VtcHR5KTsKKyNlbmRpZgogICAg ICAgICBub1Jlc3VsdChtX2N1cnJlbnROb2RlKTsKICAgICAgICAgcmV0dXJuOwogICAgIH0KZGlm ZiAtLWdpdCBhL0pTVGVzdHMvQ2hhbmdlTG9nIGIvSlNUZXN0cy9DaGFuZ2VMb2cKaW5kZXggNzVk NDA1OTAxZGQyM2JhMzMyOGY3ZjIxYWU2NGZmZjZmOTEyMzU0My4uMzdmZDFhNmE0NzQ0Y2YxMDNm M2MyZjRjOTU1NTU0NzgxZWQyZGRlOSAxMDA2NDQKLS0tIGEvSlNUZXN0cy9DaGFuZ2VMb2cKKysr IGIvSlNUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNiBAQAorMjAyMS0wOC0wNSAgTWlraGFp bCBSLiBHYWRlbGhhICA8bWlraGFpbEBpZ2FsaWEuY29tPgorCisgICAgICAgIEFzc2VydGlvbiBm YWlsdXJlIHdoZW4gY2hlY2tpbmcgYXJyYXkgaW4gREZHICgzMiBiaXRzKQorICAgICAgICBodHRw czovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjI4ODM5CisKKyAgICAgICAgUmV2 aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBzdHJlc3MvY2hlY2stYXJyYXkt ZW1wdHktMzIuanM6IEFkZGVkLgorICAgICAgICAoYS5iLmNhdGNoLnByaW50LmMpOgorICAgICAg ICAoYS5iKToKKyAgICAgICAgKGEuZSk6CisgICAgICAgIChhKToKKwogMjAyMS0wOC0wMiAgWXVz dWtlIFN1enVraSAgPHlzdXp1a2lAYXBwbGUuY29tPgogCiAgICAgICAgIFtKU0NdIFlhcnIgQm95 ZXJNb29yZSBzZWFyY2ggc2hvdWxkIHN1cHBvcnQgY2hhcmFjdGVyLWNsYXNzCmRpZmYgLS1naXQg YS9KU1Rlc3RzL3N0cmVzcy9jaGVjay1hcnJheS1lbXB0eS0zMi5qcyBiL0pTVGVzdHMvc3RyZXNz L2NoZWNrLWFycmF5LWVtcHR5LTMyLmpzCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLmYyOWI5NDliYmNiMjhhOGQxNDcx MTRlNjk0M2VkZjhiNTk0MDc3NGMKLS0tIC9kZXYvbnVsbAorKysgYi9KU1Rlc3RzL3N0cmVzcy9j aGVjay1hcnJheS1lbXB0eS0zMi5qcwpAQCAtMCwwICsxLDE1IEBACitmdW5jdGlvbiBfX2ZfMCgp IHsgcmV0dXJuIGFyZ3VtZW50cyB9CisKK2Z1bmN0aW9uIF9fZl8xKF9fdl80KSB7CisgIHZhciBf X3ZfNgorICBpZihfX3ZfNCkKKyAgICBfX3ZfNiA9IF9fZl8wKCkKKworICB7fQorCisgIF9fdl82 WzJdCit9CisKK2ZvciAoaSA9IDA7IGkgPCAxMDA7ICsraSkgeworICBfX2ZfMSgxKQorfQo=