255715 2023-04-20 02:22:01 -0700 ASSERTION FAILED: edge->hasResult() in DFG::{anonymous}::Validate::validate() 2025-05-23 17:43:43 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED WORKSFORME InRadar P2 Normal --- 1 xiangwei1895 webkit-unassigned mark.lam webkit-bug-importer ysuzuki oldest_to_newest 1949991 0 xiangwei1895 2023-04-20 02:22:01 -0700 ## JavaScriptCore Version dd75c5c12d617264cfc1e26a70c94591e4eb67c1 ## Build Ubuntu 20.04.2 LTS (Linux 5.15.0-67-generic x86_64) ## Testcase and Execution steps ``` function f0() { for (let i = 0; i < 1e5; i++) {;} } v0 = {value: 0}; function f1() { var v1 = Object.defineProperties([0], {0: v0}); for ( _ in v1) { f0(v1[i]); ++v1[ f1 (i in v1) ]; if (i === "0") Object.defineProperties(v1, {0: v0}); } } for (var i = 0; i < 1e5; ++i) f1(); ``` ./bin/jsc testcase.js ## Output At D@178 -> Check:Untyped:Kill:D@76: validation failed: edge->hasResult() (/home/WebKit/Source/JavaScriptCore/dfg/DFGValidate.cpp:156). At time of failure: 54: DFG for f1#<no-hash>:[0x62d0000d48e0->0x62d0000d4340->0x62d000069880, DFGFunctionCall, 276 (DidTryToEnterInLoop)]: 54: Fixpoint state: FixpointConverged; Form: SSA; Unification state: GloballyUnified; Ref count state: ExactRefCount 54: Argument formats for entrypoint index: 0 : FlushedJSValue 0 54: Block #0 (bc#0): (OSR target) 0 54: Execution count: 1.000000 …… ASSERTION FAILED: edge->hasResult() /home/WebKit/Source/JavaScriptCore/dfg/DFGValidate.cpp(156) : void JSC::DFG::{anonymous}::Validate::validate() Aborted 1950665 1 webkit-bug-importer 2023-04-23 14:34:07 -0700 <rdar://problem/108430274> 2119465 2 ysuzuki 2025-05-23 17:42:20 -0700 It seems that this no longer reproduces.