Bug 123778

Summary: internal-js-tests.yaml/Octane/stress-tests/pdfjs.js.default: ASSERTION FAILED: m_state.forNode(child).m_futurePossibleStructure.isSubsetOf(StructureSet(structure)) at DFGConstantFoldingPhase.cpp:249
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: barraclough, ggaren, mark.lam, mhahnenberg, msaboff, oliver, sam
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
the patch ggaren: review+

Filip Pizlo
Reported 2013-11-04 20:11:10 PST
This is likely to be an overzealous assertion.
Attachments
the patch (2.31 KB, patch)
2013-11-04 20:30 PST, Filip Pizlo 		ggaren: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2013-11-04 20:18:53 PST
Heh, this is obviously a wrong assertion. We do an execute() above it. It is asserting that if we need a watchpoint (i.e. the best proven structure was not the current structure) then it must be the future possible structure. But while that may have been true before execute(), it won't be true after.
Filip Pizlo
Comment 2 2013-11-04 20:30:25 PST
Created attachment 215992 [details] the patch
Geoffrey Garen
Comment 3 2013-11-04 21:36:09 PST
Comment on attachment 215992 [details] the patch r=me
Filip Pizlo
Comment 4 2013-11-04 21:40:08 PST
Landed in http://trac.webkit.org/changeset/158646
Note You need to log in before you can comment on or make changes to this bug.