Bug 123778

Summary:

internal-js-tests.yaml/Octane/stress-tests/pdfjs.js.default: ASSERTION FAILED: m_state.forNode(child).m_futurePossibleStructure.isSubsetOf(StructureSet(structure)) at DFGConstantFoldingPhase.cpp:249

Product:

WebKit

Reporter:

Filip Pizlo <fpizlo>

Component:

JavaScriptCore

Assignee:

Filip Pizlo <fpizlo>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

barraclough, ggaren, mark.lam, mhahnenberg, msaboff, oliver, sam

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Attachments:

Description	Flags
the patch	ggaren: review+

Description Filip Pizlo 2013-11-04 20:11:10 PST

This is likely to be an overzealous assertion.

Comment 1 Filip Pizlo 2013-11-04 20:18:53 PST

Heh, this is obviously a wrong assertion.  We do an execute() above it.  It is asserting that if we need a watchpoint (i.e. the best proven structure was not the current structure) then it must be the future possible structure.  But while that may have been true before execute(), it won't be true after.

Comment 2 Filip Pizlo 2013-11-04 20:30:25 PST

Created attachment 215992 [details]
the patch

Comment 3 Geoffrey Garen 2013-11-04 21:36:09 PST

Comment on attachment 215992 [details]
the patch

r=me

Comment 4 Filip Pizlo 2013-11-04 21:40:08 PST

Landed in http://trac.webkit.org/changeset/158646