Summary: | internal-js-tests.yaml/Octane/stress-tests/pdfjs.js.default: ASSERTION FAILED: m_state.forNode(child).m_futurePossibleStructure.isSubsetOf(StructureSet(structure)) at DFGConstantFoldingPhase.cpp:249 | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Filip Pizlo <fpizlo> | ||||
Component: | JavaScriptCore | Assignee: | Filip Pizlo <fpizlo> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | barraclough, ggaren, mark.lam, mhahnenberg, msaboff, oliver, sam | ||||
Priority: | P2 | ||||||
Version: | 528+ (Nightly build) | ||||||
Hardware: | All | ||||||
OS: | All | ||||||
Attachments: |
|
Description
Filip Pizlo
2013-11-04 20:11:10 PST
Heh, this is obviously a wrong assertion. We do an execute() above it. It is asserting that if we need a watchpoint (i.e. the best proven structure was not the current structure) then it must be the future possible structure. But while that may have been true before execute(), it won't be true after. Created attachment 215992 [details]
the patch
Comment on attachment 215992 [details]
the patch
r=me
Landed in http://trac.webkit.org/changeset/158646 |