Bug 143102 – REGRESSION (181992-182000): Dromaeo/jslib-modify-prototype.html perf test fails with a JSC release assertion

• Component: JavaScriptCore
• Status: RESOLVED DUPLICATE

[Alexey Proskuryakov]

Presumably due to http://trac.webkit.org/changeset/181993 ?

Running Dromaeo/jslib-modify-prototype.html (65 of 144)
error: Dromaeo/jslib-modify-prototype.html
Assertion failed: (getOperand(0)->getType() == getOperand(1)->getType() && "Both operands to ICmp instruction are not of the same type!"), function AssertOK, file /private/tmp/LLVM/include/llvm/IR/Instructions.h, line 973.
1   0x1120031b0 abort
2   0x11207d7dd llvm::ICmpInst::ICmpInst(llvm::CmpInst::Predicate, llvm::Value*, llvm::Value*, llvm::Twine const&)
3   0x11207d5ef llvm::IRBuilder<true, llvm::ConstantFolder, llvm::IRBuilderDefaultInserter<true> >::CreateICmp(llvm::CmpInst::Predicate, llvm::Value*, llvm::Value*, llvm::Twine const&)
4   0x112782489 LLVMBuildICmp
5   0x1062370f8 JSC::FTL::LowerDFGToLLVM::compileGetArrayLength()
6   0x10622d3e5 JSC::FTL::LowerDFGToLLVM::compileNode(unsigned int)
7   0x10622c9c8 JSC::FTL::LowerDFGToLLVM::compileBlock(JSC::DFG::BasicBlock*)
8   0x10622bbcb JSC::FTL::LowerDFGToLLVM::lower()
9   0x10622a4b9 JSC::FTL::lowerDFGToLLVM(JSC::FTL::State&)
10  0x106175afa JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&)
11  0x10617511d JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*)
12  0x1061fce72 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*)
13  0x1065a1dd3 WTF::threadEntryPoint(void*)
14  0x1065a22bf WTF::wtfThreadEntryPoint(void*)
15  0x7fff8e583268 _pthread_body
16  0x7fff8e5831e5 _pthread_body
17  0x7fff8e58141d thread_start

[Radar WebKit Bug Importer]

<rdar://problem/20310664>

[Filip Pizlo]

This was probably fixed by https://trac.webkit.org/changeset/182009 https://bugs.webkit.org/show_bug.cgi?id=143098.

[Alexey Proskuryakov]

Yes, looks fixed.

*** This bug has been marked as a duplicate of bug 143098 ***