Bug 251722

Summary:	[ BigSur+ Debug JSC ](New Tests?): ASSERTION FAILED: mode == ManualOperandSpeculation \|\| edge.useKind() == HeapBigIntUse
Product:	WebKit	Reporter:	Robert Jenner <jenner>
Component:	JavaScriptCore	Assignee:	Yusuke Suzuki <ysuzuki>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	tzagallo, webkit-bot-watchers-bugzilla, webkit-bug-importer, ysuzuki
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified
See Also:	https://bugs.webkit.org/show_bug.cgi?id=251332

Robert Jenner

Reported 2023-02-03 14:42:05 PST

wasm.yaml/wasm/stress/js-to-wasm-i64-register.js.wasm-eager wasm.yaml/wasm/stress/js-to-wasm-i64-stack.js.wasm-eager wasm.yaml/wasm/stress/js-to-wasm-many-i64.js.default-wasm wasm.yaml/wasm/stress/js-to-wasm-many-i64.js.wasm-air wasm.yaml/wasm/stress/js-to-wasm-many-i64.js.wasm-b3 wasm.yaml/wasm/stress/js-to-wasm-many-i64.js.wasm-bbqb3 wasm.yaml/wasm/stress/js-to-wasm-many-i64.js.wasm-eager wasm.yaml/wasm/stress/js-to-wasm-many-i64.js.wasm-eager-jettison wasm.yaml/wasm/stress/js-to-wasm-many-i64.js.wasm-no-cjit wasm.yaml/wasm/stress/js-to-wasm-many-i64.js.wasm-simd wasm.yaml/wasm/stress/js-to-wasm-many-i64.js.wasm-slow-memory Appear to be hitting the following assertion BigSur and Monterey Debug: ASSERTION FAILED: mode == ManualOperandSpeculation || edge.useKind() == HeapBigIntUse HISTORY: https://results.webkit.org/?suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-many-i64.js.wasm-eager-jettison&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-many-i64.js.wasm-no-cjit&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-many-i64.js.wasm-simd&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-many-i64.js.wasm-slow-memory&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-many-i64.js.default-wasm&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-many-i64.js.wasm-air&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-many-i64.js.wasm-b3&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-i64-register.js.wasm-eager&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-i64-register.js.wasm-eager-jettison&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-i64-stack.js.wasm-eager&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-i64-stack.js.wasm-eager-jettison They appear to all have been newly added tests at https://commits.webkit.org/259584@main

Attachments
Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2023-02-03 14:42:41 PST

<rdar://problem/105021476>

Yusuke Suzuki

Comment 2 2023-02-03 15:32:14 PST

Pull request: https://github.com/WebKit/WebKit/pull/9631

EWS

Comment 3 2023-02-03 16:25:32 PST

Committed 259846@main (781fc3abea74): <https://commits.webkit.org/259846@main> Reviewed commits have been landed. Closing PR #9631 and removing active labels.

Note You need to log in before you can comment on or make changes to this bug.