Bug 292111 – REGRESSION ( 294024@main): [ MacOS iOS WK2 Debug ] ASSERTION FAILED: bytecodeCanIgnoreNegativeZero(node->arithNodeFlags())

• Component: JavaScriptCore
• Status: RESOLVED DUPLICATE

[Jay Stfleur]

Description:
imported/w3c/web-platform-tests/webcodecs/video-encoder-rescaling.https.any.html?av1
imported/w3c/web-platform-tests/webcodecs/video-encoder-rescaling.https.any.html?h264_annexb
imported/w3c/web-platform-tests/webcodecs/video-encoder-rescaling.https.any.html?h264_avc
imported/w3c/web-platform-tests/webcodecs/video-encoder-rescaling.https.any.html?vp8
imported/w3c/web-platform-tests/webcodecs/video-encoder-rescaling.https.any.html?vp9_p0
imported/w3c/web-platform-tests/webcodecs/video-encoder-rescaling.https.any.worker.html?av1
imported/w3c/web-platform-tests/webcodecs/video-encoder-rescaling.https.any.worker.html?h264_annexb
imported/w3c/web-platform-tests/webcodecs/video-encoder-rescaling.https.any.worker.html?h264_avc
imported/w3c/web-platform-tests/webcodecs/video-encoder-rescaling.https.any.worker.html?vp8
imported/w3c/web-platform-tests/webcodecs/video-encoder-rescaling.https.any.worker.html?vp9_p0

Tests are failing on MacOS and iOS Wk2 Debug with assertion bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()) which is checking that the code generator can safely ignore -0 values in math operations, changes were introduced on 294024@main


Buildbot URL:
https://build.webkit.org/#/builders/1228/builds/1294

History:
https://results.webkit.org/?suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&test=imported%2Fw3c%2Fweb-platform-tests%2Fwebcodecs%2Fvideo-encoder-rescaling.https.any.html%3Fav1&test=imported%2Fw3c%2Fweb-platform-tests%2Fwebcodecs%2Fvideo-encoder-rescaling.https.any.html%3Fh264_annexb&test=imported%2Fw3c%2Fweb-platform-tests%2Fwebcodecs%2Fvideo-encoder-rescaling.https.any.html%3Fh264_avc&test=imported%2Fw3c%2Fweb-platform-tests%2Fwebcodecs%2Fvideo-encoder-rescaling.https.any.html%3Fvp8&test=imported%2Fw3c%2Fweb-platform-tests%2Fwebcodecs%2Fvideo-encoder-rescaling.https.any.html%3Fvp9_p0&test=imported%2Fw3c%2Fweb-platform-tests%2Fwebcodecs%2Fvideo-encoder-rescaling.https.any.worker.html%3Fav1&test=imported%2Fw3c%2Fweb-platform-tests%2Fwebcodecs%2Fvideo-encoder-rescaling.https.any.worker.html%3Fh264_annexb&test=imported%2Fw3c%2Fweb-platform-tests%2Fwebcodecs%2Fvideo-encoder-rescaling.https.any.worker.html%3Fh264_avc&test=imported%2Fw3c%2Fweb-platform-tests%2Fwebcodecs%2Fvideo-encoder-rescaling.https.any.worker.html%3Fvp8&test=imported%2Fw3c%2Fweb-platform-tests%2Fwebcodecs%2Fvideo-encoder-rescaling.https.any.worker.html%3Fvp9_p0&style=debug&platform=ios&platform=mac

Diff/Image Diff/Crash Log:
stderr:
ASSERTION FAILED: bytecodeCanIgnoreNegativeZero(node->arithNodeFlags())
/Volumes/Data/worker/Apple-Sequoia-Debug-Build/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp(3523) : void JSC::DFG::SpeculativeJIT::compile(Node *)
1   0x4c350598f JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node*)
2   0x4c329cd72 JSC::DFG::SpeculativeJIT::compileCurrentBlock()
3   0x4c328a09b JSC::DFG::SpeculativeJIT::compileBody()
4   0x4c328b294 JSC::DFG::SpeculativeJIT::compileFunction()
5   0x4c47f9781 JSC::DFG::Plan::compileInThreadImpl()
6   0x4c4d74752 JSC::JITPlan::compileInThread(JSC::JITWorklistThread*)
7   0x4c4dd6cdb JSC::JITWorklistThread::work()
8   0x4c2fcc07b WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0::operator()() const
9   0x4c2fcbc39 WTF::Detail::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0, void>::call()
10  0x4c2fe9227 WTF::Function<void ()>::operator()() const
11  0x4c320a823 WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*)
12  0x4c3216975 WTF::wtfThreadEntryPoint(void*)
13  0x7ff80ab52253 _pthread_start
14  0x7ff80ab4dbef thread_start
com.apple.WebKit.WebContent.Development terminated (pid 38169) for reason: crash
LEAK: 1 WebPageProxy

[Radar WebKit Bug Importer]

<rdar://problem/150116514>

[EWS]

Test gardening commit 294155@main (a8a017ff5dcd): <https://commits.webkit.org/294155@main>

Reviewed commits have been landed. Closing PR #44566 and removing active labels.

[Alexey Proskuryakov]

*** Bug 292110 has been marked as a duplicate of this bug. ***

[Sosuke Suzuki]

reproduction:

```js
var MAX_UNIX_TIMET = 2145859200;
function test(value) {
    return (value + MAX_UNIX_TIMET / 2) % MAX_UNIX_TIMET;
}
noInline(test);
for (let i = 0; i < 1e4; i++) {
    test(/* 2^32 */ 2147483648);
}
```

This should now be fixed by https://bugs.webkit.org/show_bug.cgi?id=292197

*** This bug has been marked as a duplicate of bug 292197 ***