Bug 123778 - internal-js-tests.yaml/Octane/stress-tests/pdfjs.js.default: ASSERTION FAILED: m_state.forNode(child).m_futurePossibleStructure.isSubsetOf(StructureSet(structure)) at DFGConstantFoldingPhase.cpp:249
Summary: internal-js-tests.yaml/Octane/stress-tests/pdfjs.js.default: ASSERTION FAILED...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Filip Pizlo
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-11-04 20:11 PST by Filip Pizlo
Modified: 2013-11-04 21:40 PST (History)
7 users (show)

See Also:

Attachments
the patch (2.31 KB, patch)
2013-11-04 20:30 PST, Filip Pizlo 		ggaren: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2013-11-04 20:11:10 PST 
This is likely to be an overzealous assertion.
Comment 1 Filip Pizlo 2013-11-04 20:18:53 PST 
Heh, this is obviously a wrong assertion.  We do an execute() above it.  It is asserting that if we need a watchpoint (i.e. the best proven structure was not the current structure) then it must be the future possible structure.  But while that may have been true before execute(), it won't be true after.
Comment 2 Filip Pizlo 2013-11-04 20:30:25 PST 
Created attachment 215992 [details]
the patch
Comment 3 Geoffrey Garen 2013-11-04 21:36:09 PST 
Comment on attachment 215992 [details]
the patch

r=me
Comment 4 Filip Pizlo 2013-11-04 21:40:08 PST 
Landed in http://trac.webkit.org/changeset/158646