Bug 123778 - internal-js-tests.yaml/Octane/stress-tests/pdfjs.js.default: ASSERTION FAILED: m_state.forNode(child).m_futurePossibleStructure.isSubsetOf(StructureSet(structure)) at DFGConstantFoldingPhase.cpp:249
Summary: internal-js-tests.yaml/Octane/stress-tests/pdfjs.js.default: ASSERTION FAILED...
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Filip Pizlo
Depends on:
Reported: 2013-11-04 20:11 PST by Filip Pizlo
Modified: 2013-11-04 21:40 PST (History)
7 users (show)

See Also:

the patch (2.31 KB, patch)
2013-11-04 20:30 PST, Filip Pizlo
ggaren: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2013-11-04 20:11:10 PST
This is likely to be an overzealous assertion.
Comment 1 Filip Pizlo 2013-11-04 20:18:53 PST
Heh, this is obviously a wrong assertion.  We do an execute() above it.  It is asserting that if we need a watchpoint (i.e. the best proven structure was not the current structure) then it must be the future possible structure.  But while that may have been true before execute(), it won't be true after.
Comment 2 Filip Pizlo 2013-11-04 20:30:25 PST
Created attachment 215992 [details]
the patch
Comment 3 Geoffrey Garen 2013-11-04 21:36:09 PST
Comment on attachment 215992 [details]
the patch

Comment 4 Filip Pizlo 2013-11-04 21:40:08 PST
Landed in http://trac.webkit.org/changeset/158646