Created attachment 256207 [details] Test case Load this test with debug or release jsc. An assertion fail will happen in debug and an immediate crash in release because of the release assert: Array(dumpBasicBlockExecutionRanges()); Backtrace: ASSERTION FAILED: exec->vm().controlFlowProfiler() ../../Source/JavaScriptCore/jsc.cpp(1156) : JSC::EncodedJSValue functionDumpBasicBlockExecutionRanges(JSC::ExecState*) 1 0x7ffff72d46db WTFCrash 2 0x428728 3 0x7fffb0fff0a8 [New Thread 0x7fffaf7fa700 (LWP 32247)] [New Thread 0x7fffafffb700 (LWP 32245)] [New Thread 0x7fffb07fc700 (LWP 32244)] [New Thread 0x7fffb0ffd700 (LWP 32243)] Program received signal SIGSEGV, Segmentation fault. 0x00007ffff72d46e0 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 321 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007ffff72d46e0 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 #1 0x0000000000428728 in functionDumpBasicBlockExecutionRanges (exec=0x7fffffffca50) at ../../Source/JavaScriptCore/jsc.cpp:1156 #2 0x00007fffb0fff0a8 in ?? () #3 0x00007fffffffcab0 in ?? () #4 0x00007ffff727e8e9 in llint_entry () from webkit/WebKitBuild/Debug/lib/libjavascriptcore_efl.so.1
Did you run this with: JSC_enableControlFlowProfiler=1 ? If not, this assertion is doing the right thing. It makes sure the control flow profiler is enabled.a Also, this function is only used inside JSC's stress tests.