https://bugs.webkit.org/show_bug.cgi?id=175823 made the ArrayPush node a varargs kind of node. This occasionally causes an assertion failure when running with verboseCFA=1 because of a call to node->child1() in DFGSafeToExecute.h for ArrayPush. I propose a simple fix, using "graph.varArgsChild(node, 1)" instead.
Created attachment 327179 [details] Patch
Comment on attachment 327179 [details] Patch r=me
Comment on attachment 327179 [details] Patch Attachment 327179 [details] did not pass mac-wk2-ews (mac-wk2): Output: http://webkit-queues.webkit.org/results/5276250 New failing tests: http/tests/appcache/offline-access.html
Created attachment 327192 [details] Archive of layout-test-results from ews107 for mac-elcapitan-wk2 The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews. Bot: ews107 Port: mac-elcapitan-wk2 Platform: Mac OS X 10.11.6
This failure looks unlikely to be related to my patch. I will try it again in a few hours.
Oops, nice catch.
Comment on attachment 327179 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=327179&action=review > Source/JavaScriptCore/dfg/DFGSafeToExecute.h:474 > + case ArrayPush: > + return node->arrayMode().alreadyChecked(graph, node, state.forNode(graph.varArgChild(node, 1))); varArgChild(node, 1) is not equivalent to child1(). varArgChild(node, 0) is equivalent to child1() (ah, DFG naming). You should make sure this is doing what you expect.
Comment on attachment 327179 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=327179&action=review >> Source/JavaScriptCore/dfg/DFGSafeToExecute.h:474 >> + return node->arrayMode().alreadyChecked(graph, node, state.forNode(graph.varArgChild(node, 1))); > > varArgChild(node, 1) is not equivalent to child1(). varArgChild(node, 0) is equivalent to child1() (ah, DFG naming). > You should make sure this is doing what you expect. Ignore me. This looks correct since the second varargs child is the array! Sorry for the noise.
Created attachment 327626 [details] Patch
r="Saam Barati" This is exactly the same patch as previously, just resubmitted since there has been a (probably) spurious failure last time.
Comment on attachment 327626 [details] Patch Rejecting attachment 327626 [details] from review queue. rmorisset@apple.com does not have reviewer permissions according to https://trac.webkit.org/browser/trunk/Tools/Scripts/webkitpy/common/config/contributors.json. - If you do not have reviewer rights please read http://webkit.org/coding/contributing.html for instructions on how to use bugzilla flags. - If you have reviewer rights please correct the error in Tools/Scripts/webkitpy/common/config/contributors.json by adding yourself to the file (no review needed). The commit-queue restarts itself every 2 hours. After restart the commit-queue will correctly respect your reviewer rights.
It looks like the resubmitting made the system forget about the reviews, and it won't let me mark it as reviewed myself. Can someone do it for me, please?
(In reply to Robin Morisset from comment #12) > It looks like the resubmitting made the system forget about the reviews, and > it won't let me mark it as reviewed myself. Can someone do it for me, please? What you can do in this situation is fill out the Reviewed by in the changelog yourself and just cq+
Comment on attachment 327626 [details] Patch Clearing flags on attachment: 327626 Committed r225170: <https://trac.webkit.org/changeset/225170>
All reviewed patches have been landed. Closing bug.
<rdar://problem/35698191>