>>> ASSERTION FAILED: m_op == CompareStrictEq ../../Source/JavaScriptCore/dfg/DFGNode.h(713) : void JSC::DFG::Node::convertToCompareEqPtr(JSC::DFG::FrozenValue *, JSC::DFG::Edge) 1 0x10a9e6849 WTFCrash 2 0x109295dfb WTFCrashWithInfo(int, char const*, char const*, int) 3 0x1099b4266 JSC::DFG::ConstantFoldingPhase::foldConstants(JSC::DFG::BasicBlock*) 4 0x1099aa646 JSC::DFG::ConstantFoldingPhase::run() 5 0x1099a44de bool JSC::DFG::runPhase<JSC::DFG::ConstantFoldingPhase>(JSC::DFG::Graph&) 6 0x109b6fa7e JSC::DFG::Plan::compileInThreadImpl() 7 0x109b6de3d JSC::DFG::Plan::compileInThread(JSC::DFG::ThreadData*) 8 0x109d8ffc9 JSC::DFG::Worklist::ThreadBody::work() 9 0x10a9eae29 WTF::Function<void ()>::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0>::call() 10 0x10aa1b85a WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) 11 0x10aad6edd WTF::wtfThreadEntryPoint(void*) 12 0x7fff7b0ba305 _pthread_body 13 0x7fff7b0bd26f _pthread_start 14 0x7fff7b0b9415 thread_start UndefinedBehaviorSanitizer:DEADLYSIGNAL ==61785==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x0000bbadbeef (pc 0x00010a9e684e bp 0x7000068f89f0 sp 0x7000068f89f0 T1709195) ==61785==The signal is caused by a WRITE memory access. #0 0x10a9e684d in WTFCrash Assertions.cpp:305 ==61785==Register values: rax = 0x00000000bbadbeef rbx = 0x000000010accfcc1 rcx = 0x000000000007f702 rdx = 0x0000000000000004 rdi = 0x000000010b28e544 rsi = 0x000000010c992000 rbp = 0x00007000068f89f0 rsp = 0x00007000068f89f0 r8 = 0x00000000000130a8 r9 = 0x0000000000000000 r10 = 0x00007fffadc9f048 r11 = 0x00007fffadc9f040 r12 = 0x00007000068f8e20 r13 = 0x000000010dc735c8 r14 = 0x000000010acc4f8f r15 = 0x0000000000000026 UndefinedBehaviorSanitizer can not provide additional info. ==61785==ABORTING Abort trap: 6 Poc: function main() { const v3 = [1337,1337,13.37,1337]; const v5 = [1337,13.37,1337,1337,1337,1337,13.37,1337,1337,1337]; const v8 = {getInt8:13.37}; const v9 = Object(); function v10(v11,v12,v13,v14) { for (const v15 of v5) { for (const v16 of v11) { let v18 = v8; do { const v20 = Object.is(0,v18); const v22 = ["name"]; for (let v25 = 0; v25 < 100; v25++) { const v26 = v25[100]; } const v27 = v22 + 1; v18 = v27; } while (v18 < -9007199254740991); } } } const v28 = v10(v3,v9); } noDFG(main); noFTL(main); main();
reported by HAICHEN WANG, P1umer
<rdar://problem/49199639>
Ah, I think this is a bad assertion since we added SameValue to the DFG with r231224. Should be a simple fix.
Created attachment 365843 [details] Patch
Created attachment 365844 [details] Patch
Comment on attachment 365844 [details] Patch Attachment 365844 [details] did not pass ios-sim-ews (ios-simulator-wk2): Output: https://webkit-queues.webkit.org/results/11655632 New failing tests: fast/visual-viewport/ios/min-scale-greater-than-one.html
Created attachment 365849 [details] Archive of layout-test-results from ews124 for ios-simulator-wk2 The attached test failures were seen while running run-webkit-tests on the ios-sim-ews. Bot: ews124 Port: ios-simulator-wk2 Platform: Mac OS X 10.13.6
Yeah, iOS simulator doesn't use JIT so that's noise...
Comment on attachment 365844 [details] Patch Clearing flags on attachment: 365844 Committed r243448: <https://trac.webkit.org/changeset/243448>
All reviewed patches have been landed. Closing bug.