Created attachment 435014 [details]
ASSERTION FAILED: typeFilterFor(node->child1().useKind()) & SpecEmpty
It happens because in 32 bits empty value doesn't pass the cell check. From SpeculatedType.h:
static constexpr SpeculatedType SpecCellCheck = is64Bit() ? (SpecCell | SpecEmpty) : SpecCell;
So when we reach the assertion, SpecEmpty is not set.
There is no assertion failure when running jsc in release mode.
Created attachment 435018 [details]
Comment on attachment 435018 [details]
Committed r280716 (240307@main): <https://commits.webkit.org/240307@main>
All reviewed patches have been landed. Closing bug and clearing flags on attachment 435018 [details].