Created attachment 148759 [details] Crash log for DumpRenderTree After revision r120897 <http://trac.webkit.org/changeset/r120897>, the test crashes at the following assertion: ASSERT(isCellSpeculation(value.m_type)); in the JSC::DFG::AbstractState::execute method of Source/JavaScriptCore/dfg/DFGAbstractState.cpp This test currently fails in GTK Linux 64bits Debug bot (see http://build.webkit.org/builders/GTK%20Linux%2064-bit%20Debug/builds/34242/steps/layout-test/logs/stdio), but passes on EFL Linux 64-bit Debug bot, as seen in http://build.webkit.org/builders/EFL%20Linux%2064-bit%20Debug/builds/1701/steps/layout-test/logs/stdio
Looks like a legitimate bug. I will investigate.
Can someone from GTK+ put a value.dump(stdout) or value.dump(WTF::dataFile()) or something statement, preferably conditional on the "assertion" failing. And post the resulting log output here. That way I can see what is going on.
(In reply to comment #1) > Looks like a legitimate bug. I will investigate. It seems you already fixed this in r121215 <http://trac.webkit.org/changeset/r121215>, when the assertion was modified to be ASSERT(value.isClear() || isCellSpeculation(value.m_type)); // Value could be clear if we've proven must-exit due to a speculation statically known to be bad. So this bug is already fixed. I'll be confirming that the debug bot now passes the test fast/canvas/canvas-createImageData.html, but you shouldn't need to do anything else. Thanks!
(In reply to comment #3) > [...] > So this bug is already fixed. I'll be confirming that the debug bot now passes the test fast/canvas/canvas-createImageData.html, but you shouldn't need to do anything else. Thanks! Yes, the bot passes the test, so I'll remove its crash from the TestExpectations.
Created attachment 149488 [details] Patch
Comment on attachment 149488 [details] Patch Rejecting attachment 149488 [details] from commit-queue. Failed to run "['/mnt/git/webkit-commit-queue/Tools/Scripts/webkit-patch', '--status-host=queues.webkit.org', '-..." exit_code: 2 Last 500 characters of output: s/Scripts/svn-apply', u'--force']" exit_code: 1 cwd: /mnt/git/webkit-commit-queue/ Parsed 2 diffs from patch file(s). patching file LayoutTests/ChangeLog Hunk #1 succeeded at 1 with fuzz 3. patching file LayoutTests/platform/gtk/TestExpectations Hunk #1 FAILED at 360. 1 out of 1 hunk FAILED -- saving rejects to file LayoutTests/platform/gtk/TestExpectations.rej Failed to run "[u'/mnt/git/webkit-commit-queue/Tools/Scripts/svn-apply', u'--force']" exit_code: 1 cwd: /mnt/git/webkit-commit-queue/ Full output: http://queues.webkit.org/results/13090443
Created attachment 149494 [details] Patch
(In reply to comment #7) > Created an attachment (id=149494) [details] > Patch Rebased against latest TestExpectations
Comment on attachment 149494 [details] Patch Clearing flags on attachment: 149494 Committed r121252: <http://trac.webkit.org/changeset/121252>
All reviewed patches have been landed. Closing bug.