[Webkit-unassigned] [Bug 87994] ASSERTION FAILED: m_refCount in DFG::Node:deref with patch from 87158
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Tue Jun 5 07:41:24 PDT 2012
https://bugs.webkit.org/show_bug.cgi?id=87994
--- Comment #3 from Andy Wingo <wingo at igalia.com> 2012-06-05 07:41:23 PST ---
The suspicious thing to me is this:
#6 0x00007ffff2088799 in JSC::DFG::CFGSimplificationPhase::fixPhis (this=0x7fffffffb560, sourceBlockIndex=10, destinationBlockIndex=10) at ../../Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp:392
That the source and destination block indexes are the same. I wonder if this case is handled correctly. Still investigating.
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list