[Webkit-unassigned] [Bug 87994] ASSERTION FAILED: m_refCount in DFG::Node:deref with patch from 87158

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=87994





--- Comment #3 from Andy Wingo <wingo at igalia.com>  2012-06-05 07:41:23 PST ---
The suspicious thing to me is this:

#6  0x00007ffff2088799 in JSC::DFG::CFGSimplificationPhase::fixPhis (this=0x7fffffffb560, sourceBlockIndex=10, destinationBlockIndex=10) at ../../Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp:392

That the source and destination block indexes are the same.  I wonder if this case is handled correctly.  Still investigating.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.