[Webkit-unassigned] [Bug 114129] New: Assertion hit in JSC::DFG::SpeculativeJIT::fillSpeculateCell()
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Sun Apr 7 12:53:31 PDT 2013
https://bugs.webkit.org/show_bug.cgi?id=114129
Summary: Assertion hit in
JSC::DFG::SpeculativeJIT::fillSpeculateCell()
Product: WebKit
Version: 528+ (Nightly build)
Platform: Unspecified
OS/Version: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: JavaScriptCore
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: dchris at gmail.com
CC: ggaren at apple.com, fpizlo at apple.com
The following test cases are hitting an assertion on the EFL build bots:
webgl/conformance/textures/tex-image-with-format-and-type.html
fast/canvas/webgl/tex-image-with-format-and-type.html
crash log for WebProcess (pid <unknown>):
STDOUT: <empty>
STDERR: ASSERTION FAILED: (edge.useKind() != KnownCellUse && edge.useKind() != KnownStringUse) || !(value.m_type & ~SpecCell)
STDERR: /home/buildslave-1/webkit-buildslave/efl-linux-64-debug-wk2/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp(1128) : JSC::DFG::GPRReg JSC::DFG::SpeculativeJIT::fillSpeculateCell(JSC::DFG::Edge)
STDERR: 1 0x7f223d4a178c JSC::DFG::SpeculativeJIT::fillSpeculateCell(JSC::DFG::Edge)
STDERR: 2 0x7f223d48ef80 JSC::DFG::SpeculateCellOperand::gpr()
STDERR: 3 0x7f223d4b1a9c JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node*)
STDERR: 4 0x7f223d4789b7 JSC::DFG::SpeculativeJIT::compile(JSC::DFG::BasicBlock&)
STDERR: 5 0x7f223d47911f JSC::DFG::SpeculativeJIT::compile()
STDERR: 6 0x7f223d445a4c JSC::DFG::JITCompiler::compileBody(JSC::DFG::SpeculativeJIT&)
STDERR: 7 0x7f223d446c79 JSC::DFG::JITCompiler::compileFunction(JSC::JITCode&, JSC::MacroAssemblerCodePtr&)
STDERR: 8 0x7f223d433770 JSC::DFG::compile(JSC::DFG::CompileMode, JSC::ExecState*, JSC::CodeBlock*, JSC::JITCode&, JSC::MacroAssemblerCodePtr*, unsigned int)
STDERR: 9 0x7f223d432ff4 JSC::DFG::tryCompileFunction(JSC::ExecState*, JSC::CodeBlock*, JSC::JITCode&, JSC::MacroAssemblerCodePtr&, unsigned int)
STDERR: 10 0x7f223d5f5baf JSC::jitCompileFunctionIfAppropriate(JSC::ExecState*, WTF::OwnPtr<JSC::FunctionCodeBlock>&, JSC::JITCode&, JSC::MacroAssemblerCodePtr&, JSC::JITCode::JITType, unsigned int, JSC::JITCompilationEffort)
STDERR: 11 0x7f223d5f5ea4 JSC::prepareFunctionForExecution(JSC::ExecState*, WTF::OwnPtr<JSC::FunctionCodeBlock>&, JSC::JITCode&, JSC::MacroAssemblerCodePtr&, JSC::JITCode::JITType, unsigned int, JSC::CodeSpecializationKind)
STDERR: 12 0x7f223d5f4354 JSC::FunctionExecutable::compileForConstructInternal(JSC::ExecState*, JSC::JSScope*, JSC::JITCode::JITType, unsigned int)
STDERR: 13 0x7f223d5f39ab JSC::FunctionExecutable::compileOptimizedForConstruct(JSC::ExecState*, JSC::JSScope*, unsigned int)
STDERR: 14 0x7f223d343da7 JSC::FunctionExecutable::compileOptimizedFor(JSC::ExecState*, JSC::JSScope*, unsigned int, JSC::CodeSpecializationKind)
STDERR: 15 0x7f223d33dcd2 JSC::FunctionCodeBlock::compileOptimized(JSC::ExecState*, JSC::JSScope*, unsigned int)
STDERR: 16 0x7f223d5486b9
STDERR: 17 0x7f223d5456c7
STDERR: 18 0x7f20e3bf0060
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list