[Webkit-unassigned] [Bug 119899] New: Link failure in DFG

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=119899

           Summary: Link failure in DFG
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Keywords: NeedsRadar
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: oliver at apple.com
                CC: ggaren at apple.com, oliver at apple.com,
                    webkit-bug-importer at group.apple.com, fpizlo at apple.com,
                    mhahnenberg at apple.com


x = 0;
function h() {
if (x.y++) 
  missing();
}
for (;;) try { h() } catch(e){}

Fails with this assertion:
1   0x10e556e30 WTFCrash
2   0x10e0cf13c JSC::X86Assembler::linkJump(JSC::AssemblerLabel, JSC::AssemblerLabel)
3   0x10e197129 JSC::AbstractMacroAssembler<JSC::X86Assembler>::Jump::linkTo(JSC::AbstractMacroAssembler<JSC::X86Assembler>::Label, JSC::AbstractMacroAssembler<JSC::X86Assembler>*) const
4   0x10e1e5c9c JSC::DFG::SpeculativeJIT::linkBranches()
5   0x10e1e5bdf JSC::DFG::SpeculativeJIT::compile()
6   0x10e191f94 JSC::DFG::JITCompiler::compileBody()
7   0x10e194134 JSC::DFG::JITCompiler::compileFunction()
8   0x10e1ca06b JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&)
9   0x10e1c9a46 JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&)
10  0x10e2690fc JSC::DFG::Worklist::runThread()
11  0x10e2681f5 JSC::DFG::Worklist::threadFunction(void*)
12  0x10e59ced0 WTF::threadEntryPoint(void*)
13  0x10e59d878 WTF::wtfThreadEntryPoint(void*)
14  0x7fff8c0848a9 _pthread_body
15  0x7fff8c08473a _pthread_struct_init
16  0x7fff8c088fd9 thread_start

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.