[Webkit-unassigned] [Bug 123778] internal-js-tests.yaml/Octane/stress-tests/pdfjs.js.default: ASSERTION FAILED: m_state.forNode(child).m_futurePossibleStructure.isSubsetOf(StructureSet(structure)) at DFGConstantFoldingPhase.cpp:249

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=123778





--- Comment #1 from Filip Pizlo <fpizlo at apple.com>  2013-11-04 20:18:53 PST ---
Heh, this is obviously a wrong assertion.  We do an execute() above it.  It is asserting that if we need a watchpoint (i.e. the best proven structure was not the current structure) then it must be the future possible structure.  But while that may have been true before execute(), it won't be true after.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.