[Webkit-unassigned] [Bug 122618] New: Assertion on (seemingly) simple test case

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=122618

           Summary: Assertion on (seemingly) simple test case
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: oliver at apple.com
                CC: fpizlo at apple.com


DFG codeine is  asserting when run in a debug build on this test case:
if (!this.alert)
    log=print;
else
    log=alert;
var array = [];
for (var i =0; i < 1000; i++)
    array.push(i)
function f(array) { var i = 0; for (var a of array) (i+=a); }
var start = new Date;
var k =0;
for (var i = 0 ; i < 100000; i++)
    k = k | f(array)
var end = new Date;
log(k + ": " + (end-start))

run in the jsc prompt

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.