[Webkit-unassigned] [Bug 143102] New: REGRESSION (181992-182000): Dromaeo/jslib-modify-prototype.html perf test fails with a JSC release assertion

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=143102

            Bug ID: 143102
           Summary: REGRESSION (181992-182000):
                    Dromaeo/jslib-modify-prototype.html perf test fails
                    with a JSC release assertion
    Classification: Unclassified
           Product: WebKit
           Version: 528+ (Nightly build)
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: ap at webkit.org
                CC: fpizlo at apple.com, ggaren at apple.com, rniwa at webkit.org,
                    slewis at apple.com, webkit-bug-importer at group.apple.com

Presumably due to http://trac.webkit.org/changeset/181993 ?

Running Dromaeo/jslib-modify-prototype.html (65 of 144)
error: Dromaeo/jslib-modify-prototype.html
Assertion failed: (getOperand(0)->getType() == getOperand(1)->getType() && "Both operands to ICmp instruction are not of the same type!"), function AssertOK, file /private/tmp/LLVM/include/llvm/IR/Instructions.h, line 973.
1   0x1120031b0 abort
2   0x11207d7dd llvm::ICmpInst::ICmpInst(llvm::CmpInst::Predicate, llvm::Value*, llvm::Value*, llvm::Twine const&)
3   0x11207d5ef llvm::IRBuilder<true, llvm::ConstantFolder, llvm::IRBuilderDefaultInserter<true> >::CreateICmp(llvm::CmpInst::Predicate, llvm::Value*, llvm::Value*, llvm::Twine const&)
4   0x112782489 LLVMBuildICmp
5   0x1062370f8 JSC::FTL::LowerDFGToLLVM::compileGetArrayLength()
6   0x10622d3e5 JSC::FTL::LowerDFGToLLVM::compileNode(unsigned int)
7   0x10622c9c8 JSC::FTL::LowerDFGToLLVM::compileBlock(JSC::DFG::BasicBlock*)
8   0x10622bbcb JSC::FTL::LowerDFGToLLVM::lower()
9   0x10622a4b9 JSC::FTL::lowerDFGToLLVM(JSC::FTL::State&)
10  0x106175afa JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&)
11  0x10617511d JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*)
12  0x1061fce72 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*)
13  0x1065a1dd3 WTF::threadEntryPoint(void*)
14  0x1065a22bf WTF::wtfThreadEntryPoint(void*)
15  0x7fff8e583268 _pthread_body
16  0x7fff8e5831e5 _pthread_body
17  0x7fff8e58141d thread_start

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150326/f527d250/attachment-0002.html>