[Webkit-unassigned] [Bug 172673] New: Assertion failure in com.apple.WebKit.WebContent.Development in com.apple.JavaScriptCore: JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined + 141

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=172673

            Bug ID: 172673
           Summary: Assertion failure in
                    com.apple.WebKit.WebContent.Development in
                    com.apple.JavaScriptCore:
                    JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch
                    NullOrUndefined + 141
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: ryanhaddad at apple.com

This assertion failure is seen with imported/w3c/web-platform-tests/streams/readable-streams/general.html

https://build.webkit.org/results/Apple%20El%20Capitan%20Debug%20WK1%20(Tests)/r217506%20(1488)/results.html

https://webkit-test-results.webkit.org/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=imported%2Fw3c%2Fweb-platform-tests%2Fstreams%2Freadable-streams%2Fgeneral.html

ASSERTION FAILED: The Compare should have been eliminated, it is known to be always false.
!masqueradesAsUndefinedWatchpointIsStillValid() || !isKnownCell(operand.node())
/Volumes/Data/slave/elcapitan-debug/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp(305) : void JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined(JSC::DFG::Edge, JSC::DFG::Node *)
1   0x103817ae0 WTFCrash
2   0x102d7c53d JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined(JSC::DFG::Edge, JSC::DFG::Node*)
3   0x102cf4b26 JSC::DFG::SpeculativeJIT::compilePeepHoleBranch(JSC::DFG::Node*, JSC::MacroAssemblerX86Common::RelationalCondition, JSC::MacroAssemblerX86Common::DoubleCondition, unsigned long (*)(JSC::ExecState*, long long, long long))
4   0x102d082d6 JSC::DFG::SpeculativeJIT::compare(JSC::DFG::Node*, JSC::MacroAssemblerX86Common::RelationalCondition, JSC::MacroAssemblerX86Common::DoubleCondition, unsigned long (*)(JSC::ExecState*, long long, long long))
5   0x102d89260 JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node*)
6   0x102cf5603 JSC::DFG::SpeculativeJIT::compileCurrentBlock()
7   0x102cf5dd6 JSC::DFG::SpeculativeJIT::compile()
8   0x102ba9ff7 JSC::DFG::JITCompiler::compileBody()
9   0x102bade25 JSC::DFG::JITCompiler::compileFunction()
10  0x102ca7155 JSC::DFG::Plan::compileInThreadImpl()
11  0x102ca445d JSC::DFG::Plan::compileInThread(JSC::DFG::ThreadData*)
12  0x102e2b69e JSC::DFG::Worklist::ThreadBody::work()
13  0x10382544e WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0::operator()() const
14  0x1038251dd void std::__1::__invoke_void_return_wrapper<void>::__call<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0&>(WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0&&&)
15  0x103824fcc std::__1::__function::__func<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0, std::__1::allocator<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0>, void ()>::operator()()
16  0x102d2608a std::__1::function<void ()>::operator()() const
17  0x10389c4ae WTF::threadEntryPoint(void*)
18  0x10389e636 WTF::wtfThreadEntryPoint(void*)
19  0x7fff8bde499d _pthread_body
20  0x7fff8bde491a _pthread_body
21  0x7fff8bde2351 thread_start

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20170527/392a7f5c/attachment.html>