[Webkit-unassigned] [Bug 176470] New: ASSERTION FAILED: op() == CheckStructure in Source/JavaScriptCore/dfg/DFGNode.h(443)
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Wed Sep 6 11:02:38 PDT 2017
https://bugs.webkit.org/show_bug.cgi?id=176470
Bug ID: 176470
Summary: ASSERTION FAILED: op() == CheckStructure in
Source/JavaScriptCore/dfg/DFGNode.h(443)
Product: WebKit
Version: WebKit Nightly Build
Hardware: Unspecified
OS: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: JavaScriptCore
Assignee: webkit-unassigned at lists.webkit.org
Reporter: jlewis3 at apple.com
CC: mark.lam at apple.com, ryanhaddad at apple.com
The test stress/phantom-spread-forward-varargs.js.ftl-eager has had a flaky assertion failure on El Capitan JSC Debug testers
ASSERTION FAILED: op() == CheckStructure
/Volumes/Data/slave/elcapitan-debug/build/Source/JavaScriptCore/dfg/DFGNode.h(443) : void JSC::DFG::Node::convertToCheckStructureImmediate(JSC::DFG::Node *)
1 0x1066ecd40 WTFCrash
2 0x105b04ec0 JSC::DFG::Node::convertToCheckStructureImmediate(JSC::DFG::Node*)
3 0x105afa3be void JSC::DFG::(anonymous namespace)::ObjectAllocationSinkingPhase::handleNode<JSC::DFG::(anonymous namespace)::ObjectAllocationSinkingPhase::promoteLocalHeap()::'lambda1'(JSC::DFG::PromotedHeapLocation, JSC::DFG::LazyNode), JSC::DFG::(anonymous namespace)::ObjectAllocationSinkingPhase::promoteLocalHeap()::'lambda1'(JSC::DFG::PromotedHeapLocation)>(JSC::DFG::Node*, JSC::DFG::(anonymous namespace)::ObjectAllocationSinkingPhase::promoteLocalHeap()::'lambda1'(JSC::DFG::PromotedHeapLocation, JSC::DFG::LazyNode) const&, JSC::DFG::(anonymous namespace)::ObjectAllocationSinkingPhase::promoteLocalHeap()::'lambda1'(JSC::DFG::PromotedHeapLocation) const&)
4 0x105ae0338 JSC::DFG::(anonymous namespace)::ObjectAllocationSinkingPhase::promoteLocalHeap()
5 0x105adcc03 JSC::DFG::(anonymous namespace)::ObjectAllocationSinkingPhase::performSinking()
6 0x105adc852 JSC::DFG::(anonymous namespace)::ObjectAllocationSinkingPhase::run()
7 0x105adc2a2 bool JSC::DFG::runAndLog<JSC::DFG::(anonymous namespace)::ObjectAllocationSinkingPhase>(JSC::DFG::(anonymous namespace)::ObjectAllocationSinkingPhase&)
8 0x105adc1fe bool JSC::DFG::runPhase<JSC::DFG::(anonymous namespace)::ObjectAllocationSinkingPhase>(JSC::DFG::Graph&)
9 0x105adc1c5 JSC::DFG::performObjectAllocationSinking(JSC::DFG::Graph&)
10 0x105b90c58 JSC::DFG::Plan::compileInThreadImpl()
11 0x105b8cc5d JSC::DFG::Plan::compileInThread(JSC::DFG::ThreadData*)
12 0x105d1fece JSC::DFG::Worklist::ThreadBody::work()
13 0x1066fa82e WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0::operator()() const
14 0x1066fa50c WTF::Function<void ()>::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0>::call()
15 0x10672647e WTF::Function<void ()>::operator()() const
16 0x106775f0a WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*)
17 0x10677b8f5 WTF::wtfThreadEntryPoint(void*)
18 0x7fff8513b99d _pthread_body
19 0x7fff8513b91a _pthread_body
20 0x7fff85139351 thread_start
test_script_16221: line 2: 33007 Segmentation fault: 11 ( "$@" ../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --useFunctionDotArguments\=true --maxPerThreadStackUsage\=1572864 --airForceBriggsAllocator\=true --useFTLJIT\=true --thresholdForJITAfterWarmUp\=10 --thresholdForJITSoon\=10 --thresholdForOptimizeAfterWarmUp\=20 --thresholdForOptimizeAfterLongWarmUp\=20 --thresholdForOptimizeSoon\=20 --thresholdForFTLOptimizeAfterWarmUp\=20 --thresholdForFTLOptimizeSoon\=20 --maximumEvalCacheableSourceLength\=150000 --useEagerCodeBlockJettisonTiming\=true phantom-spread-forward-varargs.js )
ERROR: Unexpected exit code: 139
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20170906/0ea8f87f/attachment.html>
More information about the webkit-unassigned
mailing list