[Webkit-unassigned] [Bug 183172] New: DFG ASSERTION FAILED: arguments->op() == CreateDirectArguments ...

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=183172

            Bug ID: 183172
           Summary: DFG ASSERTION FAILED: arguments->op() ==
                    CreateDirectArguments ...
           Product: WebKit
           Version: WebKit Local Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: andre.bargull at gmail.com

SVN: rev228977
Build with: perl Tools/Scripts/build-jsc --jsc-only --debug


Executing the following test case leads to this assertion:
---
DFG ASSERTION FAILED: arguments->op() == CreateDirectArguments || arguments->op() == CreateScopedArguments || arguments->op() == CreateClonedArguments || arguments->op() == CreateRest || arguments->op() =
= NewArrayBuffer || arguments->op() == PhantomDirectArguments || arguments->op() == PhantomClonedArguments || arguments->op() == PhantomCreateRest || arguments->op() == PhantomNewArrayBuffer
../../Source/JavaScriptCore/dfg/DFGArgumentsUtilities.cpp(71) : JSC::DFG::Node* JSC::DFG::emitCodeToGetArgumentsArrayLength(JSC::DFG::InsertionSet&, JSC::DFG::Node*, unsigned int, JSC::DFG::NodeOrigin)
---


Test case:
---
function f() {
    var a = [1];
    for (var i = 0; i < 1000000; ++i) {
        [...a].length;
    }
}
f();
---

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180227/e3fbdc55/attachment.html>