[Webkit-unassigned] [Bug 182249] New: REGRESSION (r227341): DFG_ASSERT failure at JSC::DFG::AtTailAbstractState::forNode()
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Mon Jan 29 10:17:51 PST 2018
https://bugs.webkit.org/show_bug.cgi?id=182249
Bug ID: 182249
Summary: REGRESSION (r227341): DFG_ASSERT failure at
JSC::DFG::AtTailAbstractState::forNode()
Product: WebKit
Version: WebKit Nightly Build
Hardware: Unspecified
OS: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: JavaScriptCore
Assignee: webkit-unassigned at lists.webkit.org
Reporter: msaboff at apple.com
Change set r227341 (<https://trac.webkit.org/changeset/227341>) changed the abstract interpreter for the non-strict Compare nodes like CompareEq. That change caused a DFG_ASSERT() to fire:
DFG ASSERTION FAILED: iter != valuesAtTail.end()
./dfg/DFGAtTailAbstractState.cpp(59) : JSC::DFG::AbstractValue &JSC::DFG::AtTailAbstractState::forNode(JSC::DFG::NodeFlowProjection)
There needs to be a corresponding change in clobberize() for UntypedUse as well.
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180129/8d4b6c2b/attachment.html>
More information about the webkit-unassigned
mailing list