[Webkit-unassigned] [Bug 182249] New: REGRESSION (r227341): DFG_ASSERT failure at JSC::DFG::AtTailAbstractState::forNode()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=182249

            Bug ID: 182249
           Summary: REGRESSION (r227341): DFG_ASSERT failure at
                    JSC::DFG::AtTailAbstractState::forNode()
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: msaboff at apple.com

Change set r227341 (<https://trac.webkit.org/changeset/227341>) changed the abstract interpreter for the non-strict Compare nodes like CompareEq.  That change caused a DFG_ASSERT() to fire:

DFG ASSERTION FAILED: iter != valuesAtTail.end()
./dfg/DFGAtTailAbstractState.cpp(59) : JSC::DFG::AbstractValue &JSC::DFG::AtTailAbstractState::forNode(JSC::DFG::NodeFlowProjection)

There needs to be a corresponding change in clobberize() for UntypedUse as well.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180129/8d4b6c2b/attachment.html>