[Webkit-unassigned] [Bug 211096] New: REGRESSION: ASSERTION FAILED: mode == ManualOperandSpeculation || edge.useKind() == UntypedUse seen on debug JSC bot

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=211096

            Bug ID: 211096
           Summary: REGRESSION: ASSERTION FAILED: mode ==
                    ManualOperandSpeculation || edge.useKind() ==
                    UntypedUse seen on debug JSC bot
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: ryanhaddad at apple.com

The following assertion failure is seen with microbenchmarks/sunspider-sha1-big-int.js on the debug JSC bot:

 ASSERTION FAILED: mode == ManualOperandSpeculation || edge.useKind() == UntypedUse
 /Volumes/Data/slave/catalina-debug/build/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h(1765) : JSC::DFG::JSValueOperand::JSValueOperand(JSC::DFG::SpeculativeJIT *, JSC::DFG::Edge, JSC::DFG::OperandSpeculationMode)
 1   0x10161da39 WTFCrash
 2   0x101d9ef1b WTFCrashWithInfo(int, char const*, char const*, int)
 3   0x1018202ed JSC::DFG::JSValueOperand::JSValueOperand(JSC::DFG::SpeculativeJIT*, JSC::DFG::Edge, JSC::DFG::OperandSpeculationMode)
 4   0x1017945bb JSC::DFG::JSValueOperand::JSValueOperand(JSC::DFG::SpeculativeJIT*, JSC::DFG::Edge, JSC::DFG::OperandSpeculationMode)
 5   0x10179b419 JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch(JSC::DFG::Node*, JSC::DFG::Node*, JSC::MacroAssemblerX86Common::RelationalCondition, unsigned long (*)(JSC::JSGlobalObject*, long long, long long))
 6   0x10179b075 JSC::DFG::SpeculativeJIT::compilePeepHoleBranch(JSC::DFG::Node*, JSC::MacroAssemblerX86Common::RelationalCondition, JSC::MacroAssemblerX86Common::DoubleCondition, unsigned long (*)(JSC::JSGlobalObject*, long long, long long))
 7   0x1017c2c28 JSC::DFG::SpeculativeJIT::compare(JSC::DFG::Node*, JSC::MacroAssemblerX86Common::RelationalCondition, JSC::MacroAssemblerX86Common::DoubleCondition, unsigned long (*)(JSC::JSGlobalObject*, long long, long long))
 8   0x10196ff0b JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node*)
 9   0x10179c91a JSC::DFG::SpeculativeJIT::compileCurrentBlock()
 10  0x10179e688 JSC::DFG::SpeculativeJIT::compile()
 11  0x1024f99c6 JSC::DFG::JITCompiler::compileBody()
 12  0x1024fcc07 JSC::DFG::JITCompiler::compileFunction()
 13  0x1025aaecd JSC::DFG::Plan::compileInThreadImpl()
 14  0x1025a87c8 JSC::DFG::Plan::compileInThread(JSC::DFG::ThreadData*)
 15  0x10270929e JSC::DFG::Worklist::ThreadBody::work()
 16  0x1016344b3 WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0::operator()() const
 17  0x10163409e WTF::Detail::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0, void>::call()
 18  0x101648012 WTF::Function<void ()>::operator()() const
 19  0x1016ffcc8 WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*)
 20  0x10170d158 WTF::wtfThreadEntryPoint(void*)
 21  0x7fff68d17109 _pthread_start
 22  0x7fff68d12b8b thread_start

https://build.webkit.org/builders/Apple-Catalina-Debug-JSC-Tests/builds/765/steps/jscore-test/logs/stdio

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200427/274ef1ad/attachment-0001.htm>