[Webkit-unassigned] [Bug 209777] New: ASSERTION FAILED: m_cases[i - 1] < m_cases[I] due to DeleteIC.
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Mon Mar 30 14:49:20 PDT 2020
https://bugs.webkit.org/show_bug.cgi?id=209777
Bug ID: 209777
Summary: ASSERTION FAILED: m_cases[i - 1] < m_cases[I] due to
DeleteIC.
Product: WebKit
Version: WebKit Nightly Build
Hardware: Unspecified
OS: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: JavaScriptCore
Assignee: webkit-unassigned at lists.webkit.org
Reporter: mark.lam at apple.com
We're seeing a ASSERTION FAILED: m_cases[i - 1] < m_cases[I] due to DeleteIC. Here's the test case:
function foo() {
let j = 0;
while (j++ < 2)
delete this.x;
Object.defineProperty(this, "x", {});
}
for (let i = 0; i < 5; i++)
foo();
Run with --jitPolicyScale=0 --useDFGJIT=0 --useConcurrentJIT=0.
The duplicate cases are:
DeleteMiss:(Committed, ident = 'uid:(x)', structure = 0x10c4faee0:[0xf4c5, JSProxy, {}, NonArray, Proto:0x106dfa368, Leaf])
DeleteNonConfigurable:(Committed, ident = 'uid:(x)', structure = 0x10c4faee0:[0xf4c5, JSProxy, {}, NonArray, Proto:0x106dfa368, Leaf])
<rdar://problem/61051902>
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200330/edbf732a/attachment.htm>
More information about the webkit-unassigned
mailing list