[Webkit-unassigned] [Bug 212430] [ macOS iOS ] REGRESSION(r261600?): imported/w3c/web-platform-tests/html/dom/reflection-embedded.html & imported/w3c/web-platform-tests/html/dom/reflection-forms.html are flaky failures

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=212430

--- Comment #5 from Yusuke Suzuki <ysuzuki at apple.com> ---
I think

        1736            case IsConstructor:
        1737                // FIXME: We can speculate constructability from child's m_structure.
        1738                // https://bugs.webkit.org/show_bug.cgi?id=211796
        1739                if (!(child.m_type & (SpecFunction | SpecProxyObject))) {
        1740                    setConstant(node, jsBoolean(false));
        1741                    constantWasSet = true;
        1742                    break;
        1743                }
        1744    
        1745                break;

this looks wrong in https://trac.webkit.org/changeset/261600/webkit. We do not have such an invariant.
This also explains why this failure is flaky: this is DFG / FTL code.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200527/301f1653/attachment.htm>