[Webkit-unassigned] [Bug 255715] New: Aborted at Source/JavaScriptCore/dfg/DFGValidate.cpp(156) : void JSC::DFG::{anonymous}::Validate::validate()
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Thu Apr 20 02:22:01 PDT 2023
https://bugs.webkit.org/show_bug.cgi?id=255715
Bug ID: 255715
Summary: Aborted at
Source/JavaScriptCore/dfg/DFGValidate.cpp(156) : void
JSC::DFG::{anonymous}::Validate::validate()
Product: WebKit
Version: WebKit Nightly Build
Hardware: Unspecified
OS: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: JavaScriptCore
Assignee: webkit-unassigned at lists.webkit.org
Reporter: xiangwei1895 at gmail.com
## JavaScriptCore Version
dd75c5c12d617264cfc1e26a70c94591e4eb67c1
## Build
Ubuntu 20.04.2 LTS (Linux 5.15.0-67-generic x86_64)
## Testcase and Execution steps
```
function f0() {
for (let i = 0; i < 1e5; i++) {;}
}
v0 = {value: 0};
function f1() {
var v1 = Object.defineProperties([0], {0: v0});
for ( _ in v1) {
f0(v1[i]);
++v1[ f1 (i in v1) ];
if (i === "0")
Object.defineProperties(v1, {0: v0});
}
}
for (var i = 0; i < 1e5; ++i)
f1();
```
./bin/jsc testcase.js
## Output
At D at 178 -> Check:Untyped:Kill:D at 76: validation failed: edge->hasResult() (/home/WebKit/Source/JavaScriptCore/dfg/DFGValidate.cpp:156).
At time of failure:
54: DFG for f1#<no-hash>:[0x62d0000d48e0->0x62d0000d4340->0x62d000069880, DFGFunctionCall, 276 (DidTryToEnterInLoop)]:
54: Fixpoint state: FixpointConverged; Form: SSA; Unification state: GloballyUnified; Ref count state: ExactRefCount
54: Argument formats for entrypoint index: 0 : FlushedJSValue
0 54: Block #0 (bc#0): (OSR target)
0 54: Execution count: 1.000000
……
ASSERTION FAILED: edge->hasResult()
/home/WebKit/Source/JavaScriptCore/dfg/DFGValidate.cpp(156) : void JSC::DFG::{anonymous}::Validate::validate()
Aborted
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20230420/9d820cc7/attachment.htm>
More information about the webkit-unassigned
mailing list