[Webkit-unassigned] [Bug 273854] New: [Win][JSC] REGRESSION(278477 at main): crashing in operationPutByValSloppyOptimize of JITOperations.cpp

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=273854

            Bug ID: 273854
           Summary: [Win][JSC] REGRESSION(278477 at main): crashing in
                    operationPutByValSloppyOptimize of JITOperations.cpp
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: Hironori.Fujii at sony.com

[Win][JSC] REGRESSION(278477 at main): crashing in operationPutByValSloppyOptimize of JITOperations.cpp

After 278477 at main, Windows port is crashing.

00 0000003b`110fd060 000001d1`80002ca4     JavaScriptCore!operationPutByValSloppyOptimize(int64 encodedBaseValue = 0n2000416968128, int64 encodedSubscript = 0n2000417086208, int64 encodedValue = 0n2000384729672, class JSC::JSGlobalObject * globalObject = 0x000001d1`c22a6270, class JSC::StructureStubInfo * stubInfo = 0x000001d1`c03fceac, class JSC::ArrayProfile * profile = 0x000001d1`fc3283a0)+0x6f [C:\webkit\build\Source\JavaScriptCore\jit\JITOperations.cpp @ 1751]
01 0000003b`110fd1a0 0000bd9e`1ddb6d6f     0x000001d1`80002ca4
02 0000003b`110fd1a8 000001d1`8000301a     0x0000bd9e`1ddb6d6f
03 0000003b`110fd1b0 fffffff9`c2278a00     0x000001d1`8000301a

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20240508/560a94ca/attachment-0001.htm>