Title: [243448] trunk
- Revision
- 243448
- Author
- [email protected]
- Date
- 2019-03-25 13:29:19 -0700 (Mon, 25 Mar 2019)
Log Message
ASSERTION FAILED: m_op == CompareStrictEq in JSC::DFG::Node::convertToCompareEqPtr(JSC::DFG::FrozenValue *, JSC::DFG::Edge)
https://bugs.webkit.org/show_bug.cgi?id=196176
Reviewed by Saam Barati.
JSTests:
* stress/object-is-fold-to-compare-eq-ptr.js: Added.
(main.v10):
(main):
Source/_javascript_Core:
convertToCompareEqPtr should allow for either CompareStrictEq or
the SameValue DFG node. This fixes the old assertion that only
allowed CompareStrictEq.
* dfg/DFGNode.h:
(JSC::DFG::Node::convertToCompareEqPtr):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (243447 => 243448)
--- trunk/JSTests/ChangeLog 2019-03-25 20:23:43 UTC (rev 243447)
+++ trunk/JSTests/ChangeLog 2019-03-25 20:29:19 UTC (rev 243448)
@@ -1,3 +1,14 @@
+2019-03-25 Keith Miller <[email protected]>
+
+ ASSERTION FAILED: m_op == CompareStrictEq in JSC::DFG::Node::convertToCompareEqPtr(JSC::DFG::FrozenValue *, JSC::DFG::Edge)
+ https://bugs.webkit.org/show_bug.cgi?id=196176
+
+ Reviewed by Saam Barati.
+
+ * stress/object-is-fold-to-compare-eq-ptr.js: Added.
+ (main.v10):
+ (main):
+
2019-03-25 Tadeu Zagallo <[email protected]>
WebAssembly: f32.max with NaN generates incorrect result
Added: trunk/JSTests/stress/object-is-fold-to-compare-eq-ptr.js (0 => 243448)
--- trunk/JSTests/stress/object-is-fold-to-compare-eq-ptr.js (rev 0)
+++ trunk/JSTests/stress/object-is-fold-to-compare-eq-ptr.js 2019-03-25 20:29:19 UTC (rev 243448)
@@ -0,0 +1,26 @@
+function main() {
+const v3 = [1337,1337,13.37,1337];
+const v5 = [1337,13.37,1337,1337,1337,1337,13.37,1337,1337,1337];
+const v8 = {getInt8:13.37};
+const v9 = Object();
+function v10(v11,v12,v13,v14) {
+ for (const v15 of v5) {
+ for (const v16 of v11) {
+ let v18 = v8;
+ do {
+ const v20 = Object.is(0,v18);
+ const v22 = ["name"];
+ for (let v25 = 0; v25 < 100; v25++) {
+ const v26 = v25[100];
+ }
+ const v27 = v22 + 1;
+ v18 = v27;
+ } while (v18 < -9007199254740991);
+ }
+ }
+}
+const v28 = v10(v3,v9);
+}
+noDFG(main);
+noFTL(main);
+main();
Modified: trunk/Source/_javascript_Core/ChangeLog (243447 => 243448)
--- trunk/Source/_javascript_Core/ChangeLog 2019-03-25 20:23:43 UTC (rev 243447)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-03-25 20:29:19 UTC (rev 243448)
@@ -1,3 +1,17 @@
+2019-03-25 Keith Miller <[email protected]>
+
+ ASSERTION FAILED: m_op == CompareStrictEq in JSC::DFG::Node::convertToCompareEqPtr(JSC::DFG::FrozenValue *, JSC::DFG::Edge)
+ https://bugs.webkit.org/show_bug.cgi?id=196176
+
+ Reviewed by Saam Barati.
+
+ convertToCompareEqPtr should allow for either CompareStrictEq or
+ the SameValue DFG node. This fixes the old assertion that only
+ allowed CompareStrictEq.
+
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::convertToCompareEqPtr):
+
2019-03-25 Tadeu Zagallo <[email protected]>
WebAssembly: f32.max with NaN generates incorrect result
Modified: trunk/Source/_javascript_Core/dfg/DFGNode.h (243447 => 243448)
--- trunk/Source/_javascript_Core/dfg/DFGNode.h 2019-03-25 20:23:43 UTC (rev 243447)
+++ trunk/Source/_javascript_Core/dfg/DFGNode.h 2019-03-25 20:29:19 UTC (rev 243448)
@@ -710,7 +710,7 @@
void convertToCompareEqPtr(FrozenValue* cell, Edge node)
{
- ASSERT(m_op == CompareStrictEq);
+ ASSERT(m_op == CompareStrictEq || m_op == SameValue);
setOpAndDefaultFlags(CompareEqPtr);
children.setChild1(node);
children.setChild2(Edge());
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
