ASSERTION FAILED: m_op == CompareStrictEq in JSC::DFG::Node::convertToCompareEqPtr...
authorkeith_miller@apple.com <keith_miller@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 25 Mar 2019 20:29:19 +0000 (20:29 +0000)
committerkeith_miller@apple.com <keith_miller@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 25 Mar 2019 20:29:19 +0000 (20:29 +0000)
https://bugs.webkit.org/show_bug.cgi?id=196176

Reviewed by Saam Barati.

JSTests:

* stress/object-is-fold-to-compare-eq-ptr.js: Added.
(main.v10):
(main):

Source/JavaScriptCore:

convertToCompareEqPtr should allow for either CompareStrictEq or
the SameValue DFG node. This fixes the old assertion that only
allowed CompareStrictEq.

* dfg/DFGNode.h:
(JSC::DFG::Node::convertToCompareEqPtr):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243448 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JSTests/ChangeLog
JSTests/stress/object-is-fold-to-compare-eq-ptr.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGNode.h

index a0e4ce4..fbde1de 100644 (file)
@@ -1,3 +1,14 @@
+2019-03-25  Keith Miller  <keith_miller@apple.com>
+
+        ASSERTION FAILED: m_op == CompareStrictEq in JSC::DFG::Node::convertToCompareEqPtr(JSC::DFG::FrozenValue *, JSC::DFG::Edge)
+        https://bugs.webkit.org/show_bug.cgi?id=196176
+
+        Reviewed by Saam Barati.
+
+        * stress/object-is-fold-to-compare-eq-ptr.js: Added.
+        (main.v10):
+        (main):
+
 2019-03-25  Tadeu Zagallo  <tzagallo@apple.com>
 
         WebAssembly: f32.max with NaN generates incorrect result
diff --git a/JSTests/stress/object-is-fold-to-compare-eq-ptr.js b/JSTests/stress/object-is-fold-to-compare-eq-ptr.js
new file mode 100644 (file)
index 0000000..9e14c84
--- /dev/null
@@ -0,0 +1,26 @@
+function main() {
+const v3 = [1337,1337,13.37,1337];
+const v5 = [1337,13.37,1337,1337,1337,1337,13.37,1337,1337,1337];
+const v8 = {getInt8:13.37};
+const v9 = Object();
+function v10(v11,v12,v13,v14) {
+    for (const v15 of v5) {
+        for (const v16 of v11) {
+            let v18 = v8;
+            do {
+                const v20 = Object.is(0,v18);
+                const v22 = ["name"];
+                for (let v25 = 0; v25 < 100; v25++) {
+                    const v26 = v25[100];
+                }
+                const v27 = v22 + 1;
+                v18 = v27;
+            } while (v18 < -9007199254740991);
+        }
+    }
+}
+const v28 = v10(v3,v9);
+}
+noDFG(main);
+noFTL(main);
+main();
index 912e3a9..53f8a9e 100644 (file)
@@ -1,3 +1,17 @@
+2019-03-25  Keith Miller  <keith_miller@apple.com>
+
+        ASSERTION FAILED: m_op == CompareStrictEq in JSC::DFG::Node::convertToCompareEqPtr(JSC::DFG::FrozenValue *, JSC::DFG::Edge)
+        https://bugs.webkit.org/show_bug.cgi?id=196176
+
+        Reviewed by Saam Barati.
+
+        convertToCompareEqPtr should allow for either CompareStrictEq or
+        the SameValue DFG node. This fixes the old assertion that only
+        allowed CompareStrictEq.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToCompareEqPtr):
+
 2019-03-25  Tadeu Zagallo  <tzagallo@apple.com>
 
         WebAssembly: f32.max with NaN generates incorrect result
index 26cc731..e695292 100644 (file)
@@ -710,7 +710,7 @@ public:
 
     void convertToCompareEqPtr(FrozenValue* cell, Edge node)
     {
-        ASSERT(m_op == CompareStrictEq);
+        ASSERT(m_op == CompareStrictEq || m_op == SameValue);
         setOpAndDefaultFlags(CompareEqPtr);
         children.setChild1(node);
         children.setChild2(Edge());