fast/js/dfg-dead-min-one-arg.html

gistfile1.txt

(32bit)azbest@cute4:~/32bit/WebKit$ ../run-in-xvfb.sh gdb WebKitBuild/Debug/bin/DumpRenderTree 
GNU gdb (Ubuntu/Linaro 7.4-2012.02-0ubuntu2) 7.4-2012.02
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i686-linux-gnu".
For bug reporting instructions, please see:
<http://bugs.launchpad.net/gdb-linaro/>...
Reading symbols from /home/azbest/32bit/WebKit/WebKitBuild/Debug/bin/DumpRenderTree...done.
(gdb) run fast/js/dfg-dead-min-one-arg.html
Starting program: /home/azbest/32bit/WebKit/WebKitBuild/Debug/bin/DumpRenderTree fast/js/dfg-dead-min-one-arg.html
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1".
[New Thread 0xf01b9b40 (LWP 23123)]
[New Thread 0xef7ffb40 (LWP 23125)]
[Thread 0xef7ffb40 (LWP 23125) exited]
[New Thread 0xef7ffb40 (LWP 23126)]
[New Thread 0xee945b40 (LWP 23127)]
ASSERTION FAILED: mode == ManualOperandSpeculation || edge.useKind() == UntypedUse
/home/azbest/32bit/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h(2393) : JSC::DFG::JSValueOperand::JSValueOperand(JSC::DFG::SpeculativeJIT*, JSC::DFG::Edge, JSC::DFG::OperandSpeculationMode)

Program received signal SIGSEGV, Segmentation fault.
0xf3470b19 in ?? () from /lib/i386-linux-gnu/libgcc_s.so.1
(gdb) bt
#0  0xf3470b19 in ?? () from /lib/i386-linux-gnu/libgcc_s.so.1
#1  0xf34716e1 in _Unwind_Backtrace () from /lib/i386-linux-gnu/libgcc_s.so.1
#2  0xf33b6007 in backtrace () from /lib/i386-linux-gnu/libc.so.6
#3  0xf62a9f05 in WTFGetBacktrace (stack=0xffff7058, size=0xffff70dc) at /home/azbest/32bit/WebKit/Source/WTF/wtf/Assertions.cpp:249
#4  0xf62a9f41 in WTFReportBacktrace () at /home/azbest/32bit/WebKit/Source/WTF/wtf/Assertions.cpp:278
#5  0xf60b1beb in JSC::DFG::JSValueOperand::JSValueOperand(JSC::DFG::SpeculativeJIT*, JSC::DFG::Edge, JSC::DFG::OperandSpeculationMode)
    () at /home/azbest/32bit/WebKit/Source/WTF/wtf/PrintStream.h:58
#6  0xf60a8bb3 in JSC::DFG::SpeculativeJIT::speculateNumber (this=0xffff96a0, edge=...)
    at /home/azbest/32bit/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:3947
#7  0xf60a9932 in JSC::DFG::SpeculativeJIT::speculate(JSC::DFG::Node*, JSC::DFG::Edge) ()
    at /home/azbest/32bit/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:4132
#8  0xf60db5ff in JSC::DFG::SpeculativeJIT::compile(JSC::DFG::Node*) ()
    at /home/azbest/32bit/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:4950
#9  0xf609dbbf in JSC::DFG::SpeculativeJIT::compile (this=0xffff96a0, block=0x819f968)
    at /home/azbest/32bit/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:1767
#10 0xf609e2a2 in JSC::DFG::SpeculativeJIT::compile (this=0xffff96a0)
    at /home/azbest/32bit/WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:1881
#11 0xf6069be3 in JSC::DFG::JITCompiler::compileBody (this=0xffffa8ec, speculative=0xffff96a0)
    at /home/azbest/32bit/WebKit/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp:108
#12 0xf606adb2 in JSC::DFG::JITCompiler::compileFunction(JSC::JITCode&, JSC::MacroAssemblerCodePtr&) ()
    at /home/azbest/32bit/WebKit/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp:302
#13 0xf605b6b6 in JSC::DFG::compile(JSC::DFG::CompileMode, JSC::ExecState*, JSC::CodeBlock*, JSC::JITCode&, JSC::MacroAssemblerCodePtr*, unsigned int) () at /home/azbest/32bit/WebKit/Source/WTF/wtf/PrintStream.h:58
#14 0xf605aeed in JSC::DFG::tryCompileFunction(JSC::ExecState*, JSC::CodeBlock*, JSC::JITCode&, JSC::MacroAssemblerCodePtr&, unsigned int) () at /home/azbest/32bit/WebKit/Source/JavaScriptCore/dfg/DFGDriver.cpp:189
#15 0xf61edba0 in JSC::jitCompileFunctionIfAppropriate(JSC::ExecState*, WTF::OwnPtr<JSC::FunctionCodeBlock>&, JSC::JITCode&, JSC::MacroAssemblerCodePtr&, JSC::JITCode::JITType, unsigned int, JSC::JITCompilationEffort) ()
    at /home/azbest/32bit/WebKit/Source/JavaScriptCore/bytecode/SpeculatedType.h:260
#16 0xf61ede5c in JSC::prepareFunctionForExecution(JSC::ExecState*, WTF::OwnPtr<JSC::FunctionCodeBlock>&, JSC::JITCode&, JSC::MacroAssemblerCodePtr&, JSC::JITCode::JITType, unsigned int, JSC::CodeSpecializationKind) ()
    at /home/azbest/32bit/WebKit/Source/JavaScriptCore/bytecode/SpeculatedType.h:260
#17 0xf61ec1cc in JSC::FunctionExecutable::compileForCallInternal (this=0xedfaebf8, exec=0xeea00158, scope=0xeef3f838, jitType=DFGJIT, 
    bytecodeIndex=<unknown type>) at /home/azbest/32bit/WebKit/Source/JavaScriptCore/runtime/Executable.cpp:538
#18 0xf61eb9dd in JSC::FunctionExecutable::compileOptimizedForCall (this=0xedfaebf8, exec=0xeea00158, scope=0xeef3f838, 
    bytecodeIndex=<unknown type>) at /home/azbest/32bit/WebKit/Source/JavaScriptCore/runtime/Executable.cpp:463
#19 0xf5f60fbc in JSC::FunctionExecutable::compileOptimizedFor(JSC::ExecState*, JSC::JSScope*, unsigned int, JSC::CodeSpecializationKind) () at /home/azbest/32bit/WebKit/Source/WTF/wtf/PrintStream.h:58
#20 0xf5f5bca1 in JSC::FunctionCodeBlock::compileOptimized (this=0x818e168, exec=0xeea00158, scope=0xeef3f838, 
    bytecodeIndex=<unknown type>) at /home/azbest/32bit/WebKit/Source/JavaScriptCore/bytecode/CodeBlock.cpp:2846
#21 0xf6140bc2 in cti_optimize (args=0xffffaeb0) at /home/azbest/32bit/WebKit/Source/JavaScriptCore/jit/JITStubs.cpp:1892
#22 0xf613da2a in JSC::tryCacheGetByID (callFrame=0xf0277a80, codeBlock=0x81078a8, returnAddress=..., baseValue=..., 
    propertyName=0x80fe248, slot=0xffffaf38, stubInfo=0xf6108aaf)
    at /home/azbest/32bit/WebKit/Source/JavaScriptCore/jit/JITStubs.cpp:989
#23 0x5a800000 in ?? ()
#24 0x00000000 in ?? ()
(gdb)