Bug 251722

Summary:	[ BigSur+ Debug JSC ](New Tests?): ASSERTION FAILED: mode == ManualOperandSpeculation \|\| edge.useKind() == HeapBigIntUse
Product:	WebKit	Reporter:	Robert Jenner <jenner>
Component:	JavaScriptCore	Assignee:	Yusuke Suzuki <ysuzuki>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	tzagallo, webkit-bot-watchers-bugzilla, webkit-bug-importer, ysuzuki
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified
See Also:	https://bugs.webkit.org/show_bug.cgi?id=251332

Description Robert Jenner 2023-02-03 14:42:05 PST

wasm.yaml/wasm/stress/js-to-wasm-i64-register.js.wasm-eager
wasm.yaml/wasm/stress/js-to-wasm-i64-stack.js.wasm-eager
wasm.yaml/wasm/stress/js-to-wasm-many-i64.js.default-wasm
wasm.yaml/wasm/stress/js-to-wasm-many-i64.js.wasm-air
wasm.yaml/wasm/stress/js-to-wasm-many-i64.js.wasm-b3
wasm.yaml/wasm/stress/js-to-wasm-many-i64.js.wasm-bbqb3
wasm.yaml/wasm/stress/js-to-wasm-many-i64.js.wasm-eager
wasm.yaml/wasm/stress/js-to-wasm-many-i64.js.wasm-eager-jettison
wasm.yaml/wasm/stress/js-to-wasm-many-i64.js.wasm-no-cjit
wasm.yaml/wasm/stress/js-to-wasm-many-i64.js.wasm-simd
wasm.yaml/wasm/stress/js-to-wasm-many-i64.js.wasm-slow-memory


Appear to be hitting the following assertion BigSur and Monterey Debug:

ASSERTION FAILED: mode == ManualOperandSpeculation || edge.useKind() == HeapBigIntUse

HISTORY:
https://results.webkit.org/?suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&suite=javascriptcore-tests&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-many-i64.js.wasm-eager-jettison&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-many-i64.js.wasm-no-cjit&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-many-i64.js.wasm-simd&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-many-i64.js.wasm-slow-memory&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-many-i64.js.default-wasm&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-many-i64.js.wasm-air&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-many-i64.js.wasm-b3&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-i64-register.js.wasm-eager&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-i64-register.js.wasm-eager-jettison&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-i64-stack.js.wasm-eager&test=wasm.yaml%2Fwasm%2Fstress%2Fjs-to-wasm-i64-stack.js.wasm-eager-jettison


They appear to all have been newly added tests at https://commits.webkit.org/259584@main

Comment 1 Radar WebKit Bug Importer 2023-02-03 14:42:41 PST

<rdar://problem/105021476>

Comment 2 Yusuke Suzuki 2023-02-03 15:32:14 PST

Pull request: https://github.com/WebKit/WebKit/pull/9631

Comment 3 EWS 2023-02-03 16:25:32 PST

Committed 259846@main (781fc3abea74): <https://commits.webkit.org/259846@main>

Reviewed commits have been landed. Closing PR #9631 and removing active labels.