Attachment 340614 Details for Bug 185738 – wake-in-order-seg-fault.txt

wake-in-order-seg-fault.txt

wake-in-order-seg-fault.txt (text/plain), 39.89 KB, created by Rick Waldron on 2018-05-17 11:49:29 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Rick Waldron

Created: 2018-05-17 11:49:29 PDT

Size: 39.89 KB

patch

obsolete

>rwaldron in ~/clonez/test262 on 1527
>$ ../WebKit/WebKitBuild/Debug/jsc wake-in-order-standalone.js
>DFG ASSERTION FAILED: AI-clobberize disagreement; AI says ClobberedStructures while clobberize says (Direct:[TypedArrayProperties], Super:[World, Heap])
>./dfg/DFGCFAPhase.cpp(185) : void JSC::DFG::CFAPhase::performBlockCFA(JSC::DFG::BasicBlock *)
>
>While handling node @101
>
>Graph at time of failure:
>
>DFG for #<no-hash>:[0x10c440240->0x10c440000->0x10c2cce70, DFGFunctionCall, 321]:
>  Fixpoint state: FixpointNotConverged; Form: ThreadedCPS; Unification state: GloballyUnified; Ref count state: EverythingIsLive
>  Arguments for block#0: @0, @1
>
>Block #0 (bc#0): (OSR target)
>  Execution count: 1.000000
>  Predecessors:
>  Successors: #1 #2
>  Dominated by: #root #0
>  Dominates: #0 #1 #2
>  Dominance Frontier:
>  Iterated Dominance Frontier:
>  States: StructuresAreWatched
>  Vars Before: arg1:(Top|Empty, TOP, TOP) arg0:(Top|Empty, TOP, TOP)
>  Intersected Vars Before: arg1:(DoubleImpureNan|Top|Empty, TOP, TOP) arg0:(DoubleImpureNan|Top|Empty, TOP, TOP) loc0:(DoubleImpureNan|Top|Empty, TOP, TOP) loc1:(DoubleImpureNan|Top|Empty, TOP, TOP) loc2:(DoubleImpureNan|Top|Empty, TOP, TOP) loc3:(DoubleImpureNan|Top|Empty, TOP, TOP) loc4:(DoubleImpureNan|Top|Empty, TOP, TOP) loc5:(DoubleImpureNan|Top|Empty, TOP, TOP) loc6:(DoubleImpureNan|Top|Empty, TOP, TOP) loc7:(DoubleImpureNan|Top|Empty, TOP, TOP) loc8:(DoubleImpureNan|Top|Empty, TOP, TOP) loc9:(DoubleImpureNan|Top|Empty, TOP, TOP) loc10:(DoubleImpureNan|Top|Empty, TOP, TOP) loc11:(DoubleImpureNan|Top|Empty, TOP, TOP) loc12:(DoubleImpureNan|Top|Empty, TOP, TOP) loc13:(DoubleImpureNan|Top|Empty, TOP, TOP) loc14:(DoubleImpureNan|Top|Empty, TOP, TOP) loc15:(DoubleImpureNan|Top|Empty, TOP, TOP) loc16:(DoubleImpureNan|Top|Empty, TOP, TOP) loc17:(DoubleImpureNan|Top|Empty, TOP, TOP) loc18:(DoubleImpureNan|Top|Empty, TOP, TOP) loc19:(DoubleImpureNan|Top|Empty, TOP, TOP) loc20:(DoubleImpureNan|Top|Empty, TOP, TOP) loc21:(DoubleImpureNan|Top|Empty, TOP, TOP)
>  Var Links: arg1:@1 arg0:@0
>   0:< 1:-> SetArgument(IsFlushed, this(a), W:SideState, bc#0, ExitValid)  predicting Other
>   1:< 1:-> SetArgument(IsFlushed, arg1(B~<Object>/FlushedJSValue), W:SideState, bc#0, ExitValid)  predicting OtherObj
>   2:< 1:-> JSConstant(JS|PureInt, Other, Undefined, bc#0, ExitValid)
>   3:<!0:-> MovHint(Untyped:@2, MustGen, loc0, W:SideState, ClobbersExit, bc#0, ExitValid)
>   4:< 1:-> SetLocal(Untyped:@2, loc0(C~<Other>/FlushedJSValue), W:Stack(-1), bc#0, ExitInvalid)  predicting Other
>   5:<!0:-> MovHint(Untyped:@2, MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid)
>   6:< 1:-> SetLocal(Untyped:@2, loc1(D~<Other>/FlushedJSValue), W:Stack(-2), bc#0, ExitInvalid)  predicting Other
>   7:<!0:-> MovHint(Untyped:@2, MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid)
>   8:< 1:-> SetLocal(Untyped:@2, loc2(E~<Other>/FlushedJSValue), W:Stack(-3), bc#0, ExitInvalid)  predicting Other
>   9:<!0:-> MovHint(Untyped:@2, MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid)
>  10:< 1:-> SetLocal(Untyped:@2, loc3(F~<Other>/FlushedJSValue), W:Stack(-4), bc#0, ExitInvalid)  predicting Other
>  11:<!0:-> MovHint(Untyped:@2, MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid)
>  12:< 1:-> SetLocal(Untyped:@2, loc4(G~<Other>/FlushedJSValue), W:Stack(-5), bc#0, ExitInvalid)  predicting Other
>  13:<!0:-> MovHint(Untyped:@2, MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid)
>  14:< 1:-> SetLocal(Untyped:@2, loc5(H~<Other>/FlushedJSValue), W:Stack(-6), bc#0, ExitInvalid)  predicting Other
>  15:<!0:-> MovHint(Untyped:@2, MustGen, loc6, W:SideState, ClobbersExit, bc#0, ExitInvalid)
>  16:< 1:-> SetLocal(Untyped:@2, loc6(I~<Other>/FlushedJSValue), W:Stack(-7), bc#0, ExitInvalid)  predicting Other
>  17:< 1:-> JSConstant(JS|PureInt, Function, Weak:Object: 0x10c2c02a0 with butterfly 0x0 (Structure %Bo:Function), StructureID: 58, bc#1, ExitValid)
>  18:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10bf18000 with butterfly 0x0 (Structure %C3:JSGlobalLexicalEnvironment), StructureID: 56, bc#1, ExitValid)
>  19:<!0:-> MovHint(Untyped:@18, MustGen, loc3, W:SideState, ClobbersExit, bc#1, ExitValid)
>  20:< 1:-> SetLocal(Untyped:@18, loc3(J~<Object>/FlushedJSValue), W:Stack(-4), bc#1, exit: bc#3, ExitValid)  predicting OtherObj
>  21:<!0:-> MovHint(Untyped:@18, MustGen, loc4, W:SideState, ClobbersExit, bc#3, ExitValid)
>  22:< 1:-> SetLocal(Untyped:@18, loc4(K~<Object>/FlushedJSValue), W:Stack(-5), bc#3, exit: bc#6, ExitValid)  predicting OtherObj
>  23:<!0:-> CheckTraps(MustGen, W:Watchpoint_fire, Exits, ClobbersExit, bc#6, ExitValid)
> 258:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#7, ExitValid)
>  24:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10bf2c000 with butterfly 0xc000d0408 (Structure %BJ:global), StructureID: 276, bc#7, ExitValid)
>  25:<!0:-> MovHint(Untyped:@24, MustGen, loc7, W:SideState, ClobbersExit, bc#7, ExitValid)
>  26:<!0:-> Check(MustGen, bc#7, ExitInvalid)
>  27:< 1:-> SetLocal(Untyped:@24, loc7(L~<Object>/FlushedJSValue), W:Stack(-8), bc#7, exit: bc#14, ExitValid)  predicting OtherObj
>  28:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10bf2c000 with butterfly 0xc000d0408 (Structure %BJ:global), StructureID: 276, bc#14, ExitValid)
>  29:<!0:-> Check(MustGen, bc#14, ExitValid)
>  30:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10bf1c4b0 with butterfly 0xc000e0588 (Structure %Ch:Function), StructureID: 307, bc#14, ExitValid)
>  31:<!0:-> Check(MustGen, bc#14, ExitValid)
>  32:<!0:-> MovHint(Untyped:@30, MustGen, loc8, W:SideState, ClobbersExit, bc#14, ExitValid)
>  33:< 1:-> SetLocal(Untyped:@30, loc8(M~<Object>/FlushedJSValue), W:Stack(-9), bc#14, exit: bc#22, ExitValid)  predicting OtherObj
>  34:<!0:-> MovHint(Untyped:@30, MustGen, loc8, W:SideState, ClobbersExit, bc#22, ExitValid)
>  35:< 1:-> SetLocal(Untyped:@30, loc8(N~<Object>/FlushedJSValue), W:Stack(-9), bc#22, exit: bc#25, ExitValid)  predicting OtherObj
>  36:<!0:-> GetLocal(Untyped:@1, JS|MustGen|UseAsOther|UseAsInt|ReallyWantsInt, OtherObj, arg1(B~<Object>/FlushedJSValue), R:Stack(6), bc#25, ExitValid)  predicting OtherObj
>  37:<!0:-> MovHint(Untyped:@36, MustGen, loc11, W:SideState, ClobbersExit, bc#25, ExitValid)
>  38:< 1:-> SetLocal(Untyped:@36, loc11(O~<Object>/FlushedJSValue), W:Stack(-12), bc#25, exit: bc#28, ExitValid)  predicting OtherObj
>  39:<!0:-> MovHint(Untyped:@30, MustGen, loc12, W:SideState, ClobbersExit, bc#28, ExitValid)
>  40:< 1:-> SetLocal(Untyped:@30, loc12(P~<Object>/FlushedJSValue), W:Stack(-13), bc#28, exit: bc#31, ExitValid)  predicting OtherObj
>  41:<!0:-> CheckCell(Cell:@30, MustGen, <0x10bf1c4b0, Function>, Exits, bc#31, ExitValid)
>  42:<!0:-> Check(MustGen, bc#31, ExitValid)
>  43:<!0:-> NewTypedArray(Untyped:@36, JS|MustGen|UseAsOther, Int32Array, TypeInt32, R:World, W:Heap, Exits, ClobbersExit, bc#31, ExitValid)
>  44:<!0:-> MovHint(Untyped:@43, MustGen, loc5, W:SideState, ClobbersExit, bc#31, ExitInvalid)
>  45:<!0:-> Check(MustGen, bc#31, ExitInvalid)
>  46:<!0:-> Check(MustGen, bc#31, ExitInvalid)
>  47:<!0:-> Check(MustGen, bc#31, ExitInvalid)
> 259:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#31, exit: bc#40, ExitValid)
>  48:< 1:-> SetLocal(Cell:@43, loc5(Q<Int32array>/FlushedCell), W:Stack(-6), bc#31, exit: bc#40, ExitValid)  predicting Int32Array
>  49:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10bf2c000 with butterfly 0xc000d0408 (Structure %BJ:global), StructureID: 276, bc#40, ExitValid)
>  50:<!0:-> MovHint(Untyped:@49, MustGen, loc12, W:SideState, ClobbersExit, bc#40, ExitValid)
>  51:<!0:-> Check(MustGen, bc#40, ExitInvalid)
>  52:< 1:-> SetLocal(Untyped:@49, loc12(R~<Object>/FlushedJSValue), W:Stack(-13), bc#40, exit: bc#47, ExitValid)  predicting OtherObj
>  53:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10bf2c000 with butterfly 0xc000d0408 (Structure %BJ:global), StructureID: 276, bc#47, ExitValid)
>  54:<!0:-> Check(MustGen, bc#47, ExitValid)
>  55:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10bf040c0 with butterfly 0xc000dc4e8 (Structure %Ep:Atomics), StructureID: 164, bc#47, ExitValid)
>  56:<!0:-> Check(MustGen, bc#47, ExitValid)
>  57:<!0:-> MovHint(Untyped:@55, MustGen, loc13, W:SideState, ClobbersExit, bc#47, ExitValid)
>  58:< 1:-> SetLocal(Untyped:@55, loc13(S~<Object>/FlushedJSValue), W:Stack(-14), bc#47, exit: bc#55, ExitValid)  predicting OtherObj
>  59:<!0:-> MovHint(Untyped:@55, MustGen, loc12, W:SideState, ClobbersExit, bc#55, ExitValid)
>  60:< 1:-> SetLocal(Untyped:@55, loc12(T~<Object>/FlushedJSValue), W:Stack(-13), bc#55, exit: bc#58, ExitValid)  predicting OtherObj
>  61:<!0:-> Check(MustGen, bc#58, ExitValid)
>  62:<!0:-> CheckStructure(Cell:@55, MustGen, [%Ep:Atomics], R:JSCell_structureID, Exits, bc#58, ExitValid)
>  63:< 1:-> GetButterfly(Cell:@55, Storage|UseAsOther, Other, R:JSObject_butterfly, Exits, bc#58, ExitValid)
>  64:< 1:-> GetByOffset(Untyped:@63, KnownCell:@55, JS|UseAsOther, Function, id2{add}, 100, inferredType = Top, R:NamedProperties(2), Exits, bc#58, ExitValid)  predicting Function
>  65:<!0:-> MovHint(Untyped:@64, MustGen, loc7, W:SideState, ClobbersExit, bc#58, ExitValid)
>  66:< 1:-> SetLocal(Untyped:@64, loc7(U~<Function>/FlushedJSValue), W:Stack(-8), bc#58, exit: bc#67, ExitValid)  predicting Function
>  67:<!0:-> MovHint(Untyped:@43, MustGen, loc11, W:SideState, ClobbersExit, bc#67, ExitValid)
>  68:< 1:-> SetLocal(Untyped:@43, loc11(V~<Int32array>/FlushedJSValue), W:Stack(-12), bc#67, exit: bc#70, ExitValid)  predicting Int32Array
>  69:< 1:-> JSConstant(JS|UseAsOther, NonBoolInt32, Int32: 4, bc#70, ExitValid)
>  70:<!0:-> MovHint(Untyped:@69, MustGen, loc10, W:SideState, ClobbersExit, bc#70, ExitValid)
>  71:< 1:-> SetLocal(Untyped:@69, loc10(W~<Int32>/FlushedJSValue), W:Stack(-11), bc#70, exit: bc#73, ExitValid)  predicting NonBoolInt32
>  72:< 1:-> JSConstant(JS|UseAsOther, BoolInt32, Int32: 1, bc#73, ExitValid)
>  73:<!0:-> MovHint(Untyped:@72, MustGen, loc9, W:SideState, ClobbersExit, bc#73, ExitValid)
>  74:< 1:-> SetLocal(Untyped:@72, loc9(X~<BoolInt32>/FlushedJSValue), W:Stack(-10), bc#73, exit: bc#76, ExitValid)  predicting BoolInt32
>  75:<!0:-> Call(Untyped:@64, Untyped:@55, Untyped:@43, Untyped:@69, Untyped:@72, JS|MustGen|VarArgs|PureInt, BoolInt32, R:World, W:Heap, ExitsForExceptions, ClobbersExit, bc#76, ExitValid)  predicting BoolInt32
>  76:<!0:-> MovHint(Untyped:@75, MustGen, loc7, W:SideState, ClobbersExit, bc#76, ExitInvalid)
> 260:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#76, exit: bc#85, ExitValid)
>  77:< 1:-> SetLocal(Untyped:@75, loc7(Y~<BoolInt32>/FlushedJSValue), W:Stack(-8), bc#76, exit: bc#85, ExitValid)  predicting BoolInt32
>  78:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10bf2c000 with butterfly 0xc000d0408 (Structure %BJ:global), StructureID: 276, bc#85, ExitValid)
>  79:<!0:-> MovHint(Untyped:@78, MustGen, loc10, W:SideState, ClobbersExit, bc#85, ExitValid)
>  80:<!0:-> Check(MustGen, bc#85, ExitInvalid)
>  81:< 1:-> SetLocal(Untyped:@78, loc10(Z~<Object>/FlushedJSValue), W:Stack(-11), bc#85, exit: bc#92, ExitValid)  predicting OtherObj
>  82:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10bf2c000 with butterfly 0xc000d0408 (Structure %BJ:global), StructureID: 276, bc#92, ExitValid)
>  83:<!0:-> Check(MustGen, bc#92, ExitValid)
>  84:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10bf040c0 with butterfly 0xc000dc4e8 (Structure %Ep:Atomics), StructureID: 164, bc#92, ExitValid)
>  85:<!0:-> Check(MustGen, bc#92, ExitValid)
>  86:<!0:-> MovHint(Untyped:@84, MustGen, loc11, W:SideState, ClobbersExit, bc#92, ExitValid)
>  87:< 1:-> SetLocal(Untyped:@84, loc11(AB~<Object>/FlushedJSValue), W:Stack(-12), bc#92, exit: bc#100, ExitValid)  predicting OtherObj
>  88:<!0:-> MovHint(Untyped:@84, MustGen, loc10, W:SideState, ClobbersExit, bc#100, ExitValid)
>  89:< 1:-> SetLocal(Untyped:@84, loc10(BB~<Object>/FlushedJSValue), W:Stack(-11), bc#100, exit: bc#103, ExitValid)  predicting OtherObj
>  90:<!0:-> Check(MustGen, bc#103, ExitValid)
>  91:<!0:-> CheckStructure(Cell:@84, MustGen, [%Ep:Atomics], R:JSCell_structureID, Exits, bc#103, ExitValid)
>  92:< 1:-> JSConstant(JS|UseAsOther, Function, Weak:Object: 0x10bf0d9b0 with butterfly 0xc000e5048 (Structure %By:Function), StructureID: 62, bc#103, ExitValid)
>  93:<!0:-> MovHint(Untyped:@92, MustGen, loc7, W:SideState, ClobbersExit, bc#103, ExitValid)
>  94:< 1:-> SetLocal(Untyped:@92, loc7(CB~<Function>/FlushedJSValue), W:Stack(-8), bc#103, exit: bc#112, ExitValid)  predicting Function
>  95:<!0:-> MovHint(Untyped:@43, MustGen, loc9, W:SideState, ClobbersExit, bc#112, ExitValid)
>  96:< 1:-> SetLocal(Untyped:@43, loc9(DB~<Int32array>/FlushedJSValue), W:Stack(-10), bc#112, exit: bc#115, ExitValid)  predicting Int32Array
>  97:<!0:-> MovHint(Untyped:@72, MustGen, loc8, W:SideState, ClobbersExit, bc#115, ExitValid)
>  98:< 1:-> SetLocal(Untyped:@72, loc8(EB~<BoolInt32>/FlushedJSValue), W:Stack(-9), bc#115, exit: bc#118, ExitValid)  predicting BoolInt32
>  99:<!0:-> CheckCell(Cell:@92, MustGen, <0x10bf0d9b0, Function>, <host function>, Exits, bc#118, ExitValid)
> 100:<!0:-> Check(MustGen, bc#118, ExitValid)
> 244:<!0:-> CheckArray(Cell:@43, MustGen, Int32Array+NonArray+InBounds+AsIs, R:JSCell_indexingType,JSCell_structureID,JSCell_typeInfoType, Exits, bc#118, ExitValid)
> 245:< 1:-> GetIndexedPropertyStorage(KnownCell:@43, Storage|PureInt, Int32Array+NonArray+InBounds+AsIs, R:MiscFields, Exits, bc#118, ExitValid)
> 101:<!0:-> AtomicsLoad(Cell:@43, Int32:@72, Untyped:@245, JS|MustGen|UseAsOther, Int32, Int32Array+NonArray+InBounds+AsIs, R:TypedArrayProperties,MiscFields, W:TypedArrayProperties, Exits, ClobbersExit, bc#118, ExitValid)  predicting BoolInt32
> 102:<!0:-> MovHint(Check:Untyped:@101, MustGen, loc7, W:SideState, ClobbersExit, bc#118, ExitInvalid)
> 103:<!0:-> Check(MustGen, bc#118, ExitInvalid)
> 104:<!0:-> Check(MustGen, bc#118, ExitInvalid)
> 105:<!0:-> Check(MustGen, bc#118, ExitInvalid)
> 106:<!0:-> Check(MustGen, bc#118, ExitInvalid)
> 107:< 1:-> SetLocal(Check:Untyped:@101, loc7(FB~<Int32>/FlushedJSValue), W:Stack(-8), bc#118, exit: bc#127, ExitValid)  predicting Int32
> 108:< 1:-> JSConstant(JS|UseAsOther, BoolInt32, Int32: 0, bc#127, ExitValid)
> 109:< 1:-> CompareStrictEq(Check:Int32:@101, Check:Int32:@108, Boolean|PureInt, Bool, Exits, bc#127, ExitValid)
> 110:<!0:-> Branch(Check:KnownBoolean:@109, MustGen, T:#1/w:10.000000, F:#2/w:1.000000, W:SideState, bc#127, ExitValid)
>  States: InvalidBranchDirection, StructuresAreWatched
>  Vars After:
>  Var Links: arg1:@36 arg0:@0 loc0:@4 loc1:@6 loc2:@8 loc3:@20 loc4:@22 loc5:@48 loc6:@16 loc7:@107 loc8:@98 loc9:@96 loc10:@89 loc11:@87 loc12:@60 loc13:@58
>
>Block #1 (bc#131): (OSR target)
>  Execution count: 10.000000
>  Predecessors: #0 #1
>  Successors: #1 #2
>  Dominated by: #root #0 #1
>  Dominates: #1
>  Dominance Frontier: #1 #2
>  Iterated Dominance Frontier: #1 #2
>  Loop header, contains: #1
>  Containing loop headers: #1
>  Phi Nodes: @240<loc3,1>->(@240, @20), @241<loc5,1>->(@241, @48), @242<this,1>->(@242, @0), @243<arg1,1>->(@243, @1)
>  States: StructuresAreWatched, CurrentlyCFAUnreachable
>  Vars Before: <empty>
>  Intersected Vars Before: arg1:(DoubleImpureNan|Top|Empty, TOP, TOP) arg0:(DoubleImpureNan|Top|Empty, TOP, TOP) loc0:(DoubleImpureNan|Top|Empty, TOP, TOP) loc1:(DoubleImpureNan|Top|Empty, TOP, TOP) loc2:(DoubleImpureNan|Top|Empty, TOP, TOP) loc3:(DoubleImpureNan|Top|Empty, TOP, TOP) loc4:(DoubleImpureNan|Top|Empty, TOP, TOP) loc5:(DoubleImpureNan|Top|Empty, TOP, TOP) loc6:(DoubleImpureNan|Top|Empty, TOP, TOP) loc7:(DoubleImpureNan|Top|Empty, TOP, TOP) loc8:(DoubleImpureNan|Top|Empty, TOP, TOP) loc9:(DoubleImpureNan|Top|Empty, TOP, TOP) loc10:(DoubleImpureNan|Top|Empty, TOP, TOP) loc11:(DoubleImpureNan|Top|Empty, TOP, TOP) loc12:(DoubleImpureNan|Top|Empty, TOP, TOP) loc13:(DoubleImpureNan|Top|Empty, TOP, TOP) loc14:(DoubleImpureNan|Top|Empty, TOP, TOP) loc15:(DoubleImpureNan|Top|Empty, TOP, TOP) loc16:(DoubleImpureNan|Top|Empty, TOP, TOP) loc17:(DoubleImpureNan|Top|Empty, TOP, TOP) loc18:(DoubleImpureNan|Top|Empty, TOP, TOP) loc19:(DoubleImpureNan|Top|Empty, TOP, TOP) loc20:(DoubleImpureNan|Top|Empty, TOP, TOP) loc21:(DoubleImpureNan|Top|Empty, TOP, TOP)
>  Var Links: arg1:@243 arg0:@242 loc3:@240 loc5:@241
> 111:<!0:-> LoopHint(MustGen, W:SideState, bc#131, ExitValid)
> 112:<!0:-> CheckTraps(MustGen, W:Watchpoint_fire, Exits, ClobbersExit, bc#132, ExitValid)
> 257:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#133, ExitValid)
> 113:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10bf2c000 with butterfly 0xc000d0408 (Structure %BJ:global), StructureID: 276, bc#133, ExitValid)
> 114:<!0:-> MovHint(Check:Untyped:@113, MustGen, loc10, W:SideState, ClobbersExit, bc#133, ExitValid)
> 115:<!0:-> GetLocal(Check:Untyped:@240, JS|MustGen|UseAsOther, OtherObj, loc3(J~<Object>/FlushedJSValue), R:Stack(-4), bc#133, ExitInvalid)  predicting OtherObj
> 116:<!0:-> Check(MustGen, bc#133, ExitInvalid)
> 117:< 1:-> SetLocal(Check:Untyped:@113, loc10(HB~<Object>/FlushedJSValue), W:Stack(-11), bc#133, exit: bc#140, ExitValid)  predicting OtherObj
> 118:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10bf2c000 with butterfly 0xc000d0408 (Structure %BJ:global), StructureID: 276, bc#140, ExitValid)
> 119:<!0:-> Check(MustGen, bc#140, ExitValid)
> 120:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10bf040c0 with butterfly 0xc000dc4e8 (Structure %Ep:Atomics), StructureID: 164, bc#140, ExitValid)
> 121:<!0:-> Check(MustGen, bc#140, ExitValid)
> 122:<!0:-> MovHint(Check:Untyped:@120, MustGen, loc11, W:SideState, ClobbersExit, bc#140, ExitValid)
> 123:< 1:-> SetLocal(Check:Untyped:@120, loc11(IB~<Object>/FlushedJSValue), W:Stack(-12), bc#140, exit: bc#148, ExitValid)  predicting OtherObj
> 124:<!0:-> MovHint(Check:Untyped:@120, MustGen, loc10, W:SideState, ClobbersExit, bc#148, ExitValid)
> 125:< 1:-> SetLocal(Check:Untyped:@120, loc10(JB~<Object>/FlushedJSValue), W:Stack(-11), bc#148, exit: bc#151, ExitValid)  predicting OtherObj
> 126:<!0:-> Check(MustGen, bc#151, ExitValid)
> 127:<!0:-> CheckStructure(Check:Cell:@120, MustGen, [%Ep:Atomics], R:JSCell_structureID, Exits, bc#151, ExitValid)
> 128:< 1:-> JSConstant(JS|UseAsOther, Function, Weak:Object: 0x10bf0d9b0 with butterfly 0xc000e5048 (Structure %By:Function), StructureID: 62, bc#151, ExitValid)
> 129:<!0:-> MovHint(Check:Untyped:@128, MustGen, loc7, W:SideState, ClobbersExit, bc#151, ExitValid)
> 130:< 1:-> SetLocal(Check:Untyped:@128, loc7(KB~<Function>/FlushedJSValue), W:Stack(-8), bc#151, exit: bc#160, ExitValid)  predicting Function
> 131:<!0:-> GetLocal(Check:Untyped:@241, JS|MustGen|UseAsOther, Int32Array, loc5(Q<Int32array>/FlushedCell), R:Stack(-6), bc#160, ExitValid)  predicting Int32Array
> 132:<!0:-> MovHint(Check:Untyped:@131, MustGen, loc9, W:SideState, ClobbersExit, bc#160, ExitValid)
> 133:< 1:-> SetLocal(Check:Untyped:@131, loc9(MB~<Int32array>/FlushedJSValue), W:Stack(-10), bc#160, exit: bc#163, ExitValid)  predicting Int32Array
> 134:< 1:-> JSConstant(JS|UseAsOther, BoolInt32, Int32: 1, bc#163, ExitValid)
> 135:<!0:-> MovHint(Check:Untyped:@134, MustGen, loc8, W:SideState, ClobbersExit, bc#163, ExitValid)
> 136:< 1:-> SetLocal(Check:Untyped:@134, loc8(NB~<BoolInt32>/FlushedJSValue), W:Stack(-9), bc#163, exit: bc#166, ExitValid)  predicting BoolInt32
> 137:<!0:-> CheckCell(Check:Cell:@128, MustGen, <0x10bf0d9b0, Function>, <host function>, Exits, bc#166, ExitValid)
> 138:<!0:-> Check(MustGen, bc#166, ExitValid)
> 246:<!0:-> CheckArray(Check:Cell:@131, MustGen, Int32Array+NonArray+InBounds+AsIs, R:JSCell_indexingType,JSCell_structureID,JSCell_typeInfoType, Exits, bc#166, ExitValid)
> 247:< 1:-> GetIndexedPropertyStorage(Check:KnownCell:@131, Storage|PureInt, Int32Array+NonArray+InBounds+AsIs, R:MiscFields, Exits, bc#166, ExitValid)
> 139:<!0:-> AtomicsLoad(Check:Cell:@131, Check:Int32:@134, Check:Untyped:@247, JS|MustGen|UseAsOther, Int32, Int32Array+NonArray+InBounds+AsIs, R:TypedArrayProperties,MiscFields, W:TypedArrayProperties, Exits, ClobbersExit, bc#166, ExitValid)  predicting BoolInt32
> 140:<!0:-> MovHint(Check:Untyped:@139, MustGen, loc7, W:SideState, ClobbersExit, bc#166, ExitInvalid)
> 141:<!0:-> Check(MustGen, bc#166, ExitInvalid)
> 142:<!0:-> Check(MustGen, bc#166, ExitInvalid)
> 143:<!0:-> Check(MustGen, bc#166, ExitInvalid)
> 144:<!0:-> Check(MustGen, bc#166, ExitInvalid)
> 145:< 1:-> SetLocal(Check:Untyped:@139, loc7(OB~<Int32>/FlushedJSValue), W:Stack(-8), bc#166, exit: bc#175, ExitValid)  predicting Int32
> 146:< 1:-> JSConstant(JS|UseAsOther, BoolInt32, Int32: 0, bc#175, ExitValid)
> 147:< 1:-> CompareStrictEq(Check:Int32:@139, Check:Int32:@146, Boolean|PureInt, Bool, Exits, bc#175, ExitValid)
> 148:<!0:-> Branch(Check:KnownBoolean:@147, MustGen, T:#1/w:10.000000, F:#2/w:1.000000, W:SideState, bc#175, ExitValid)
>  States: InvalidBranchDirection, StructuresAreWatched
>  Vars After: <empty>
>  Var Links: arg1:@243 arg0:@242 loc3:@115 loc5:@131 loc7:@145 loc8:@136 loc9:@133 loc10:@125 loc11:@123
>
>Block #2 (bc#179):
>  Execution count: 1.000000
>  Predecessors: #0 #1
>  Successors:
>  Dominated by: #root #0 #2
>  Dominates: #2
>  Dominance Frontier:
>  Iterated Dominance Frontier:
>  Phi Nodes: @236<loc3,1>->(@240, @20), @237<loc5,1>->(@241, @48), @238<arg1,1>->(@243, @1), @239<this,1>->(@242, @0)
>  States: StructuresAreWatched, CurrentlyCFAUnreachable
>  Vars Before: <empty>
>  Intersected Vars Before: arg1:(DoubleImpureNan|Top|Empty, TOP, TOP) arg0:(DoubleImpureNan|Top|Empty, TOP, TOP) loc0:(DoubleImpureNan|Top|Empty, TOP, TOP) loc1:(DoubleImpureNan|Top|Empty, TOP, TOP) loc2:(DoubleImpureNan|Top|Empty, TOP, TOP) loc3:(DoubleImpureNan|Top|Empty, TOP, TOP) loc4:(DoubleImpureNan|Top|Empty, TOP, TOP) loc5:(DoubleImpureNan|Top|Empty, TOP, TOP) loc6:(DoubleImpureNan|Top|Empty, TOP, TOP) loc7:(DoubleImpureNan|Top|Empty, TOP, TOP) loc8:(DoubleImpureNan|Top|Empty, TOP, TOP) loc9:(DoubleImpureNan|Top|Empty, TOP, TOP) loc10:(DoubleImpureNan|Top|Empty, TOP, TOP) loc11:(DoubleImpureNan|Top|Empty, TOP, TOP) loc12:(DoubleImpureNan|Top|Empty, TOP, TOP) loc13:(DoubleImpureNan|Top|Empty, TOP, TOP) loc14:(DoubleImpureNan|Top|Empty, TOP, TOP) loc15:(DoubleImpureNan|Top|Empty, TOP, TOP) loc16:(DoubleImpureNan|Top|Empty, TOP, TOP) loc17:(DoubleImpureNan|Top|Empty, TOP, TOP) loc18:(DoubleImpureNan|Top|Empty, TOP, TOP) loc19:(DoubleImpureNan|Top|Empty, TOP, TOP) loc20:(DoubleImpureNan|Top|Empty, TOP, TOP) loc21:(DoubleImpureNan|Top|Empty, TOP, TOP)
>  Var Links: arg1:@234 arg0:@235 loc3:@236 loc5:@237
> 149:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10bf2c000 with butterfly 0xc000d0408 (Structure %BJ:global), StructureID: 276, bc#179, ExitValid)
> 150:<!0:-> MovHint(Check:Untyped:@149, MustGen, loc11, W:SideState, ClobbersExit, bc#179, ExitValid)
> 151:<!0:-> GetLocal(Check:Untyped:@236, JS|MustGen|UseAsOther, OtherObj, loc3(J~<Object>/FlushedJSValue), R:Stack(-4), bc#179, ExitInvalid)  predicting OtherObj
> 152:<!0:-> Check(MustGen, bc#179, ExitInvalid)
> 153:< 1:-> SetLocal(Check:Untyped:@149, loc11(QB~<Object>/FlushedJSValue), W:Stack(-12), bc#179, exit: bc#186, ExitValid)  predicting OtherObj
> 154:<!0:-> ForceOSRExit(MustGen, W:SideState, Exits, bc#186, ExitValid)
> 155:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10bf2c000 with butterfly 0xc000d0408 (Structure %BJ:global), StructureID: 276, bc#186, ExitValid)
> 156:<!0:-> Check(MustGen, bc#186, ExitValid)
> 157:< 1:-> JSConstant(JS|UseAsOther, Final, Weak:Object: 0x10bf04330 with butterfly 0xc000e0488 (Structure %Bo9:Object), StructureID: 284, bc#186, ExitValid)
> 158:<!0:-> Check(MustGen, bc#186, ExitValid)
> 159:<!0:-> MovHint(Check:Untyped:@157, MustGen, loc12, W:SideState, ClobbersExit, bc#186, ExitValid)
> 160:< 1:-> SetLocal(Check:Untyped:@157, loc12(RB~<Final>/FlushedJSValue), W:Stack(-13), bc#186, exit: bc#194, ExitValid)  predicting Final
> 161:<!0:-> MovHint(Check:Untyped:@157, MustGen, loc12, W:SideState, ClobbersExit, bc#194, ExitValid)
> 162:< 1:-> SetLocal(Check:Untyped:@157, loc12(SB~<Final>/FlushedJSValue), W:Stack(-13), bc#194, exit: bc#197, ExitValid)  predicting Final
> 163:<!0:-> ForceOSRExit(MustGen, W:SideState, Exits, bc#197, ExitValid)
> 164:<!0:-> GetById(Check:Cell:@157, JS|MustGen|UseAsOther, id5{agent}, R:World, W:Heap, Exits, ClobbersExit, bc#197, ExitValid)  predicting None
> 165:<!0:-> MovHint(Check:Untyped:@164, MustGen, loc10, W:SideState, ClobbersExit, bc#197, ExitInvalid)
> 248:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#197, exit: bc#206, ExitValid)
> 166:< 1:-> SetLocal(Check:Untyped:@164, loc10(TB~/FlushedJSValue), W:Stack(-11), bc#197, exit: bc#206, ExitValid)  predicting None
> 167:<!0:-> ForceOSRExit(MustGen, W:SideState, Exits, bc#206, ExitValid)
> 168:<!0:-> GetById(Check:Untyped:@164, JS|MustGen|UseAsOther, id6{report}, R:World, W:Heap, Exits, ClobbersExit, bc#206, ExitValid)  predicting None
> 169:<!0:-> MovHint(Check:Untyped:@168, MustGen, loc7, W:SideState, ClobbersExit, bc#206, ExitInvalid)
> 249:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#206, exit: bc#215, ExitValid)
> 170:< 1:-> SetLocal(Check:Untyped:@168, loc7(UB~/FlushedJSValue), W:Stack(-8), bc#206, exit: bc#215, ExitValid)  predicting None
> 171:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10bf2c000 with butterfly 0xc000d0408 (Structure %BJ:global), StructureID: 276, bc#215, ExitValid)
> 172:<!0:-> MovHint(Check:Untyped:@171, MustGen, loc16, W:SideState, ClobbersExit, bc#215, ExitValid)
> 173:<!0:-> Check(MustGen, bc#215, ExitInvalid)
> 174:< 1:-> SetLocal(Check:Untyped:@171, loc16(VB~<Object>/FlushedJSValue), W:Stack(-17), bc#215, exit: bc#222, ExitValid)  predicting OtherObj
> 175:<!0:-> ForceOSRExit(MustGen, W:SideState, Exits, bc#222, ExitValid)
> 176:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10bf2c000 with butterfly 0xc000d0408 (Structure %BJ:global), StructureID: 276, bc#222, ExitValid)
> 177:<!0:-> Check(MustGen, bc#222, ExitValid)
> 178:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10bf040c0 with butterfly 0xc000dc4e8 (Structure %Ep:Atomics), StructureID: 164, bc#222, ExitValid)
> 179:<!0:-> Check(MustGen, bc#222, ExitValid)
> 180:<!0:-> MovHint(Check:Untyped:@178, MustGen, loc17, W:SideState, ClobbersExit, bc#222, ExitValid)
> 181:< 1:-> SetLocal(Check:Untyped:@178, loc17(WB~<Object>/FlushedJSValue), W:Stack(-18), bc#222, exit: bc#230, ExitValid)  predicting OtherObj
> 182:<!0:-> MovHint(Check:Untyped:@178, MustGen, loc16, W:SideState, ClobbersExit, bc#230, ExitValid)
> 183:< 1:-> SetLocal(Check:Untyped:@178, loc16(XB~<Object>/FlushedJSValue), W:Stack(-17), bc#230, exit: bc#233, ExitValid)  predicting OtherObj
> 184:<!0:-> ForceOSRExit(MustGen, W:SideState, Exits, bc#233, ExitValid)
> 185:<!0:-> GetById(Check:Cell:@178, JS|MustGen|UseAsOther, id7{wait}, R:World, W:Heap, Exits, ClobbersExit, bc#233, ExitValid)  predicting None
> 186:<!0:-> MovHint(Check:Untyped:@185, MustGen, loc11, W:SideState, ClobbersExit, bc#233, ExitInvalid)
> 250:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#233, exit: bc#242, ExitValid)
> 187:< 1:-> SetLocal(Check:Untyped:@185, loc11(YB~/FlushedJSValue), W:Stack(-12), bc#233, exit: bc#242, ExitValid)  predicting None
> 188:<!0:-> GetLocal(Check:Untyped:@237, JS|MustGen|UseAsOther, Int32Array, loc5(Q<Int32array>/FlushedCell), R:Stack(-6), bc#242, ExitValid)  predicting Int32Array
> 189:<!0:-> MovHint(Check:Untyped:@188, MustGen, loc15, W:SideState, ClobbersExit, bc#242, ExitValid)
> 190:< 1:-> SetLocal(Check:Untyped:@188, loc15(AC~<Int32array>/FlushedJSValue), W:Stack(-16), bc#242, exit: bc#245, ExitValid)  predicting Int32Array
> 191:< 1:-> JSConstant(JS|UseAsOther, BoolInt32, Int32: 0, bc#245, ExitValid)
> 192:<!0:-> MovHint(Check:Untyped:@191, MustGen, loc14, W:SideState, ClobbersExit, bc#245, ExitValid)
> 193:< 1:-> SetLocal(Check:Untyped:@191, loc14(BC~<BoolInt32>/FlushedJSValue), W:Stack(-15), bc#245, exit: bc#248, ExitValid)  predicting BoolInt32
> 194:<!0:-> MovHint(Check:Untyped:@191, MustGen, loc13, W:SideState, ClobbersExit, bc#248, ExitValid)
> 195:< 1:-> SetLocal(Check:Untyped:@191, loc13(CC~<BoolInt32>/FlushedJSValue), W:Stack(-14), bc#248, exit: bc#251, ExitValid)  predicting BoolInt32
> 196:<!0:-> ForceOSRExit(MustGen, W:SideState, Exits, bc#251, ExitValid)
> 197:<!0:-> Call(Check:Untyped:@185, Check:Untyped:@178, Check:Untyped:@188, Check:Untyped:@191, Check:Untyped:@191, JS|MustGen|VarArgs|PureNum|UseAsOther, R:World, W:Heap, ExitsForExceptions, ClobbersExit, bc#251, ExitValid)  predicting None
> 198:<!0:-> MovHint(Check:Untyped:@197, MustGen, loc11, W:SideState, ClobbersExit, bc#251, ExitInvalid)
> 251:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#251, exit: bc#260, ExitValid)
> 199:< 1:-> SetLocal(Check:Untyped:@197, loc11(DC~/FlushedJSValue), W:Stack(-12), bc#251, exit: bc#260, ExitValid)  predicting None
> 200:<!0:-> ValueAdd(Check:Untyped:@191, Check:Untyped:@197, JS|MustGen|UseAsOther, R:World, W:Heap, Exits, ClobbersExit, bc#260, ExitValid)
> 201:<!0:-> MovHint(Check:Untyped:@200, MustGen, loc9, W:SideState, ClobbersExit, bc#260, ExitInvalid)
> 252:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#260, exit: bc#265, ExitValid)
> 202:< 1:-> SetLocal(Check:Untyped:@200, loc9(EC~/FlushedJSValue), W:Stack(-10), bc#260, exit: bc#265, ExitValid)  predicting None
> 203:<!0:-> ForceOSRExit(MustGen, W:SideState, Exits, bc#265, ExitValid)
> 204:<!0:-> Call(Check:Untyped:@168, Check:Untyped:@164, Check:Untyped:@200, JS|MustGen|VarArgs|PureInt, R:World, W:Heap, ExitsForExceptions, ClobbersExit, bc#265, ExitValid)  predicting None
> 205:<!0:-> MovHint(Check:Untyped:@204, MustGen, loc7, W:SideState, ClobbersExit, bc#265, ExitInvalid)
> 253:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#265, exit: bc#274, ExitValid)
> 206:< 1:-> SetLocal(Check:Untyped:@204, loc7(FC~/FlushedJSValue), W:Stack(-8), bc#265, exit: bc#274, ExitValid)  predicting None
> 207:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10bf2c000 with butterfly 0xc000d0408 (Structure %BJ:global), StructureID: 276, bc#274, ExitValid)
> 208:<!0:-> MovHint(Check:Untyped:@207, MustGen, loc9, W:SideState, ClobbersExit, bc#274, ExitValid)
> 209:<!0:-> Check(MustGen, bc#274, ExitInvalid)
> 210:< 1:-> SetLocal(Check:Untyped:@207, loc9(GC~<Object>/FlushedJSValue), W:Stack(-10), bc#274, exit: bc#281, ExitValid)  predicting OtherObj
> 211:<!0:-> ForceOSRExit(MustGen, W:SideState, Exits, bc#281, ExitValid)
> 212:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10bf2c000 with butterfly 0xc000d0408 (Structure %BJ:global), StructureID: 276, bc#281, ExitValid)
> 213:<!0:-> Check(MustGen, bc#281, ExitValid)
> 214:< 1:-> JSConstant(JS|UseAsOther, Final, Weak:Object: 0x10bf04330 with butterfly 0xc000e0488 (Structure %Bo9:Object), StructureID: 284, bc#281, ExitValid)
> 215:<!0:-> Check(MustGen, bc#281, ExitValid)
> 216:<!0:-> MovHint(Check:Untyped:@214, MustGen, loc10, W:SideState, ClobbersExit, bc#281, ExitValid)
> 217:< 1:-> SetLocal(Check:Untyped:@214, loc10(HC~<Final>/FlushedJSValue), W:Stack(-11), bc#281, exit: bc#289, ExitValid)  predicting Final
> 218:<!0:-> MovHint(Check:Untyped:@214, MustGen, loc10, W:SideState, ClobbersExit, bc#289, ExitValid)
> 219:< 1:-> SetLocal(Check:Untyped:@214, loc10(IC~<Final>/FlushedJSValue), W:Stack(-11), bc#289, exit: bc#292, ExitValid)  predicting Final
> 220:<!0:-> ForceOSRExit(MustGen, W:SideState, Exits, bc#292, ExitValid)
> 221:<!0:-> GetById(Check:Cell:@214, JS|MustGen|UseAsOther, id5{agent}, R:World, W:Heap, Exits, ClobbersExit, bc#292, ExitValid)  predicting None
> 222:<!0:-> MovHint(Check:Untyped:@221, MustGen, loc8, W:SideState, ClobbersExit, bc#292, ExitInvalid)
> 254:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#292, exit: bc#301, ExitValid)
> 223:< 1:-> SetLocal(Check:Untyped:@221, loc8(JC~/FlushedJSValue), W:Stack(-9), bc#292, exit: bc#301, ExitValid)  predicting None
> 224:<!0:-> ForceOSRExit(MustGen, W:SideState, Exits, bc#301, ExitValid)
> 225:<!0:-> GetById(Check:Untyped:@221, JS|MustGen|UseAsOther, id8{leaving}, R:World, W:Heap, Exits, ClobbersExit, bc#301, ExitValid)  predicting None
> 226:<!0:-> MovHint(Check:Untyped:@225, MustGen, loc7, W:SideState, ClobbersExit, bc#301, ExitInvalid)
> 255:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#301, exit: bc#310, ExitValid)
> 227:< 1:-> SetLocal(Check:Untyped:@225, loc7(KC~/FlushedJSValue), W:Stack(-8), bc#301, exit: bc#310, ExitValid)  predicting None
> 228:<!0:-> ForceOSRExit(MustGen, W:SideState, Exits, bc#310, ExitValid)
> 229:<!0:-> Call(Check:Untyped:@225, Check:Untyped:@221, JS|MustGen|VarArgs|PureInt, R:World, W:Heap, ExitsForExceptions, ClobbersExit, bc#310, ExitValid)  predicting None
> 230:<!0:-> MovHint(Check:Untyped:@229, MustGen, loc7, W:SideState, ClobbersExit, bc#310, ExitInvalid)
> 256:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#310, exit: bc#319, ExitValid)
> 231:< 1:-> SetLocal(Check:Untyped:@229, loc7(LC~/FlushedJSValue), W:Stack(-8), bc#310, exit: bc#319, ExitValid)  predicting None
> 232:< 1:-> JSConstant(JS|UseAsOther, Other, Undefined, bc#319, ExitValid)
> 233:<!0:-> Return(Check:Untyped:@232, MustGen, W:SideState, Exits, bc#319, ExitValid)
> 234:<!0:-> Flush(Check:Untyped:@238, MustGen|IsFlushed, arg1(B~<Object>/FlushedJSValue), R:Stack(6), W:SideState, bc#319, ExitValid)  predicting OtherObj
> 235:<!0:-> Flush(Check:Untyped:@239, MustGen|IsFlushed, this(a), R:Stack(5), W:SideState, bc#319, ExitValid)  predicting Other
>  States: InvalidBranchDirection, StructuresAreWatched
>  Vars After: <empty>
>  Var Links: arg1:@234 arg0:@235 loc3:@151 loc5:@188 loc7:@231 loc8:@223 loc9:@210 loc10:@219 loc11:@199 loc12:@162 loc13:@195 loc14:@193 loc15:@190 loc16:@183 loc17:@181
>
>GC Values:
>    Weak:Object: 0x10bf04330 with butterfly 0xc000e0488 (Structure %Bo9:Object), StructureID: 284
>    Weak:Object: 0x10bf0d9b0 with butterfly 0xc000e5048 (Structure %By:Function), StructureID: 62
>    Weak:Object: 0x10bf040c0 with butterfly 0xc000dc4e8 (Structure %Ep:Atomics), StructureID: 164
>    Weak:Object: 0x10bf1c4b0 with butterfly 0xc000e0588 (Structure %Ch:Function), StructureID: 307
>    Weak:Object: 0x10bf2c000 with butterfly 0xc000d0408 (Structure %BJ:global), StructureID: 276
>    Weak:Object: 0x10bf18000 with butterfly 0x0 (Structure %C3:JSGlobalLexicalEnvironment), StructureID: 56
>    Weak:Object: 0x10c2c02a0 with butterfly 0x0 (Structure %Bo:Function), StructureID: 58
>Desired watchpoints:
>    Watchpoint sets: 0x10ba28e88, 0x10ba7c0a0
>    Inline watchpoint sets: 0x10bf40760, 0x10bf40060, 0x10bf41b10, 0x10c2f7da0, 0x10bf41870, 0x10c2f4920, 0x10c2b8920, 0x10bf401b0, 0x10c2b87d0, 0x10bf43630
>    Inferred values: 0x10bf24e40
>    Buffer views:
>    Object property conditions: <Object: 0x10bf2c000 with butterfly 0xc000d0408 (Structure %BJ:global), StructureID: 276: Equivalence of Atomics with Object: 0x10bf040c0 with butterfly 0xc000dc4e8 (Structure %Ep:Atomics), StructureID: 164>, <Object: 0x10bf2c000 with butterfly 0xc000d0408 (Structure %BJ:global), StructureID: 276: Equivalence of $262 with Object: 0x10bf04330 with butterfly 0xc000e0488 (Structure %Bo9:Object), StructureID: 284>, <Object: 0x10bf2c000 with butterfly 0xc000d0408 (Structure %BJ:global), StructureID: 276: Equivalence of Int32Array with Object: 0x10bf1c4b0 with butterfly 0xc000e0588 (Structure %Ch:Function), StructureID: 307>, <Object: 0x10bf04000 with butterfly 0xc000dc088 (Structure %Ci:Object), StructureID: 68: Absence of Symbol.toPrimitive with prototype <JSValue()>>, <Object: 0x10c2f8000 with butterfly 0xc000d8238 (Structure %C7:String), StructureID: 123: Absence of Symbol.toPrimitive with prototype Object: 0x10bf04000 with butterfly 0xc000dc088 (Structure %Ci:Object), StructureID: 68>
>    Inferred types:
>Structures:
>    %BJ:global                     = 0x10c2f79c0:[global, {parseInt:100, parseFloat:101, Object:102, Function:103, Array:104, RegExp:105, RangeError:106, TypeError:107, PrivateSymbol.Object:108, PrivateSymbol.Array:109, ArrayBuffer:110, SharedArrayBuffer:111, Atomics:112, String:113, Symbol:114, Number:115, Boolean:116, Error:117, Map:118, Set:119, Promise:120, eval:121, Intl:122, Reflect:123, WebAssembly:124, debug:125, describe:126, describeArray:127, print:128, printErr:129, quit:130, gc:131, fullGC:132, edenGC:133, forceGCSlowPaths:134, gcHeapSize:135, addressOf:136, dumpCallFrame:137, version:138, run:139, runString:140, load:141, loadString:142, readFile:143, read:144, checkSyntax:145, sleepSeconds:146, jscStack:147, readline:148, preciseTime:149, neverInlineFunction:150, noInline:151, noDFG:152, noFTL:153, noOSRExitFuzzing:154, numberOfDFGCompiles:155, jscOptions:156, optimizeNextInvocation:157, reoptimizationRetryCount:158, transferArrayBuffer:159, failNextNewCodeBlock:160, OSRExit:161, isFinalTier:162, predictInt32:163, isInt32:164, isPureNaN:165, fiatInt52:166, effectful42:167, makeMasquerader:168, hasCustomProperties:169, createGlobalObject:170, dumpTypesForAllVariables:171, drainMicrotasks:172, getRandomSeed:173, setRandomSeed:174, isRope:175, callerSourceOrigin:176, is32BitPlatform:177, loadModule:178, checkModuleSyntax:179, platformSupportsSamplingProfiler:180, generateHeapSnapshot:181, resetSuperSamplerState:182, ensureArrayStorage:183, startSamplingProfiler:184, samplingProfilerStackTraces:185, maxArguments:186, asyncTestStart:187, asyncTestPassed:188, WebAssemblyMemoryMode:189, console:190, $:191, $262:192, waitForReport:193, heapCapacity:194, flashHeapAccess:195, disableRichSourceInfo:196, mallocInALoop:197, Int32Array:198, PrivateSymbol.Int32Array:199}, NonArray, Proto:0x10bf04000, Dictionary, Leaf]
>    %Bo:Function                   = 0x10bf418f0:[Function, {}, NonArray, Proto:0x10bf1c000]
>    %Bo9:Object                    = 0x10c2f7d40:[Object, {createRealm:100, detachArrayBuffer:101, evalScript:102, global:103, agent:104}, NonArray, Proto:0x10bf04000, Leaf]
>    %By:Function                   = 0x10bf41ab0:[Function, {name:100, length:101}, NonArray, Proto:0x10bf1c000, Leaf]
>    %C3:JSGlobalLexicalEnvironment = 0x10bf41810:[JSGlobalLexicalEnvironment, {}, NonArray, Leaf]
>    %C7:String                     = 0x10bf43560:[String, {toString:100, valueOf:101, charAt:102, charCodeAt:103, codePointAt:104, indexOf:105, lastIndexOf:106, PrivateSymbol.replaceUsingRegExp:107, PrivateSymbol.replaceUsingStringSearch:108, slice:109, substr:110, substring:111, toLowerCase:112, toUpperCase:113, localeCompare:114, toLocaleLowerCase:115, toLocaleUpperCase:116, trim:117, startsWith:118, endsWith:119, includes:120, normalize:121, PrivateSymbol.charCodeAt:122, trimStart:123, trimLeft:124, trimEnd:125, trimRight:126, Symbol.iterator:127, length:128, constructor:129}, NonArray, Proto:0x10bf04000, Leaf]
>    %Ch:Function                   = 0x10c2b88c0:[Function, {name:100, prototype:101, length:102, BYTES_PER_ELEMENT:103, PrivateSymbol.allocateTypedArray:104}, NonArray, Proto:0x10bf1c480, Leaf]
>    %Ci:Object                     = 0x10bf41d50:[Object, {toString:100, toLocaleString:101, valueOf:102, hasOwnProperty:103, propertyIsEnumerable:104, isPrototypeOf:105, __defineGetter__:106, __defineSetter__:107, __lookupGetter__:108, __lookupSetter__:109, __proto__:110, constructor:111}, NonArray, Leaf]
>    %Ep:Atomics                    = 0x10c2f48c0:[Atomics, {add:100, and:101, compareExchange:102, exchange:103, isLockFree:104, load:105, or:106, store:107, sub:108, wait:109, wake:110, xor:111}, NonArray, Proto:0x10bf04000, Leaf]
>
>
>DFG ASSERTION FAILED: AI-clobberize disagreement; AI says ClobberedStructures while clobberize says (Direct:[TypedArrayProperties], Super:[World, Heap])
>./dfg/DFGCFAPhase.cpp(185) : void JSC::DFG::CFAPhase::performBlockCFA(JSC::DFG::BasicBlock *)
>1   0x105e715e9 WTFCrash
>2   0x105e733bb WTFCrashWithInfo(int, char const*, char const*, int)
>3   0x1065a2515 JSC::DFG::CFAPhase::performBlockCFA(JSC::DFG::BasicBlock*)
>4   0x1065a1d72 JSC::DFG::CFAPhase::performForwardCFA()
>5   0x1065a17f7 JSC::DFG::CFAPhase::run()
>6   0x1065a0fde bool JSC::DFG::runAndLog<JSC::DFG::CFAPhase>(JSC::DFG::CFAPhase&)
>7   0x106544b7e bool JSC::DFG::runPhase<JSC::DFG::CFAPhase>(JSC::DFG::Graph&)
>8   0x106544b45 JSC::DFG::performCFA(JSC::DFG::Graph&)
>9   0x10681cd03 JSC::DFG::Plan::compileInThreadImpl()
>10  0x10681b312 JSC::DFG::Plan::compileInThread(JSC::DFG::ThreadData*)
>11  0x106a8091c JSC::DFG::Worklist::ThreadBody::work()
>12  0x105e85aa7 WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0::operator()() const
>13  0x105e856e9 WTF::Function<void ()>::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0>::call()
>14  0x105e95e1b WTF::Function<void ()>::operator()() const
>15  0x105f185bf WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*)
>16  0x105f1dd85 WTF::wtfThreadEntryPoint(void*)
>17  0x7fff654bd661 _pthread_body
>18  0x7fff654bd50d _pthread_body
>19  0x7fff654bcbf9 thread_start
>Segmentation fault: 11

Actions: View

Attachments on bug 185738: 340614 | 341539