<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>117602</bug_id>
          
          <creation_ts>2013-06-13 10:35:57 -0700</creation_ts>
          <short_desc>Going to google.com/trends causes a crash</short_desc>
          <delta_ts>2013-06-18 17:36:22 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Mac (Intel)</rep_platform>
          <op_sys>OS X 10.8</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P1</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="jacoco">cococohen1122</reporter>
          <assigned_to name="Oliver Hunt">oliver</assigned_to>
          <cc>fpizlo</cc>
    
    <cc>oliver</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>900192</commentid>
    <comment_count>0</comment_count>
    <who name="jacoco">cococohen1122</who>
    <bug_when>2013-06-13 10:35:57 -0700</bug_when>
    <thetext>Going to google.com/trends force closes the browser</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>900905</commentid>
    <comment_count>1</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2013-06-16 14:52:19 -0700</bug_when>
    <thetext>&lt;rdar://problem/13910521&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>901231</commentid>
    <comment_count>2</comment_count>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2013-06-17 18:17:04 -0700</bug_when>
    <thetext>function g() { f() }
 function f() {  doStuff(); arguments = undefined;  }
 function doStuff() { throw {} }

 for (var i = 0; i &lt; 100; i++) { try { g() } catch (e) {} }</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>901470</commentid>
    <comment_count>3</comment_count>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2013-06-18 12:17:40 -0700</bug_when>
    <thetext>Okay, so if we have:
function g() { f() }
function f() {  doStuff(); arguments;  }
function doStuff() { throw {} }

for (var i = 0; i &lt; 100; i++) { try { g() } catch (e) {} }



The initial graph is:
DFG for g#BBXOF8:[0x7fe6ad00f000-&gt;0x10935fd70, DFGFunctionCall]:
  Fixpoint state: BeforeFixpoint; Form: LoadStore; Unification state: LocallyUnified; Ref count state: EverythingIsLive
  ArgumentPosition size: 3
    #0: 
    #1: 
    #2: 
Block #0 (bc#0):  (OSR target)
  Predecessors:
  Phi Nodes:
  vars before: &lt;empty&gt;
  var links: arg0:- : r0:- r1:- r2:- r3:- r4:- r5:- r6:- r7:- r8:- r9:- r10:- r11:- r12:- r13:- r14:- r15:- r16:- r17:- r18:-
   0:           &lt; 1:-&gt;	SetArgument(arg0(a), bc#0)  predicting None
   1:           &lt; 1:-&gt;	JSConstant(JS|PureInt, $0 = Undefined, bc#1)
   2:           &lt;!0:-&gt;	GlobalVarWatchpoint(MustGen|CanExit, global4(0x105dff9c8), bc#1)
   3:           &lt; 1:-&gt;	WeakJSConstant(JS|PureInt, 0x1092decb0, bc#1)
   4:           &lt; 1:-&gt;	SetLocal(@1, CanExit|NodeExitsForward, r1(B~), bc#1)  predicting None
   5:           &lt; 1:-&gt;	SetLocal(@3, CanExit|NodeExitsForward, r0(C~), bc#1)  predicting None
   6:           &lt; 1:-&gt;	SetLocal(@1, CanExit|NodeExitsForward, r1(D~), bc#1)  predicting None
   7:           &lt; 1:-&gt;	SetLocal(@3, CanExit|NodeExitsForward, r0(E~), bc#1)  predicting None
   8:           &lt;!0:-&gt;	Phantom(@3, @1, MustGen|CanExit, bc#7)
  --&gt; f#AmUsAH:&lt;0x10935fc70, bc#7, Call, known callee: Cell: 0x1092decb0 (0x105ddf420: Function, NonArray), numArgs+this = 1, stack &gt;= r8&gt;
     9:           &lt;!0:-&gt;	InlineStart(MustGen, bc#0)
    10:           &lt; 1:-&gt;	SetLocal(@1, CanExit|NodeExitsForward, r8(F*), bc#0)  predicting None
    11:           &lt; 1:-&gt;	SetLocal(@1, CanExit|NodeExitsForward, r9(G*), bc#0)  predicting None
    12:           &lt; 1:-&gt;	JSConstant(JS|PureInt, $1 = &lt;JSValue()&gt;, bc#1)
    13:           &lt;!0:-&gt;	Flush(MustGen, r9(G*), bc#1)  predicting None
    14:           &lt; 1:-&gt;	SetLocal(@12, CanExit|NodeExitsForward, r9(H*), bc#1)  predicting None
    15:           &lt;!0:-&gt;	Flush(MustGen, r8(F*), bc#3)  predicting None
    16:           &lt; 1:-&gt;	SetLocal(@12, CanExit|NodeExitsForward, r8(I*), bc#3)  predicting None
    17:           &lt;!0:-&gt;	GlobalVarWatchpoint(MustGen|CanExit, global5(0x105dff9d0), bc#5)
    18:           &lt; 1:-&gt;	WeakJSConstant(JS|PureInt, 0x1092dec70, bc#5)
    19:           &lt; 1:-&gt;	SetLocal(@1, CanExit|NodeExitsForward, r11(J~), bc#5)  predicting None
    20:           &lt; 1:-&gt;	SetLocal(@18, CanExit|NodeExitsForward, r10(K~), bc#5)  predicting None
    21:           &lt; 1:-&gt;	SetLocal(@1, CanExit|NodeExitsForward, r11(L~), bc#5)  predicting None
    22:           &lt; 1:-&gt;	SetLocal(@18, CanExit|NodeExitsForward, r10(M~), bc#5)  predicting None
    23:           &lt;!0:-&gt;	Phantom(@18, @1, MustGen|CanExit, bc#11)
    --&gt; doStuff#ASE1VK:&lt;0x10935fb70, bc#11, Call, known callee: Cell: 0x1092dec70 (0x105ddf420: Function, NonArray), numArgs+this = 1, stack &gt;= r18&gt;
      24:           &lt;!0:-&gt;	InlineStart(MustGen, bc#0)
      25:           &lt; 1:-&gt;	NewObject(JS|PureInt|CanExit, struct(0x105ddb6c8: NonArray), bc#1)
      26:           &lt; 1:-&gt;	SetLocal(@25, CanExit|NodeExitsForward, r18(N~), bc#1)  predicting None
      27:           &lt;!0:-&gt;	Throw(@25, MustGen|CanExit, bc#5)


Which eventually becomes:
  var links: arg0:@0 : r0:- r1:- r2:- r3:- r4:- r5:- r6:- r7:- r8:- r9:- r10:- r11:- r12:- r13:- r14:- r15:- r16:- r17:- r18:-
   0:           &lt; 1:-&gt;	SetArgument(arg0(a), bc#0)  predicting Other
   1:           &lt; 1:-&gt;	JSConstant(JS|UseAsOther, $0 = Undefined, bc#1)
   2:           &lt;!0:-&gt;	GlobalVarWatchpoint(MustGen|CanExit, global4(0x105dff9c8), bc#1)
   3:           &lt; 1:-&gt;	WeakJSConstant(JS|UseAsOther, 0x1092decb0, bc#1)
   4:           &lt; 1:-&gt;	SetLocal(@1&lt;Other&gt;, CanExit|NodeExitsForward, r1(B~&lt;Other&gt;), bc#1)  predicting Other
   5:           &lt; 1:-&gt;	SetLocal(@3&lt;Function&gt;, CanExit|NodeExitsForward, r0(C~&lt;Function&gt;), bc#1)  predicting Function
   6:           &lt; 1:-&gt;	SetLocal(@1&lt;Other&gt;, CanExit|NodeExitsForward, r1(D~&lt;Other&gt;), bc#1)  predicting Other
   7:           &lt; 1:-&gt;	SetLocal(@3&lt;Function&gt;, CanExit|NodeExitsForward, r0(E~&lt;Function&gt;), bc#1)  predicting Function
   8:           &lt;!0:-&gt;	Phantom(@3&lt;Function&gt;, @1&lt;Other&gt;, MustGen|CanExit, bc#7)
  --&gt; f#AmUsAH:&lt;0x10935fc70, bc#7, Call, known callee: Cell: 0x1092decb0 (0x105ddf420: Function, NonArray), numArgs+this = 1, stack &gt;= r8&gt;
     9:           &lt;!0:-&gt;	InlineStart(MustGen, bc#0)
    10:           &lt; 1:-&gt;	SetLocal(@1&lt;Other&gt;, CanExit|NodeExitsForward, r8(F*&lt;Other&gt;), bc#0)  predicting Other
    11:           &lt; 1:-&gt;	SetLocal(@1&lt;Other&gt;, CanExit|NodeExitsForward, r9(G*&lt;Other&gt;), bc#0)  predicting Other
    12:           &lt; 1:-&gt;	JSConstant(JS|PureInt, $1 = &lt;JSValue()&gt;, bc#1)
    13:           &lt;!0:-&gt;	Flush(@11, MustGen, r9(G*&lt;Other&gt;), bc#1)  predicting Other
    14:           &lt; 1:-&gt;	SetLocal(@12, CanExit|NodeExitsForward, r9(H*), bc#1)  predicting Empty
    15:           &lt;!0:-&gt;	Flush(@10, MustGen, r8(F*&lt;Other&gt;), bc#3)  predicting Other
    16:           &lt; 1:-&gt;	SetLocal(@12, CanExit|NodeExitsForward, r8(I*), bc#3)  predicting Empty
    17:           &lt;!0:-&gt;	GlobalVarWatchpoint(MustGen|CanExit, global5(0x105dff9d0), bc#5)
    18:           &lt; 1:-&gt;	WeakJSConstant(JS|UseAsOther, 0x1092dec70, bc#5)
    19:           &lt; 1:-&gt;	SetLocal(@1&lt;Other&gt;, CanExit|NodeExitsForward, r11(J~&lt;Other&gt;), bc#5)  predicting Other
    20:           &lt; 1:-&gt;	SetLocal(@18&lt;Function&gt;, CanExit|NodeExitsForward, r10(K~&lt;Function&gt;), bc#5)  predicting Function
    21:           &lt; 1:-&gt;	SetLocal(@1&lt;Other&gt;, CanExit|NodeExitsForward, r11(L~&lt;Other&gt;), bc#5)  predicting Other
    22:           &lt; 1:-&gt;	SetLocal(@18&lt;Function&gt;, CanExit|NodeExitsForward, r10(M~&lt;Function&gt;), bc#5)  predicting Function
    23:           &lt;!0:-&gt;	Phantom(@18&lt;Function&gt;, @1&lt;Other&gt;, MustGen|CanExit, bc#11)
    --&gt; doStuff#ASE1VK:&lt;0x10935fb70, bc#11, Call, known callee: Cell: 0x1092dec70 (0x105ddf420: Function, NonArray), numArgs+this = 1, stack &gt;= r18&gt;
      24:           &lt;!0:-&gt;	InlineStart(MustGen, bc#0)
      25:           &lt; 1:-&gt;	NewObject(JS|UseAsOther|CanExit, struct(0x105ddb6c8: NonArray), bc#1)
      26:           &lt; 1:-&gt;	SetLocal(@25&lt;Final&gt;, CanExit|NodeExitsForward, r18(N~&lt;Final&gt;), bc#1)  predicting Final
      27:           &lt;!0:-&gt;	Throw(@25&lt;Final&gt;, MustGen|CanExit, bc#5)


And then after DCE
  var links: arg0:@0 : r0:- r1:- r2:- r3:- r4:- r5:- r6:- r7:- r8:- r9:- r10:- r11:- r12:- r13:- r14:- r15:- r16:- r17:- r18:-
   0:  skipped  &lt; 0:-&gt;	SetArgument(arg0(a), bc#0)
   1:           &lt; 4:-&gt;	JSConstant(JS|UseAsOther, $0 = Undefined, bc#1)
   2:           &lt;!0:-&gt;	GlobalVarWatchpoint(MustGen|CanExit, global4(0x105dff9c8), bc#1)
   3:           &lt; 1:-&gt;	WeakJSConstant(JS|UseAsOther, 0x1092decb0, bc#1)
   4:  skipped  &lt; 0:-&gt;	MovHint(@1&lt;Other&gt;, r1(B~&lt;Other&gt;), bc#1)
   5:  skipped  &lt; 0:-&gt;	MovHint(@3&lt;Function&gt;, r0(C~&lt;Function&gt;), bc#1)
   6:  skipped  &lt; 0:-&gt;	MovHint(@1&lt;Other&gt;, r1(D~&lt;Other&gt;), bc#1)
   7:  skipped  &lt; 0:-&gt;	MovHint(@3&lt;Function&gt;, r0(E~&lt;Function&gt;), bc#1)
   8:           &lt;!0:-&gt;	Phantom(@3&lt;Function&gt;, @1&lt;Other&gt;, MustGen, bc#7)
  --&gt; f#AmUsAH:&lt;0x10935fc70, bc#7, Call, known callee: Cell: 0x1092decb0 (0x105ddf420: Function, NonArray), numArgs+this = 1, stack &gt;= r8&gt;
     9:           &lt;!0:-&gt;	InlineStart(MustGen, bc#0)
    10:  skipped  &lt; 0:-&gt;	MovHint(@1&lt;Other&gt;, r8(F*&lt;Other&gt;), bc#0)
    11:  skipped  &lt; 0:-&gt;	MovHint(@1&lt;Other&gt;, r9(G*&lt;Other&gt;), bc#0)
    12:           &lt;!0:-&gt;	Phantom(MustGen|CanExit, bc#1)
    13:           &lt;!0:-&gt;	Phantom(@1&lt;Other&gt;, MustGen, bc#1)
    14:  skipped  &lt; 0:-&gt;	ZombieHint(r9(H*), bc#1)
    15:           &lt;!0:-&gt;	Phantom(@1&lt;Other&gt;, MustGen, bc#3)
    16:  skipped  &lt; 0:-&gt;	ZombieHint(r8(I*), bc#3)
    17:           &lt;!0:-&gt;	GlobalVarWatchpoint(MustGen|CanExit, global5(0x105dff9d0), bc#5)
    18:           &lt; 1:-&gt;	WeakJSConstant(JS|UseAsOther, 0x1092dec70, bc#5)
    19:  skipped  &lt; 0:-&gt;	MovHint(@1&lt;Other&gt;, r11(J~&lt;Other&gt;), bc#5)
    20:  skipped  &lt; 0:-&gt;	MovHint(@18&lt;Function&gt;, r10(K~&lt;Function&gt;), bc#5)
    21:  skipped  &lt; 0:-&gt;	MovHint(@1&lt;Other&gt;, r11(L~&lt;Other&gt;), bc#5)
    22:  skipped  &lt; 0:-&gt;	MovHint(@18&lt;Function&gt;, r10(M~&lt;Function&gt;), bc#5)
    23:           &lt;!0:-&gt;	Phantom(@18&lt;Function&gt;, @1&lt;Other&gt;, MustGen, bc#11)
    --&gt; doStuff#ASE1VK:&lt;0x10935fb70, bc#11, Call, known callee: Cell: 0x1092dec70 (0x105ddf420: Function, NonArray), numArgs+this = 1, stack &gt;= r18&gt;
      24:           &lt;!0:-&gt;	InlineStart(MustGen, bc#0)
      25:           &lt; 1:-&gt;	NewObject(JS|UseAsOther, struct(0x105ddb6c8: NonArray), bc#1)
      26:  skipped  &lt; 0:-&gt;	MovHint(@25&lt;Final&gt;, r18(N~&lt;Final&gt;), bc#1)
      27:           &lt;!0:-&gt;	Throw(@25&lt;Final&gt;, MustGen|CanExit, bc#5)


Nodes @14 and @16 were responsible for initializing the lazy argument slots, but they have been elided, despite being necessary for correct behavior.

I can add 
            addToGraph(Phantom, get(currentInstruction[1].u.operand));

To init_lazy_reg, and that makes this crash go away, but it feels jacky, and looking at the output graph it is not obvious _why_ we end up with the correct behavior.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>901559</commentid>
    <comment_count>4</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2013-06-18 15:40:08 -0700</bug_when>
    <thetext>(In reply to comment #3)
&gt; Okay, so if we have:
&gt; function g() { f() }
&gt; function f() {  doStuff(); arguments;  }
&gt; function doStuff() { throw {} }
&gt; 
&gt; for (var i = 0; i &lt; 100; i++) { try { g() } catch (e) {} }
&gt; 
&gt; 
&gt; 
&gt; The initial graph is:
&gt; DFG for g#BBXOF8:[0x7fe6ad00f000-&gt;0x10935fd70, DFGFunctionCall]:
&gt;   Fixpoint state: BeforeFixpoint; Form: LoadStore; Unification state: LocallyUnified; Ref count state: EverythingIsLive
&gt;   ArgumentPosition size: 3
&gt;     #0: 
&gt;     #1: 
&gt;     #2: 
&gt; Block #0 (bc#0):  (OSR target)
&gt;   Predecessors:
&gt;   Phi Nodes:
&gt;   vars before: &lt;empty&gt;
&gt;   var links: arg0:- : r0:- r1:- r2:- r3:- r4:- r5:- r6:- r7:- r8:- r9:- r10:- r11:- r12:- r13:- r14:- r15:- r16:- r17:- r18:-
&gt;    0:           &lt; 1:-&gt;    SetArgument(arg0(a), bc#0)  predicting None
&gt;    1:           &lt; 1:-&gt;    JSConstant(JS|PureInt, $0 = Undefined, bc#1)
&gt;    2:           &lt;!0:-&gt;    GlobalVarWatchpoint(MustGen|CanExit, global4(0x105dff9c8), bc#1)
&gt;    3:           &lt; 1:-&gt;    WeakJSConstant(JS|PureInt, 0x1092decb0, bc#1)
&gt;    4:           &lt; 1:-&gt;    SetLocal(@1, CanExit|NodeExitsForward, r1(B~), bc#1)  predicting None
&gt;    5:           &lt; 1:-&gt;    SetLocal(@3, CanExit|NodeExitsForward, r0(C~), bc#1)  predicting None
&gt;    6:           &lt; 1:-&gt;    SetLocal(@1, CanExit|NodeExitsForward, r1(D~), bc#1)  predicting None
&gt;    7:           &lt; 1:-&gt;    SetLocal(@3, CanExit|NodeExitsForward, r0(E~), bc#1)  predicting None
&gt;    8:           &lt;!0:-&gt;    Phantom(@3, @1, MustGen|CanExit, bc#7)
&gt;   --&gt; f#AmUsAH:&lt;0x10935fc70, bc#7, Call, known callee: Cell: 0x1092decb0 (0x105ddf420: Function, NonArray), numArgs+this = 1, stack &gt;= r8&gt;
&gt;      9:           &lt;!0:-&gt;    InlineStart(MustGen, bc#0)
&gt;     10:           &lt; 1:-&gt;    SetLocal(@1, CanExit|NodeExitsForward, r8(F*), bc#0)  predicting None
&gt;     11:           &lt; 1:-&gt;    SetLocal(@1, CanExit|NodeExitsForward, r9(G*), bc#0)  predicting None
&gt;     12:           &lt; 1:-&gt;    JSConstant(JS|PureInt, $1 = &lt;JSValue()&gt;, bc#1)
&gt;     13:           &lt;!0:-&gt;    Flush(MustGen, r9(G*), bc#1)  predicting None
&gt;     14:           &lt; 1:-&gt;    SetLocal(@12, CanExit|NodeExitsForward, r9(H*), bc#1)  predicting None
&gt;     15:           &lt;!0:-&gt;    Flush(MustGen, r8(F*), bc#3)  predicting None
&gt;     16:           &lt; 1:-&gt;    SetLocal(@12, CanExit|NodeExitsForward, r8(I*), bc#3)  predicting None

Are 14 and 16 flushed?

&gt;     17:           &lt;!0:-&gt;    GlobalVarWatchpoint(MustGen|CanExit, global5(0x105dff9d0), bc#5)
&gt;     18:           &lt; 1:-&gt;    WeakJSConstant(JS|PureInt, 0x1092dec70, bc#5)
&gt;     19:           &lt; 1:-&gt;    SetLocal(@1, CanExit|NodeExitsForward, r11(J~), bc#5)  predicting None
&gt;     20:           &lt; 1:-&gt;    SetLocal(@18, CanExit|NodeExitsForward, r10(K~), bc#5)  predicting None
&gt;     21:           &lt; 1:-&gt;    SetLocal(@1, CanExit|NodeExitsForward, r11(L~), bc#5)  predicting None
&gt;     22:           &lt; 1:-&gt;    SetLocal(@18, CanExit|NodeExitsForward, r10(M~), bc#5)  predicting None
&gt;     23:           &lt;!0:-&gt;    Phantom(@18, @1, MustGen|CanExit, bc#11)
&gt;     --&gt; doStuff#ASE1VK:&lt;0x10935fb70, bc#11, Call, known callee: Cell: 0x1092dec70 (0x105ddf420: Function, NonArray), numArgs+this = 1, stack &gt;= r18&gt;
&gt;       24:           &lt;!0:-&gt;    InlineStart(MustGen, bc#0)
&gt;       25:           &lt; 1:-&gt;    NewObject(JS|PureInt|CanExit, struct(0x105ddb6c8: NonArray), bc#1)
&gt;       26:           &lt; 1:-&gt;    SetLocal(@25, CanExit|NodeExitsForward, r18(N~), bc#1)  predicting None
&gt;       27:           &lt;!0:-&gt;    Throw(@25, MustGen|CanExit, bc#5)
&gt; 
&gt; 
&gt; Which eventually becomes:
&gt;   var links: arg0:@0 : r0:- r1:- r2:- r3:- r4:- r5:- r6:- r7:- r8:- r9:- r10:- r11:- r12:- r13:- r14:- r15:- r16:- r17:- r18:-
&gt;    0:           &lt; 1:-&gt;    SetArgument(arg0(a), bc#0)  predicting Other
&gt;    1:           &lt; 1:-&gt;    JSConstant(JS|UseAsOther, $0 = Undefined, bc#1)
&gt;    2:           &lt;!0:-&gt;    GlobalVarWatchpoint(MustGen|CanExit, global4(0x105dff9c8), bc#1)
&gt;    3:           &lt; 1:-&gt;    WeakJSConstant(JS|UseAsOther, 0x1092decb0, bc#1)
&gt;    4:           &lt; 1:-&gt;    SetLocal(@1&lt;Other&gt;, CanExit|NodeExitsForward, r1(B~&lt;Other&gt;), bc#1)  predicting Other
&gt;    5:           &lt; 1:-&gt;    SetLocal(@3&lt;Function&gt;, CanExit|NodeExitsForward, r0(C~&lt;Function&gt;), bc#1)  predicting Function
&gt;    6:           &lt; 1:-&gt;    SetLocal(@1&lt;Other&gt;, CanExit|NodeExitsForward, r1(D~&lt;Other&gt;), bc#1)  predicting Other
&gt;    7:           &lt; 1:-&gt;    SetLocal(@3&lt;Function&gt;, CanExit|NodeExitsForward, r0(E~&lt;Function&gt;), bc#1)  predicting Function
&gt;    8:           &lt;!0:-&gt;    Phantom(@3&lt;Function&gt;, @1&lt;Other&gt;, MustGen|CanExit, bc#7)
&gt;   --&gt; f#AmUsAH:&lt;0x10935fc70, bc#7, Call, known callee: Cell: 0x1092decb0 (0x105ddf420: Function, NonArray), numArgs+this = 1, stack &gt;= r8&gt;
&gt;      9:           &lt;!0:-&gt;    InlineStart(MustGen, bc#0)
&gt;     10:           &lt; 1:-&gt;    SetLocal(@1&lt;Other&gt;, CanExit|NodeExitsForward, r8(F*&lt;Other&gt;), bc#0)  predicting Other
&gt;     11:           &lt; 1:-&gt;    SetLocal(@1&lt;Other&gt;, CanExit|NodeExitsForward, r9(G*&lt;Other&gt;), bc#0)  predicting Other
&gt;     12:           &lt; 1:-&gt;    JSConstant(JS|PureInt, $1 = &lt;JSValue()&gt;, bc#1)
&gt;     13:           &lt;!0:-&gt;    Flush(@11, MustGen, r9(G*&lt;Other&gt;), bc#1)  predicting Other
&gt;     14:           &lt; 1:-&gt;    SetLocal(@12, CanExit|NodeExitsForward, r9(H*), bc#1)  predicting Empty
&gt;     15:           &lt;!0:-&gt;    Flush(@10, MustGen, r8(F*&lt;Other&gt;), bc#3)  predicting Other
&gt;     16:           &lt; 1:-&gt;    SetLocal(@12, CanExit|NodeExitsForward, r8(I*), bc#3)  predicting Empty
&gt;     17:           &lt;!0:-&gt;    GlobalVarWatchpoint(MustGen|CanExit, global5(0x105dff9d0), bc#5)
&gt;     18:           &lt; 1:-&gt;    WeakJSConstant(JS|UseAsOther, 0x1092dec70, bc#5)
&gt;     19:           &lt; 1:-&gt;    SetLocal(@1&lt;Other&gt;, CanExit|NodeExitsForward, r11(J~&lt;Other&gt;), bc#5)  predicting Other
&gt;     20:           &lt; 1:-&gt;    SetLocal(@18&lt;Function&gt;, CanExit|NodeExitsForward, r10(K~&lt;Function&gt;), bc#5)  predicting Function
&gt;     21:           &lt; 1:-&gt;    SetLocal(@1&lt;Other&gt;, CanExit|NodeExitsForward, r11(L~&lt;Other&gt;), bc#5)  predicting Other
&gt;     22:           &lt; 1:-&gt;    SetLocal(@18&lt;Function&gt;, CanExit|NodeExitsForward, r10(M~&lt;Function&gt;), bc#5)  predicting Function
&gt;     23:           &lt;!0:-&gt;    Phantom(@18&lt;Function&gt;, @1&lt;Other&gt;, MustGen|CanExit, bc#11)
&gt;     --&gt; doStuff#ASE1VK:&lt;0x10935fb70, bc#11, Call, known callee: Cell: 0x1092dec70 (0x105ddf420: Function, NonArray), numArgs+this = 1, stack &gt;= r18&gt;
&gt;       24:           &lt;!0:-&gt;    InlineStart(MustGen, bc#0)
&gt;       25:           &lt; 1:-&gt;    NewObject(JS|UseAsOther|CanExit, struct(0x105ddb6c8: NonArray), bc#1)
&gt;       26:           &lt; 1:-&gt;    SetLocal(@25&lt;Final&gt;, CanExit|NodeExitsForward, r18(N~&lt;Final&gt;), bc#1)  predicting Final
&gt;       27:           &lt;!0:-&gt;    Throw(@25&lt;Final&gt;, MustGen|CanExit, bc#5)
&gt; 
&gt; 
&gt; And then after DCE
&gt;   var links: arg0:@0 : r0:- r1:- r2:- r3:- r4:- r5:- r6:- r7:- r8:- r9:- r10:- r11:- r12:- r13:- r14:- r15:- r16:- r17:- r18:-
&gt;    0:  skipped  &lt; 0:-&gt;    SetArgument(arg0(a), bc#0)
&gt;    1:           &lt; 4:-&gt;    JSConstant(JS|UseAsOther, $0 = Undefined, bc#1)
&gt;    2:           &lt;!0:-&gt;    GlobalVarWatchpoint(MustGen|CanExit, global4(0x105dff9c8), bc#1)
&gt;    3:           &lt; 1:-&gt;    WeakJSConstant(JS|UseAsOther, 0x1092decb0, bc#1)
&gt;    4:  skipped  &lt; 0:-&gt;    MovHint(@1&lt;Other&gt;, r1(B~&lt;Other&gt;), bc#1)
&gt;    5:  skipped  &lt; 0:-&gt;    MovHint(@3&lt;Function&gt;, r0(C~&lt;Function&gt;), bc#1)
&gt;    6:  skipped  &lt; 0:-&gt;    MovHint(@1&lt;Other&gt;, r1(D~&lt;Other&gt;), bc#1)
&gt;    7:  skipped  &lt; 0:-&gt;    MovHint(@3&lt;Function&gt;, r0(E~&lt;Function&gt;), bc#1)
&gt;    8:           &lt;!0:-&gt;    Phantom(@3&lt;Function&gt;, @1&lt;Other&gt;, MustGen, bc#7)
&gt;   --&gt; f#AmUsAH:&lt;0x10935fc70, bc#7, Call, known callee: Cell: 0x1092decb0 (0x105ddf420: Function, NonArray), numArgs+this = 1, stack &gt;= r8&gt;
&gt;      9:           &lt;!0:-&gt;    InlineStart(MustGen, bc#0)
&gt;     10:  skipped  &lt; 0:-&gt;    MovHint(@1&lt;Other&gt;, r8(F*&lt;Other&gt;), bc#0)
&gt;     11:  skipped  &lt; 0:-&gt;    MovHint(@1&lt;Other&gt;, r9(G*&lt;Other&gt;), bc#0)
&gt;     12:           &lt;!0:-&gt;    Phantom(MustGen|CanExit, bc#1)
&gt;     13:           &lt;!0:-&gt;    Phantom(@1&lt;Other&gt;, MustGen, bc#1)
&gt;     14:  skipped  &lt; 0:-&gt;    ZombieHint(r9(H*), bc#1)
&gt;     15:           &lt;!0:-&gt;    Phantom(@1&lt;Other&gt;, MustGen, bc#3)
&gt;     16:  skipped  &lt; 0:-&gt;    ZombieHint(r8(I*), bc#3)
&gt;     17:           &lt;!0:-&gt;    GlobalVarWatchpoint(MustGen|CanExit, global5(0x105dff9d0), bc#5)
&gt;     18:           &lt; 1:-&gt;    WeakJSConstant(JS|UseAsOther, 0x1092dec70, bc#5)
&gt;     19:  skipped  &lt; 0:-&gt;    MovHint(@1&lt;Other&gt;, r11(J~&lt;Other&gt;), bc#5)
&gt;     20:  skipped  &lt; 0:-&gt;    MovHint(@18&lt;Function&gt;, r10(K~&lt;Function&gt;), bc#5)
&gt;     21:  skipped  &lt; 0:-&gt;    MovHint(@1&lt;Other&gt;, r11(L~&lt;Other&gt;), bc#5)
&gt;     22:  skipped  &lt; 0:-&gt;    MovHint(@18&lt;Function&gt;, r10(M~&lt;Function&gt;), bc#5)
&gt;     23:           &lt;!0:-&gt;    Phantom(@18&lt;Function&gt;, @1&lt;Other&gt;, MustGen, bc#11)
&gt;     --&gt; doStuff#ASE1VK:&lt;0x10935fb70, bc#11, Call, known callee: Cell: 0x1092dec70 (0x105ddf420: Function, NonArray), numArgs+this = 1, stack &gt;= r18&gt;
&gt;       24:           &lt;!0:-&gt;    InlineStart(MustGen, bc#0)
&gt;       25:           &lt; 1:-&gt;    NewObject(JS|UseAsOther, struct(0x105ddb6c8: NonArray), bc#1)
&gt;       26:  skipped  &lt; 0:-&gt;    MovHint(@25&lt;Final&gt;, r18(N~&lt;Final&gt;), bc#1)
&gt;       27:           &lt;!0:-&gt;    Throw(@25&lt;Final&gt;, MustGen|CanExit, bc#5)
&gt; 
&gt; 
&gt; Nodes @14 and @16 were responsible for initializing the lazy argument slots, but they have been elided, despite being necessary for correct behavior.
&gt; 
&gt; I can add 
&gt;             addToGraph(Phantom, get(currentInstruction[1].u.operand));
&gt; 
&gt; To init_lazy_reg, and that makes this crash go away, but it feels jacky, and looking at the output graph it is not obvious _why_ we end up with the correct behavior.

No that is definitely not the right solution. Why aren&apos;t those two nodes flushed?  Does the inkined functional ways end in Throw?  If so maybe it&apos;s that op_throw (and ThrowReferenceError) aren&apos;t doing the Flushing that op_ret and op_end do?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>901561</commentid>
    <comment_count>5</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2013-06-18 15:41:43 -0700</bug_when>
    <thetext>(In reply to comment #4)
&gt; (In reply to comment #3)
&gt; &gt; Okay, so if we have:
&gt; &gt; function g() { f() }
&gt; &gt; function f() {  doStuff(); arguments;  }
&gt; &gt; function doStuff() { throw {} }
&gt; &gt; 
&gt; &gt; for (var i = 0; i &lt; 100; i++) { try { g() } catch (e) {} }
&gt; &gt; 
&gt; &gt; 
&gt; &gt; 
&gt; &gt; The initial graph is:
&gt; &gt; DFG for g#BBXOF8:[0x7fe6ad00f000-&gt;0x10935fd70, DFGFunctionCall]:
&gt; &gt;   Fixpoint state: BeforeFixpoint; Form: LoadStore; Unification state: LocallyUnified; Ref count state: EverythingIsLive
&gt; &gt;   ArgumentPosition size: 3
&gt; &gt;     #0: 
&gt; &gt;     #1: 
&gt; &gt;     #2: 
&gt; &gt; Block #0 (bc#0):  (OSR target)
&gt; &gt;   Predecessors:
&gt; &gt;   Phi Nodes:
&gt; &gt;   vars before: &lt;empty&gt;
&gt; &gt;   var links: arg0:- : r0:- r1:- r2:- r3:- r4:- r5:- r6:- r7:- r8:- r9:- r10:- r11:- r12:- r13:- r14:- r15:- r16:- r17:- r18:-
&gt; &gt;    0:           &lt; 1:-&gt;    SetArgument(arg0(a), bc#0)  predicting None
&gt; &gt;    1:           &lt; 1:-&gt;    JSConstant(JS|PureInt, $0 = Undefined, bc#1)
&gt; &gt;    2:           &lt;!0:-&gt;    GlobalVarWatchpoint(MustGen|CanExit, global4(0x105dff9c8), bc#1)
&gt; &gt;    3:           &lt; 1:-&gt;    WeakJSConstant(JS|PureInt, 0x1092decb0, bc#1)
&gt; &gt;    4:           &lt; 1:-&gt;    SetLocal(@1, CanExit|NodeExitsForward, r1(B~), bc#1)  predicting None
&gt; &gt;    5:           &lt; 1:-&gt;    SetLocal(@3, CanExit|NodeExitsForward, r0(C~), bc#1)  predicting None
&gt; &gt;    6:           &lt; 1:-&gt;    SetLocal(@1, CanExit|NodeExitsForward, r1(D~), bc#1)  predicting None
&gt; &gt;    7:           &lt; 1:-&gt;    SetLocal(@3, CanExit|NodeExitsForward, r0(E~), bc#1)  predicting None
&gt; &gt;    8:           &lt;!0:-&gt;    Phantom(@3, @1, MustGen|CanExit, bc#7)
&gt; &gt;   --&gt; f#AmUsAH:&lt;0x10935fc70, bc#7, Call, known callee: Cell: 0x1092decb0 (0x105ddf420: Function, NonArray), numArgs+this = 1, stack &gt;= r8&gt;
&gt; &gt;      9:           &lt;!0:-&gt;    InlineStart(MustGen, bc#0)
&gt; &gt;     10:           &lt; 1:-&gt;    SetLocal(@1, CanExit|NodeExitsForward, r8(F*), bc#0)  predicting None
&gt; &gt;     11:           &lt; 1:-&gt;    SetLocal(@1, CanExit|NodeExitsForward, r9(G*), bc#0)  predicting None
&gt; &gt;     12:           &lt; 1:-&gt;    JSConstant(JS|PureInt, $1 = &lt;JSValue()&gt;, bc#1)
&gt; &gt;     13:           &lt;!0:-&gt;    Flush(MustGen, r9(G*), bc#1)  predicting None
&gt; &gt;     14:           &lt; 1:-&gt;    SetLocal(@12, CanExit|NodeExitsForward, r9(H*), bc#1)  predicting None
&gt; &gt;     15:           &lt;!0:-&gt;    Flush(MustGen, r8(F*), bc#3)  predicting None
&gt; &gt;     16:           &lt; 1:-&gt;    SetLocal(@12, CanExit|NodeExitsForward, r8(I*), bc#3)  predicting None
&gt; 
&gt; Are 14 and 16 flushed?
&gt; 
&gt; &gt;     17:           &lt;!0:-&gt;    GlobalVarWatchpoint(MustGen|CanExit, global5(0x105dff9d0), bc#5)
&gt; &gt;     18:           &lt; 1:-&gt;    WeakJSConstant(JS|PureInt, 0x1092dec70, bc#5)
&gt; &gt;     19:           &lt; 1:-&gt;    SetLocal(@1, CanExit|NodeExitsForward, r11(J~), bc#5)  predicting None
&gt; &gt;     20:           &lt; 1:-&gt;    SetLocal(@18, CanExit|NodeExitsForward, r10(K~), bc#5)  predicting None
&gt; &gt;     21:           &lt; 1:-&gt;    SetLocal(@1, CanExit|NodeExitsForward, r11(L~), bc#5)  predicting None
&gt; &gt;     22:           &lt; 1:-&gt;    SetLocal(@18, CanExit|NodeExitsForward, r10(M~), bc#5)  predicting None
&gt; &gt;     23:           &lt;!0:-&gt;    Phantom(@18, @1, MustGen|CanExit, bc#11)
&gt; &gt;     --&gt; doStuff#ASE1VK:&lt;0x10935fb70, bc#11, Call, known callee: Cell: 0x1092dec70 (0x105ddf420: Function, NonArray), numArgs+this = 1, stack &gt;= r18&gt;
&gt; &gt;       24:           &lt;!0:-&gt;    InlineStart(MustGen, bc#0)
&gt; &gt;       25:           &lt; 1:-&gt;    NewObject(JS|PureInt|CanExit, struct(0x105ddb6c8: NonArray), bc#1)
&gt; &gt;       26:           &lt; 1:-&gt;    SetLocal(@25, CanExit|NodeExitsForward, r18(N~), bc#1)  predicting None
&gt; &gt;       27:           &lt;!0:-&gt;    Throw(@25, MustGen|CanExit, bc#5)
&gt; &gt; 
&gt; &gt; 
&gt; &gt; Which eventually becomes:
&gt; &gt;   var links: arg0:@0 : r0:- r1:- r2:- r3:- r4:- r5:- r6:- r7:- r8:- r9:- r10:- r11:- r12:- r13:- r14:- r15:- r16:- r17:- r18:-
&gt; &gt;    0:           &lt; 1:-&gt;    SetArgument(arg0(a), bc#0)  predicting Other
&gt; &gt;    1:           &lt; 1:-&gt;    JSConstant(JS|UseAsOther, $0 = Undefined, bc#1)
&gt; &gt;    2:           &lt;!0:-&gt;    GlobalVarWatchpoint(MustGen|CanExit, global4(0x105dff9c8), bc#1)
&gt; &gt;    3:           &lt; 1:-&gt;    WeakJSConstant(JS|UseAsOther, 0x1092decb0, bc#1)
&gt; &gt;    4:           &lt; 1:-&gt;    SetLocal(@1&lt;Other&gt;, CanExit|NodeExitsForward, r1(B~&lt;Other&gt;), bc#1)  predicting Other
&gt; &gt;    5:           &lt; 1:-&gt;    SetLocal(@3&lt;Function&gt;, CanExit|NodeExitsForward, r0(C~&lt;Function&gt;), bc#1)  predicting Function
&gt; &gt;    6:           &lt; 1:-&gt;    SetLocal(@1&lt;Other&gt;, CanExit|NodeExitsForward, r1(D~&lt;Other&gt;), bc#1)  predicting Other
&gt; &gt;    7:           &lt; 1:-&gt;    SetLocal(@3&lt;Function&gt;, CanExit|NodeExitsForward, r0(E~&lt;Function&gt;), bc#1)  predicting Function
&gt; &gt;    8:           &lt;!0:-&gt;    Phantom(@3&lt;Function&gt;, @1&lt;Other&gt;, MustGen|CanExit, bc#7)
&gt; &gt;   --&gt; f#AmUsAH:&lt;0x10935fc70, bc#7, Call, known callee: Cell: 0x1092decb0 (0x105ddf420: Function, NonArray), numArgs+this = 1, stack &gt;= r8&gt;
&gt; &gt;      9:           &lt;!0:-&gt;    InlineStart(MustGen, bc#0)
&gt; &gt;     10:           &lt; 1:-&gt;    SetLocal(@1&lt;Other&gt;, CanExit|NodeExitsForward, r8(F*&lt;Other&gt;), bc#0)  predicting Other
&gt; &gt;     11:           &lt; 1:-&gt;    SetLocal(@1&lt;Other&gt;, CanExit|NodeExitsForward, r9(G*&lt;Other&gt;), bc#0)  predicting Other
&gt; &gt;     12:           &lt; 1:-&gt;    JSConstant(JS|PureInt, $1 = &lt;JSValue()&gt;, bc#1)
&gt; &gt;     13:           &lt;!0:-&gt;    Flush(@11, MustGen, r9(G*&lt;Other&gt;), bc#1)  predicting Other
&gt; &gt;     14:           &lt; 1:-&gt;    SetLocal(@12, CanExit|NodeExitsForward, r9(H*), bc#1)  predicting Empty
&gt; &gt;     15:           &lt;!0:-&gt;    Flush(@10, MustGen, r8(F*&lt;Other&gt;), bc#3)  predicting Other
&gt; &gt;     16:           &lt; 1:-&gt;    SetLocal(@12, CanExit|NodeExitsForward, r8(I*), bc#3)  predicting Empty
&gt; &gt;     17:           &lt;!0:-&gt;    GlobalVarWatchpoint(MustGen|CanExit, global5(0x105dff9d0), bc#5)
&gt; &gt;     18:           &lt; 1:-&gt;    WeakJSConstant(JS|UseAsOther, 0x1092dec70, bc#5)
&gt; &gt;     19:           &lt; 1:-&gt;    SetLocal(@1&lt;Other&gt;, CanExit|NodeExitsForward, r11(J~&lt;Other&gt;), bc#5)  predicting Other
&gt; &gt;     20:           &lt; 1:-&gt;    SetLocal(@18&lt;Function&gt;, CanExit|NodeExitsForward, r10(K~&lt;Function&gt;), bc#5)  predicting Function
&gt; &gt;     21:           &lt; 1:-&gt;    SetLocal(@1&lt;Other&gt;, CanExit|NodeExitsForward, r11(L~&lt;Other&gt;), bc#5)  predicting Other
&gt; &gt;     22:           &lt; 1:-&gt;    SetLocal(@18&lt;Function&gt;, CanExit|NodeExitsForward, r10(M~&lt;Function&gt;), bc#5)  predicting Function
&gt; &gt;     23:           &lt;!0:-&gt;    Phantom(@18&lt;Function&gt;, @1&lt;Other&gt;, MustGen|CanExit, bc#11)
&gt; &gt;     --&gt; doStuff#ASE1VK:&lt;0x10935fb70, bc#11, Call, known callee: Cell: 0x1092dec70 (0x105ddf420: Function, NonArray), numArgs+this = 1, stack &gt;= r18&gt;
&gt; &gt;       24:           &lt;!0:-&gt;    InlineStart(MustGen, bc#0)
&gt; &gt;       25:           &lt; 1:-&gt;    NewObject(JS|UseAsOther|CanExit, struct(0x105ddb6c8: NonArray), bc#1)
&gt; &gt;       26:           &lt; 1:-&gt;    SetLocal(@25&lt;Final&gt;, CanExit|NodeExitsForward, r18(N~&lt;Final&gt;), bc#1)  predicting Final
&gt; &gt;       27:           &lt;!0:-&gt;    Throw(@25&lt;Final&gt;, MustGen|CanExit, bc#5)
&gt; &gt; 
&gt; &gt; 
&gt; &gt; And then after DCE
&gt; &gt;   var links: arg0:@0 : r0:- r1:- r2:- r3:- r4:- r5:- r6:- r7:- r8:- r9:- r10:- r11:- r12:- r13:- r14:- r15:- r16:- r17:- r18:-
&gt; &gt;    0:  skipped  &lt; 0:-&gt;    SetArgument(arg0(a), bc#0)
&gt; &gt;    1:           &lt; 4:-&gt;    JSConstant(JS|UseAsOther, $0 = Undefined, bc#1)
&gt; &gt;    2:           &lt;!0:-&gt;    GlobalVarWatchpoint(MustGen|CanExit, global4(0x105dff9c8), bc#1)
&gt; &gt;    3:           &lt; 1:-&gt;    WeakJSConstant(JS|UseAsOther, 0x1092decb0, bc#1)
&gt; &gt;    4:  skipped  &lt; 0:-&gt;    MovHint(@1&lt;Other&gt;, r1(B~&lt;Other&gt;), bc#1)
&gt; &gt;    5:  skipped  &lt; 0:-&gt;    MovHint(@3&lt;Function&gt;, r0(C~&lt;Function&gt;), bc#1)
&gt; &gt;    6:  skipped  &lt; 0:-&gt;    MovHint(@1&lt;Other&gt;, r1(D~&lt;Other&gt;), bc#1)
&gt; &gt;    7:  skipped  &lt; 0:-&gt;    MovHint(@3&lt;Function&gt;, r0(E~&lt;Function&gt;), bc#1)
&gt; &gt;    8:           &lt;!0:-&gt;    Phantom(@3&lt;Function&gt;, @1&lt;Other&gt;, MustGen, bc#7)
&gt; &gt;   --&gt; f#AmUsAH:&lt;0x10935fc70, bc#7, Call, known callee: Cell: 0x1092decb0 (0x105ddf420: Function, NonArray), numArgs+this = 1, stack &gt;= r8&gt;
&gt; &gt;      9:           &lt;!0:-&gt;    InlineStart(MustGen, bc#0)
&gt; &gt;     10:  skipped  &lt; 0:-&gt;    MovHint(@1&lt;Other&gt;, r8(F*&lt;Other&gt;), bc#0)
&gt; &gt;     11:  skipped  &lt; 0:-&gt;    MovHint(@1&lt;Other&gt;, r9(G*&lt;Other&gt;), bc#0)
&gt; &gt;     12:           &lt;!0:-&gt;    Phantom(MustGen|CanExit, bc#1)
&gt; &gt;     13:           &lt;!0:-&gt;    Phantom(@1&lt;Other&gt;, MustGen, bc#1)
&gt; &gt;     14:  skipped  &lt; 0:-&gt;    ZombieHint(r9(H*), bc#1)
&gt; &gt;     15:           &lt;!0:-&gt;    Phantom(@1&lt;Other&gt;, MustGen, bc#3)
&gt; &gt;     16:  skipped  &lt; 0:-&gt;    ZombieHint(r8(I*), bc#3)
&gt; &gt;     17:           &lt;!0:-&gt;    GlobalVarWatchpoint(MustGen|CanExit, global5(0x105dff9d0), bc#5)
&gt; &gt;     18:           &lt; 1:-&gt;    WeakJSConstant(JS|UseAsOther, 0x1092dec70, bc#5)
&gt; &gt;     19:  skipped  &lt; 0:-&gt;    MovHint(@1&lt;Other&gt;, r11(J~&lt;Other&gt;), bc#5)
&gt; &gt;     20:  skipped  &lt; 0:-&gt;    MovHint(@18&lt;Function&gt;, r10(K~&lt;Function&gt;), bc#5)
&gt; &gt;     21:  skipped  &lt; 0:-&gt;    MovHint(@1&lt;Other&gt;, r11(L~&lt;Other&gt;), bc#5)
&gt; &gt;     22:  skipped  &lt; 0:-&gt;    MovHint(@18&lt;Function&gt;, r10(M~&lt;Function&gt;), bc#5)
&gt; &gt;     23:           &lt;!0:-&gt;    Phantom(@18&lt;Function&gt;, @1&lt;Other&gt;, MustGen, bc#11)
&gt; &gt;     --&gt; doStuff#ASE1VK:&lt;0x10935fb70, bc#11, Call, known callee: Cell: 0x1092dec70 (0x105ddf420: Function, NonArray), numArgs+this = 1, stack &gt;= r18&gt;
&gt; &gt;       24:           &lt;!0:-&gt;    InlineStart(MustGen, bc#0)
&gt; &gt;       25:           &lt; 1:-&gt;    NewObject(JS|UseAsOther, struct(0x105ddb6c8: NonArray), bc#1)
&gt; &gt;       26:  skipped  &lt; 0:-&gt;    MovHint(@25&lt;Final&gt;, r18(N~&lt;Final&gt;), bc#1)
&gt; &gt;       27:           &lt;!0:-&gt;    Throw(@25&lt;Final&gt;, MustGen|CanExit, bc#5)
&gt; &gt; 
&gt; &gt; 
&gt; &gt; Nodes @14 and @16 were responsible for initializing the lazy argument slots, but they have been elided, despite being necessary for correct behavior.
&gt; &gt; 
&gt; &gt; I can add 
&gt; &gt;             addToGraph(Phantom, get(currentInstruction[1].u.operand));
&gt; &gt; 
&gt; &gt; To init_lazy_reg, and that makes this crash go away, but it feels jacky, and looking at the output graph it is not obvious _why_ we end up with the correct behavior.
&gt; 
&gt; No that is definitely not the right solution. Why aren&apos;t those two nodes flushed?  Does the inkined functional ways end in Throw?  If so maybe it&apos;s that op_throw (and ThrowReferenceError) aren&apos;t doing the Flushing that op_ret and op_end do?

Just reread the original bug code. Yeah, the bug is that op_throw doesn&apos;t do the flushing that op_ret does. This can be fixed by either copying or abstracting the code in ByteCodeParser for flushing in return, so that throwing also does it.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>901566</commentid>
    <comment_count>6</comment_count>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2013-06-18 15:48:51 -0700</bug_when>
    <thetext>
&gt; Just reread the original bug code. Yeah, the bug is that op_throw doesn&apos;t do the flushing that op_ret does. This can be fixed by either copying or abstracting the code in ByteCodeParser for flushing in return, so that throwing also does it.

Yeah, i was coming to the conclusion as well (there&apos;s another bug i cc&apos;d you on which I think is just another symptom of this)

randomly should op_throw be flagged as clobbers the world?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>901567</commentid>
    <comment_count>7</comment_count>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2013-06-18 15:52:05 -0700</bug_when>
    <thetext>(In reply to comment #6)
&gt; &gt; Just reread the original bug code. Yeah, the bug is that op_throw doesn&apos;t do the flushing that op_ret does. This can be fixed by either copying or abstracting the code in ByteCodeParser for flushing in return, so that throwing also does it.
&gt; 
&gt; Yeah, i was coming to the conclusion as well (there&apos;s another bug i cc&apos;d you on which I think is just another symptom of this)
&gt; 
&gt; randomly should op_throw be flagged as clobbers the world?

Although my reading of the code implies that throw, etc think that they _are_ flushing everything</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>901568</commentid>
    <comment_count>8</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2013-06-18 15:59:44 -0700</bug_when>
    <thetext>(In reply to comment #6)
&gt; &gt; Just reread the original bug code. Yeah, the bug is that op_throw doesn&apos;t do the flushing that op_ret does. This can be fixed by either copying or abstracting the code in ByteCodeParser for flushing in return, so that throwing also does it.
&gt; 
&gt; Yeah, i was coming to the conclusion as well (there&apos;s another bug i cc&apos;d you on which I think is just another symptom of this)
&gt; 
&gt; randomly should op_throw be flagged as clobbers the world?

No, throwing doesn&apos;t clobber, for the same reason that return doesn&apos;t: it&apos;s a terminal.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>901570</commentid>
    <comment_count>9</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2013-06-18 16:07:54 -0700</bug_when>
    <thetext>(In reply to comment #7)
&gt; (In reply to comment #6)
&gt; &gt; &gt; Just reread the original bug code. Yeah, the bug is that op_throw doesn&apos;t do the flushing that op_ret does. This can be fixed by either copying or abstracting the code in ByteCodeParser for flushing in return, so that throwing also does it.
&gt; &gt; 
&gt; &gt; Yeah, i was coming to the conclusion as well (there&apos;s another bug i cc&apos;d you on which I think is just another symptom of this)
&gt; &gt; 
&gt; &gt; randomly should op_throw be flagged as clobbers the world?
&gt; 
&gt; Although my reading of the code implies that throw, etc think that they _are_ flushing everything

Lololololo. 

I see the bug and its awesome. 

Throw is doing the right thing, if throw behaved like return. Return just &quot;pops&quot; the function you&apos;re returning from. But throw pops all functions we&apos;ve inkined: it is a hard terminal. So throw must flush eveything but it only flushes things from inline stack top. That&apos;s why the bug manifests if you throw from something that is inlined into an arguments-using function; presumably throwing directly won&apos;t break it. 

Just make throw flush things for all inline stack entries and not just the top one.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>901573</commentid>
    <comment_count>10</comment_count>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2013-06-18 16:09:15 -0700</bug_when>
    <thetext>*** Bug 117749 has been marked as a duplicate of this bug. ***</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>901575</commentid>
    <comment_count>11</comment_count>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2013-06-18 16:22:00 -0700</bug_when>
    <thetext>Okay I believe i have this fixed</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>901592</commentid>
    <comment_count>12</comment_count>
      <attachid>204956</attachid>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2013-06-18 17:11:32 -0700</bug_when>
    <thetext>Created attachment 204956
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>901595</commentid>
    <comment_count>13</comment_count>
      <attachid>204956</attachid>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2013-06-18 17:27:20 -0700</bug_when>
    <thetext>Comment on attachment 204956
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=204956&amp;action=review

&gt; Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:452
&gt; +        for (InlineStackEntry* stack = m_inlineStackTop; stack; stack = stack-&gt;m_caller) {

I&apos;d call this variable &quot;entry&quot;, not &quot;stack&quot;, since it&apos;s an entry in the stack, and not the whole stack.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>901599</commentid>
    <comment_count>14</comment_count>
      <attachid>204958</attachid>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2013-06-18 17:31:49 -0700</bug_when>
    <thetext>Created attachment 204958
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>901601</commentid>
    <comment_count>15</comment_count>
      <attachid>204958</attachid>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2013-06-18 17:33:53 -0700</bug_when>
    <thetext>Comment on attachment 204958
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=204958&amp;action=review

r=me

&gt; Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:458
&gt; +    void flushInlineStackEntry(InlineStackEntry* inlineStackEntry)

You can just call this &quot;flush&quot;, since the type disambiguates in C++.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>901603</commentid>
    <comment_count>16</comment_count>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2013-06-18 17:36:22 -0700</bug_when>
    <thetext>Committed r151709: &lt;http://trac.webkit.org/changeset/151709&gt;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>204956</attachid>
            <date>2013-06-18 17:11:32 -0700</date>
            <delta_ts>2013-06-18 17:31:47 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-117602-20130618171115.patch</filename>
            <type>text/plain</type>
            <size>5862</size>
            <attacher name="Oliver Hunt">oliver</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTUxNzA2CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw
dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCBh
M2ZkODU1MzA4NzYwNDM3MDY2NjUyOGY2YmZhZWNmMWM2ZGM3Njg5Li5kMTg0YWQ1ODAzYjUzZDZj
ZGJlMTQ0Y2E3NWRkYjllMjk2MzYzYmU3IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv
cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs
MyArMSwxNyBAQAorMjAxMy0wNi0xOCAgT2xpdmVyIEh1bnQgIDxvbGl2ZXJAYXBwbGUuY29tPgor
CisgICAgICAgIEdvaW5nIHRvIGdvb2dsZS5jb20vdHJlbmRzIGNhdXNlcyBhIGNyYXNoCisgICAg
ICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMTc2MDIKKworICAg
ICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBXaGVuIGhhbmRsaW5n
IG9wX3Rocm93LCBldGMgd2UgbmVlZCB0byBmbHVzaCB0aGUgdmFyaWFibGVzIGFuZCBhcmd1bWVu
dHMKKyAgICAgICAgZm9yIHRoZSBlbnRpcmUgaW5saW5lIHN0YWNrLCBub3QganVzdCB0aGUgdG9w
IGZyYW1lLgorCisgICAgICAgICogZGZnL0RGR0J5dGVDb2RlUGFyc2VyLmNwcDoKKyAgICAgICAg
KEpTQzo6REZHOjpCeXRlQ29kZVBhcnNlcjo6Zmx1c2hBbGxBcmd1bWVudHNBbmRDYXB0dXJlZFZh
cmlhYmxlc0luSW5saW5lU3RhY2spOgorICAgICAgICAoSlNDOjpERkc6OkJ5dGVDb2RlUGFyc2Vy
OjpwYXJzZUJsb2NrKToKKwogMjAxMy0wNi0xOCAgUm9nZXIgRm9uZyAgPHJvZ2VyX2ZvbmdAYXBw
bGUuY29tPgogCiAgICAgICAgIFJlcGxhY2UgdG9vbHMzMiBmb2xkZXIgd2l0aCB0b29scyBhbmQg
dXBkYXRlIFdlYktpdCBXaW5kb3dzIHNvbHV0aW9uIGFjY29yZGluZ2x5LgpkaWZmIC0tZ2l0IGEv
U291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdCeXRlQ29kZVBhcnNlci5jcHAgYi9Tb3VyY2Uv
SmF2YVNjcmlwdENvcmUvZGZnL0RGR0J5dGVDb2RlUGFyc2VyLmNwcAppbmRleCAwZDQ2YzgxNjJj
NWU4MzIzZWM3MGYxMzA2ODc2MjQzODYyMTk4YWY3Li42MGRiNGZiNjk5MjAxZjQyYzk2OWExMzVh
MDg4MzI3ZmU4YzczZTQxIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RG
R0J5dGVDb2RlUGFyc2VyLmNwcAorKysgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0J5
dGVDb2RlUGFyc2VyLmNwcApAQCAtNDQ2LDcgKzQ0NiwyNSBAQCBwcml2YXRlOgogICAgICAgICBp
ZiAoYXJndW1lbnRQb3NpdGlvbikKICAgICAgICAgICAgIGFyZ3VtZW50UG9zaXRpb24tPmFkZFZh
cmlhYmxlKHZhcmlhYmxlKTsKICAgICB9Ci0gICAgCisKKyAgICB2b2lkIGZsdXNoQWxsQXJndW1l
bnRzQW5kQ2FwdHVyZWRWYXJpYWJsZXNJbklubGluZVN0YWNrKCkKKyAgICB7CisgICAgICAgIGZv
ciAoSW5saW5lU3RhY2tFbnRyeSogc3RhY2sgPSBtX2lubGluZVN0YWNrVG9wOyBzdGFjazsgc3Rh
Y2sgPSBzdGFjay0+bV9jYWxsZXIpIHsKKyAgICAgICAgICAgIGludCBudW1Bcmd1bWVudHM7Cisg
ICAgICAgICAgICBpZiAoSW5saW5lQ2FsbEZyYW1lKiBpbmxpbmVDYWxsRnJhbWUgPSBzdGFjay0+
bV9pbmxpbmVDYWxsRnJhbWUpCisgICAgICAgICAgICAgICAgbnVtQXJndW1lbnRzID0gaW5saW5l
Q2FsbEZyYW1lLT5hcmd1bWVudHMuc2l6ZSgpOworICAgICAgICAgICAgZWxzZQorICAgICAgICAg
ICAgICAgIG51bUFyZ3VtZW50cyA9IHN0YWNrLT5tX2NvZGVCbG9jay0+bnVtUGFyYW1ldGVycygp
OworICAgICAgICAgICAgZm9yICh1bnNpZ25lZCBhcmd1bWVudCA9IG51bUFyZ3VtZW50czsgYXJn
dW1lbnQtLSA+IDE7KQorICAgICAgICAgICAgICAgIGZsdXNoRGlyZWN0KHN0YWNrLT5yZW1hcE9w
ZXJhbmQoYXJndW1lbnRUb09wZXJhbmQoYXJndW1lbnQpKSk7CisgICAgICAgICAgICBmb3IgKGlu
dCBsb2NhbCA9IDA7IGxvY2FsIDwgc3RhY2stPm1fY29kZUJsb2NrLT5tX251bVZhcnM7ICsrbG9j
YWwpIHsKKyAgICAgICAgICAgICAgICBpZiAoIXN0YWNrLT5tX2NvZGVCbG9jay0+aXNDYXB0dXJl
ZChsb2NhbCkpCisgICAgICAgICAgICAgICAgICAgIGNvbnRpbnVlOworICAgICAgICAgICAgICAg
IGZsdXNoRGlyZWN0KHN0YWNrLT5yZW1hcE9wZXJhbmQobG9jYWwpKTsKKyAgICAgICAgICAgIH0K
KyAgICAgICAgfQorICAgIH0KKwogICAgIHZvaWQgZmx1c2hBcmd1bWVudHNBbmRDYXB0dXJlZFZh
cmlhYmxlcygpCiAgICAgewogICAgICAgICBpbnQgbnVtQXJndW1lbnRzOwpAQCAtMzAxMSwxMiAr
MzAyOSwxMiBAQCBib29sIEJ5dGVDb2RlUGFyc2VyOjpwYXJzZUJsb2NrKHVuc2lnbmVkIGxpbWl0
KQogICAgICAgICAgICAgTEFTVF9PUENPREUob3BfZW5kKTsKIAogICAgICAgICBjYXNlIG9wX3Ro
cm93OgotICAgICAgICAgICAgZmx1c2hBcmd1bWVudHNBbmRDYXB0dXJlZFZhcmlhYmxlcygpOwor
ICAgICAgICAgICAgZmx1c2hBbGxBcmd1bWVudHNBbmRDYXB0dXJlZFZhcmlhYmxlc0luSW5saW5l
U3RhY2soKTsKICAgICAgICAgICAgIGFkZFRvR3JhcGgoVGhyb3csIGdldChjdXJyZW50SW5zdHJ1
Y3Rpb25bMV0udS5vcGVyYW5kKSk7CiAgICAgICAgICAgICBMQVNUX09QQ09ERShvcF90aHJvdyk7
CiAgICAgICAgICAgICAKICAgICAgICAgY2FzZSBvcF90aHJvd19zdGF0aWNfZXJyb3I6Ci0gICAg
ICAgICAgICBmbHVzaEFyZ3VtZW50c0FuZENhcHR1cmVkVmFyaWFibGVzKCk7CisgICAgICAgICAg
ICBmbHVzaEFsbEFyZ3VtZW50c0FuZENhcHR1cmVkVmFyaWFibGVzSW5JbmxpbmVTdGFjaygpOwog
ICAgICAgICAgICAgYWRkVG9HcmFwaChUaHJvd1JlZmVyZW5jZUVycm9yKTsKICAgICAgICAgICAg
IExBU1RfT1BDT0RFKG9wX3Rocm93X3N0YXRpY19lcnJvcik7CiAgICAgICAgICAgICAKZGlmZiAt
LWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRl
eCBiYmFmNDM0OTljMDY5NWI0ZWVmZjAwNGE3OWU4NWRkNDMxZjRhOGVhLi45NmM0MjE1YjVmNzgx
NjFlOTI5MTEwYTc5N2IyNjM3MTZkZjhkYmNkIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFu
Z2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMjAgQEAKKzIwMTMt
MDYtMTggIE9saXZlciBIdW50ICA8b2xpdmVyQGFwcGxlLmNvbT4KKworICAgICAgICBHb2luZyB0
byBnb29nbGUuY29tL3RyZW5kcyBjYXVzZXMgYSBjcmFzaAorICAgICAgICBodHRwczovL2J1Z3Mu
d2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTE3NjAyCisKKyAgICAgICAgUmV2aWV3ZWQgYnkg
Tk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgTWFrZSBzdXJlIHdlIGNvcnJlY3RseSBpbml0aWFs
aXNlIHRoZSBhcHByb3ByaWF0ZSBhcmd1bWVudCByZWdpc3RlcnMsCisgICAgICAgIGFuZCBtYWtl
IHN1cmUgd2UgcGVyZm9ybSB0aGUgdGVhcm9mZiBjb3JyZWN0bHkuCisKKyAgICAgICAgKiBmYXN0
L2pzL2lubGluZS1hcmd1bWVudHMtdGVhci1vZmYtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAg
ICAgKiBmYXN0L2pzL2lubGluZS1hcmd1bWVudHMtdGVhci1vZmYuaHRtbDogQWRkZWQuCisgICAg
ICAgICogZmFzdC9qcy9zY3JpcHQtdGVzdHMvaW5saW5lLWFyZ3VtZW50cy10ZWFyLW9mZi5qczog
QWRkZWQuCisgICAgICAgIChnKToKKyAgICAgICAgKGYpOgorICAgICAgICAoZG9TdHVmZik6CisK
IDIwMTMtMDYtMTggIEJlbmphbWluIFBvdWxhaW4gIDxicG91bGFpbkBhcHBsZS5jb20+CiAKICAg
ICAgICAgUmViYXNlbGluZSBhZnRlciBzeXN0ZW0gdXBkYXRlCmRpZmYgLS1naXQgYS9MYXlvdXRU
ZXN0cy9mYXN0L2pzL2lubGluZS1hcmd1bWVudHMtdGVhci1vZmYtZXhwZWN0ZWQudHh0IGIvTGF5
b3V0VGVzdHMvZmFzdC9qcy9pbmxpbmUtYXJndW1lbnRzLXRlYXItb2ZmLWV4cGVjdGVkLnR4dApu
ZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
MDAwMDAwMDAwLi45YWQzMDE3ZGVjYTk4M2ZiYWM3ZTk1ZjFhZTJkOGI1NzVmNzYzN2I4Ci0tLSAv
ZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9qcy9pbmxpbmUtYXJndW1lbnRzLXRlYXIt
b2ZmLWV4cGVjdGVkLnR4dApAQCAtMCwwICsxLDExIEBACitFbnN1cmUgdGhhdCB3ZSBjb3JyZWN0
bHkgdGVhcm9mZiB0aGUgYXJndW1lbnRzIG9iamVjdHMgd2hlbiB0aHJvd2luZyBmcm9tIGlubGlu
ZWQgZnVuY3Rpb24KKworT24gc3VjY2VzcywgeW91IHdpbGwgc2VlIGEgc2VyaWVzIG9mICJQQVNT
IiBtZXNzYWdlcywgZm9sbG93ZWQgYnkgIlRFU1QgQ09NUExFVEUiLgorCisKK1BBU1MgZmlmdGll
dGhBcmd1bWVudHNbMF0gaXMgNTAKK1BBU1MgZmlmdGlldGhBcmd1bWVudHMubGVuZ3RoIGlzIDEK
K1BBU1Mgc3VjY2Vzc2Z1bGx5UGFyc2VkIGlzIHRydWUKKworVEVTVCBDT01QTEVURQorCmRpZmYg
LS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L2pzL2lubGluZS1hcmd1bWVudHMtdGVhci1vZmYuaHRt
bCBiL0xheW91dFRlc3RzL2Zhc3QvanMvaW5saW5lLWFyZ3VtZW50cy10ZWFyLW9mZi5odG1sCm5l
dyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
MDAwMDAwMDAuLmU1MmUyYTI4YzA3MmU0ZTRiNDkzNzU4Mjk4OTQyZDhhNTEyMGVkMjcKLS0tIC9k
ZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2pzL2lubGluZS1hcmd1bWVudHMtdGVhci1v
ZmYuaHRtbApAQCAtMCwwICsxLDEwIEBACis8IURPQ1RZUEUgSFRNTCBQVUJMSUMgIi0vL0lFVEYv
L0RURCBIVE1MLy9FTiI+Cis8aHRtbD4KKzxoZWFkPgorPHNjcmlwdCBzcmM9InJlc291cmNlcy9q
cy10ZXN0LXByZS5qcyI+PC9zY3JpcHQ+Cis8L2hlYWQ+Cis8Ym9keT4KKzxzY3JpcHQgc3JjPSJz
Y3JpcHQtdGVzdHMvaW5saW5lLWFyZ3VtZW50cy10ZWFyLW9mZi5qcyI+PC9zY3JpcHQ+Cis8c2Ny
aXB0IHNyYz0icmVzb3VyY2VzL2pzLXRlc3QtcG9zdC5qcyI+PC9zY3JpcHQ+Cis8L2JvZHk+Cis8
L2h0bWw+CmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L2pzL3NjcmlwdC10ZXN0cy9pbmxp
bmUtYXJndW1lbnRzLXRlYXItb2ZmLmpzIGIvTGF5b3V0VGVzdHMvZmFzdC9qcy9zY3JpcHQtdGVz
dHMvaW5saW5lLWFyZ3VtZW50cy10ZWFyLW9mZi5qcwpuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRl
eCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi43YWNmNmU3NmFmMzcy
NzNjZGIwNjBlYWI3YjA4YzIyZDcyNjBmMmRiCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVz
dHMvZmFzdC9qcy9zY3JpcHQtdGVzdHMvaW5saW5lLWFyZ3VtZW50cy10ZWFyLW9mZi5qcwpAQCAt
MCwwICsxLDE1IEBACitkZXNjcmlwdGlvbigiRW5zdXJlIHRoYXQgd2UgY29ycmVjdGx5IHRlYXJv
ZmYgdGhlIGFyZ3VtZW50cyBvYmplY3RzIHdoZW4gdGhyb3dpbmcgZnJvbSBpbmxpbmVkIGZ1bmN0
aW9uIik7CisKK3ZhciBmaWZ0aWV0aEFyZ3VtZW50cyA9IG51bGw7CisKK2Z1bmN0aW9uIGcoYSkg
eyBpZiAoYSA9PT0gNTApIGZpZnRpZXRoQXJndW1lbnRzID0gYXJndW1lbnRzOyBmKCk7IH0KK2Z1
bmN0aW9uIGYoKSB7IGRvU3R1ZmYoKTsgIH0KK2Z1bmN0aW9uIGRvU3R1ZmYoKSB7IHRocm93IHt9
OyB9CisKKworZm9yICh2YXIgaSA9IDA7IGkgPCAxMDA7IGkrKykgeyB0cnkgeyAgZyhpKSB9IGNh
dGNoIChlKSB7IH0gfQorCitzaG91bGRCZSgiZmlmdGlldGhBcmd1bWVudHNbMF0iLCAiNTAiKTsK
K3Nob3VsZEJlKCJmaWZ0aWV0aEFyZ3VtZW50cy5sZW5ndGgiLCAiMSIpOworCisK
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>204958</attachid>
            <date>2013-06-18 17:31:49 -0700</date>
            <delta_ts>2013-06-18 17:33:53 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-117602-20130618173133.patch</filename>
            <type>text/plain</type>
            <size>6854</size>
            <attacher name="Oliver Hunt">oliver</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTUxNzA2CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw
dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCBh
M2ZkODU1MzA4NzYwNDM3MDY2NjUyOGY2YmZhZWNmMWM2ZGM3Njg5Li5kMTg0YWQ1ODAzYjUzZDZj
ZGJlMTQ0Y2E3NWRkYjllMjk2MzYzYmU3IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv
cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs
MyArMSwxNyBAQAorMjAxMy0wNi0xOCAgT2xpdmVyIEh1bnQgIDxvbGl2ZXJAYXBwbGUuY29tPgor
CisgICAgICAgIEdvaW5nIHRvIGdvb2dsZS5jb20vdHJlbmRzIGNhdXNlcyBhIGNyYXNoCisgICAg
ICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMTc2MDIKKworICAg
ICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBXaGVuIGhhbmRsaW5n
IG9wX3Rocm93LCBldGMgd2UgbmVlZCB0byBmbHVzaCB0aGUgdmFyaWFibGVzIGFuZCBhcmd1bWVu
dHMKKyAgICAgICAgZm9yIHRoZSBlbnRpcmUgaW5saW5lIHN0YWNrLCBub3QganVzdCB0aGUgdG9w
IGZyYW1lLgorCisgICAgICAgICogZGZnL0RGR0J5dGVDb2RlUGFyc2VyLmNwcDoKKyAgICAgICAg
KEpTQzo6REZHOjpCeXRlQ29kZVBhcnNlcjo6Zmx1c2hBbGxBcmd1bWVudHNBbmRDYXB0dXJlZFZh
cmlhYmxlc0luSW5saW5lU3RhY2spOgorICAgICAgICAoSlNDOjpERkc6OkJ5dGVDb2RlUGFyc2Vy
OjpwYXJzZUJsb2NrKToKKwogMjAxMy0wNi0xOCAgUm9nZXIgRm9uZyAgPHJvZ2VyX2ZvbmdAYXBw
bGUuY29tPgogCiAgICAgICAgIFJlcGxhY2UgdG9vbHMzMiBmb2xkZXIgd2l0aCB0b29scyBhbmQg
dXBkYXRlIFdlYktpdCBXaW5kb3dzIHNvbHV0aW9uIGFjY29yZGluZ2x5LgpkaWZmIC0tZ2l0IGEv
U291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdCeXRlQ29kZVBhcnNlci5jcHAgYi9Tb3VyY2Uv
SmF2YVNjcmlwdENvcmUvZGZnL0RGR0J5dGVDb2RlUGFyc2VyLmNwcAppbmRleCAwZDQ2YzgxNjJj
NWU4MzIzZWM3MGYxMzA2ODc2MjQzODYyMTk4YWY3Li5mYmE4OGU3NTk0OWRjOWU3NWRiNWI4ZDA3
NWQzM2M4ODA5MGU1ZGI1IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RG
R0J5dGVDb2RlUGFyc2VyLmNwcAorKysgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0J5
dGVDb2RlUGFyc2VyLmNwcApAQCAtMTU0LDYgKzE1NCw4IEBAIHB1YmxpYzoKICAgICBib29sIHBh
cnNlKCk7CiAgICAgCiBwcml2YXRlOgorICAgIHN0cnVjdCBJbmxpbmVTdGFja0VudHJ5OworCiAg
ICAgLy8gSnVzdCBwYXJzZSBmcm9tIG1fY3VycmVudEluZGV4IHRvIHRoZSBlbmQgb2YgdGhlIGN1
cnJlbnQgQ29kZUJsb2NrLgogICAgIHZvaWQgcGFyc2VDb2RlQmxvY2soKTsKIApAQCAtNDQ2LDIz
ICs0NDgsMzUgQEAgcHJpdmF0ZToKICAgICAgICAgaWYgKGFyZ3VtZW50UG9zaXRpb24pCiAgICAg
ICAgICAgICBhcmd1bWVudFBvc2l0aW9uLT5hZGRWYXJpYWJsZSh2YXJpYWJsZSk7CiAgICAgfQot
ICAgIAotICAgIHZvaWQgZmx1c2hBcmd1bWVudHNBbmRDYXB0dXJlZFZhcmlhYmxlcygpCisKKyAg
ICB2b2lkIGZsdXNoQWxsQXJndW1lbnRzQW5kQ2FwdHVyZWRWYXJpYWJsZXNJbklubGluZVN0YWNr
KCkKKyAgICB7CisgICAgICAgIGZvciAoSW5saW5lU3RhY2tFbnRyeSogaW5saW5lU3RhY2tFbnRy
eSA9IG1faW5saW5lU3RhY2tUb3A7IGlubGluZVN0YWNrRW50cnk7IGlubGluZVN0YWNrRW50cnkg
PSBpbmxpbmVTdGFja0VudHJ5LT5tX2NhbGxlcikKKyAgICAgICAgICAgIGZsdXNoSW5saW5lU3Rh
Y2tFbnRyeShpbmxpbmVTdGFja0VudHJ5KTsKKyAgICB9CisKKyAgICB2b2lkIGZsdXNoSW5saW5l
U3RhY2tFbnRyeShJbmxpbmVTdGFja0VudHJ5KiBpbmxpbmVTdGFja0VudHJ5KQogICAgIHsKICAg
ICAgICAgaW50IG51bUFyZ3VtZW50czsKLSAgICAgICAgaWYgKGlubGluZUNhbGxGcmFtZSgpKQot
ICAgICAgICAgICAgbnVtQXJndW1lbnRzID0gaW5saW5lQ2FsbEZyYW1lKCktPmFyZ3VtZW50cy5z
aXplKCk7CisgICAgICAgIGlmIChJbmxpbmVDYWxsRnJhbWUqIGlubGluZUNhbGxGcmFtZSA9IGlu
bGluZVN0YWNrRW50cnktPm1faW5saW5lQ2FsbEZyYW1lKQorICAgICAgICAgICAgbnVtQXJndW1l
bnRzID0gaW5saW5lQ2FsbEZyYW1lLT5hcmd1bWVudHMuc2l6ZSgpOwogICAgICAgICBlbHNlCi0g
ICAgICAgICAgICBudW1Bcmd1bWVudHMgPSBtX2lubGluZVN0YWNrVG9wLT5tX2NvZGVCbG9jay0+
bnVtUGFyYW1ldGVycygpOworICAgICAgICAgICAgbnVtQXJndW1lbnRzID0gaW5saW5lU3RhY2tF
bnRyeS0+bV9jb2RlQmxvY2stPm51bVBhcmFtZXRlcnMoKTsKICAgICAgICAgZm9yICh1bnNpZ25l
ZCBhcmd1bWVudCA9IG51bUFyZ3VtZW50czsgYXJndW1lbnQtLSA+IDE7KQotICAgICAgICAgICAg
Zmx1c2goYXJndW1lbnRUb09wZXJhbmQoYXJndW1lbnQpKTsKLSAgICAgICAgZm9yIChpbnQgbG9j
YWwgPSAwOyBsb2NhbCA8IG1faW5saW5lU3RhY2tUb3AtPm1fY29kZUJsb2NrLT5tX251bVZhcnM7
ICsrbG9jYWwpIHsKLSAgICAgICAgICAgIGlmICghbV9pbmxpbmVTdGFja1RvcC0+bV9jb2RlQmxv
Y2stPmlzQ2FwdHVyZWQobG9jYWwpKQorICAgICAgICAgICAgZmx1c2hEaXJlY3QoaW5saW5lU3Rh
Y2tFbnRyeS0+cmVtYXBPcGVyYW5kKGFyZ3VtZW50VG9PcGVyYW5kKGFyZ3VtZW50KSkpOworICAg
ICAgICBmb3IgKGludCBsb2NhbCA9IDA7IGxvY2FsIDwgaW5saW5lU3RhY2tFbnRyeS0+bV9jb2Rl
QmxvY2stPm1fbnVtVmFyczsgKytsb2NhbCkgeworICAgICAgICAgICAgaWYgKCFpbmxpbmVTdGFj
a0VudHJ5LT5tX2NvZGVCbG9jay0+aXNDYXB0dXJlZChsb2NhbCkpCiAgICAgICAgICAgICAgICAg
Y29udGludWU7Ci0gICAgICAgICAgICBmbHVzaChsb2NhbCk7CisgICAgICAgICAgICBmbHVzaERp
cmVjdChpbmxpbmVTdGFja0VudHJ5LT5yZW1hcE9wZXJhbmQobG9jYWwpKTsKICAgICAgICAgfQog
ICAgIH0KIAorCisgICAgdm9pZCBmbHVzaEFyZ3VtZW50c0FuZENhcHR1cmVkVmFyaWFibGVzKCkK
KyAgICB7CisgICAgICAgIGZsdXNoSW5saW5lU3RhY2tFbnRyeShtX2lubGluZVN0YWNrVG9wKTsK
KyAgICB9CisKICAgICAvLyBHZXQgYW4gb3BlcmFuZCwgYW5kIHBlcmZvcm0gYSBUb0ludDMyL1Rv
TnVtYmVyIGNvbnZlcnNpb24gb24gaXQuCiAgICAgTm9kZSogZ2V0VG9JbnQzMihpbnQgb3BlcmFu
ZCkKICAgICB7CkBAIC0zMDExLDEyICszMDI1LDEyIEBAIGJvb2wgQnl0ZUNvZGVQYXJzZXI6OnBh
cnNlQmxvY2sodW5zaWduZWQgbGltaXQpCiAgICAgICAgICAgICBMQVNUX09QQ09ERShvcF9lbmQp
OwogCiAgICAgICAgIGNhc2Ugb3BfdGhyb3c6Ci0gICAgICAgICAgICBmbHVzaEFyZ3VtZW50c0Fu
ZENhcHR1cmVkVmFyaWFibGVzKCk7CisgICAgICAgICAgICBmbHVzaEFsbEFyZ3VtZW50c0FuZENh
cHR1cmVkVmFyaWFibGVzSW5JbmxpbmVTdGFjaygpOwogICAgICAgICAgICAgYWRkVG9HcmFwaChU
aHJvdywgZ2V0KGN1cnJlbnRJbnN0cnVjdGlvblsxXS51Lm9wZXJhbmQpKTsKICAgICAgICAgICAg
IExBU1RfT1BDT0RFKG9wX3Rocm93KTsKICAgICAgICAgICAgIAogICAgICAgICBjYXNlIG9wX3Ro
cm93X3N0YXRpY19lcnJvcjoKLSAgICAgICAgICAgIGZsdXNoQXJndW1lbnRzQW5kQ2FwdHVyZWRW
YXJpYWJsZXMoKTsKKyAgICAgICAgICAgIGZsdXNoQWxsQXJndW1lbnRzQW5kQ2FwdHVyZWRWYXJp
YWJsZXNJbklubGluZVN0YWNrKCk7CiAgICAgICAgICAgICBhZGRUb0dyYXBoKFRocm93UmVmZXJl
bmNlRXJyb3IpOwogICAgICAgICAgICAgTEFTVF9PUENPREUob3BfdGhyb3dfc3RhdGljX2Vycm9y
KTsKICAgICAgICAgICAgIApkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5
b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IGJiYWY0MzQ5OWMwNjk1YjRlZWZmMDA0YTc5ZTg1ZGQ0
MzFmNGE4ZWEuLjk2YzQyMTViNWY3ODE2MWU5MjkxMTBhNzk3YjI2MzcxNmRmOGRiY2QgMTAwNjQ0
Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cK
QEAgLTEsMyArMSwyMCBAQAorMjAxMy0wNi0xOCAgT2xpdmVyIEh1bnQgIDxvbGl2ZXJAYXBwbGUu
Y29tPgorCisgICAgICAgIEdvaW5nIHRvIGdvb2dsZS5jb20vdHJlbmRzIGNhdXNlcyBhIGNyYXNo
CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMTc2MDIK
KworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBNYWtlIHN1
cmUgd2UgY29ycmVjdGx5IGluaXRpYWxpc2UgdGhlIGFwcHJvcHJpYXRlIGFyZ3VtZW50IHJlZ2lz
dGVycywKKyAgICAgICAgYW5kIG1ha2Ugc3VyZSB3ZSBwZXJmb3JtIHRoZSB0ZWFyb2ZmIGNvcnJl
Y3RseS4KKworICAgICAgICAqIGZhc3QvanMvaW5saW5lLWFyZ3VtZW50cy10ZWFyLW9mZi1leHBl
Y3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGZhc3QvanMvaW5saW5lLWFyZ3VtZW50cy10ZWFy
LW9mZi5odG1sOiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2pzL3NjcmlwdC10ZXN0cy9pbmxpbmUt
YXJndW1lbnRzLXRlYXItb2ZmLmpzOiBBZGRlZC4KKyAgICAgICAgKGcpOgorICAgICAgICAoZik6
CisgICAgICAgIChkb1N0dWZmKToKKwogMjAxMy0wNi0xOCAgQmVuamFtaW4gUG91bGFpbiAgPGJw
b3VsYWluQGFwcGxlLmNvbT4KIAogICAgICAgICBSZWJhc2VsaW5lIGFmdGVyIHN5c3RlbSB1cGRh
dGUKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvanMvaW5saW5lLWFyZ3VtZW50cy10ZWFy
LW9mZi1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9mYXN0L2pzL2lubGluZS1hcmd1bWVudHMt
dGVhci1vZmYtZXhwZWN0ZWQudHh0Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAw
MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLjlhZDMwMTdkZWNhOTgzZmJhYzdlOTVm
MWFlMmQ4YjU3NWY3NjM3YjgKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2pz
L2lubGluZS1hcmd1bWVudHMtdGVhci1vZmYtZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEsMTEgQEAK
K0Vuc3VyZSB0aGF0IHdlIGNvcnJlY3RseSB0ZWFyb2ZmIHRoZSBhcmd1bWVudHMgb2JqZWN0cyB3
aGVuIHRocm93aW5nIGZyb20gaW5saW5lZCBmdW5jdGlvbgorCitPbiBzdWNjZXNzLCB5b3Ugd2ls
bCBzZWUgYSBzZXJpZXMgb2YgIlBBU1MiIG1lc3NhZ2VzLCBmb2xsb3dlZCBieSAiVEVTVCBDT01Q
TEVURSIuCisKKworUEFTUyBmaWZ0aWV0aEFyZ3VtZW50c1swXSBpcyA1MAorUEFTUyBmaWZ0aWV0
aEFyZ3VtZW50cy5sZW5ndGggaXMgMQorUEFTUyBzdWNjZXNzZnVsbHlQYXJzZWQgaXMgdHJ1ZQor
CitURVNUIENPTVBMRVRFCisKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvanMvaW5saW5l
LWFyZ3VtZW50cy10ZWFyLW9mZi5odG1sIGIvTGF5b3V0VGVzdHMvZmFzdC9qcy9pbmxpbmUtYXJn
dW1lbnRzLXRlYXItb2ZmLmh0bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAw
MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uZTUyZTJhMjhjMDcyZTRlNGI0OTM3NTgy
OTg5NDJkOGE1MTIwZWQyNwotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2Zhc3QvanMv
aW5saW5lLWFyZ3VtZW50cy10ZWFyLW9mZi5odG1sCkBAIC0wLDAgKzEsMTAgQEAKKzwhRE9DVFlQ
RSBIVE1MIFBVQkxJQyAiLS8vSUVURi8vRFREIEhUTUwvL0VOIj4KKzxodG1sPgorPGhlYWQ+Cis8
c2NyaXB0IHNyYz0icmVzb3VyY2VzL2pzLXRlc3QtcHJlLmpzIj48L3NjcmlwdD4KKzwvaGVhZD4K
Kzxib2R5PgorPHNjcmlwdCBzcmM9InNjcmlwdC10ZXN0cy9pbmxpbmUtYXJndW1lbnRzLXRlYXIt
b2ZmLmpzIj48L3NjcmlwdD4KKzxzY3JpcHQgc3JjPSJyZXNvdXJjZXMvanMtdGVzdC1wb3N0Lmpz
Ij48L3NjcmlwdD4KKzwvYm9keT4KKzwvaHRtbD4KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zh
c3QvanMvc2NyaXB0LXRlc3RzL2lubGluZS1hcmd1bWVudHMtdGVhci1vZmYuanMgYi9MYXlvdXRU
ZXN0cy9mYXN0L2pzL3NjcmlwdC10ZXN0cy9pbmxpbmUtYXJndW1lbnRzLXRlYXItb2ZmLmpzCm5l
dyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
MDAwMDAwMDAuLjdhY2Y2ZTc2YWYzNzI3M2NkYjA2MGVhYjdiMDhjMjJkNzI2MGYyZGIKLS0tIC9k
ZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2pzL3NjcmlwdC10ZXN0cy9pbmxpbmUtYXJn
dW1lbnRzLXRlYXItb2ZmLmpzCkBAIC0wLDAgKzEsMTUgQEAKK2Rlc2NyaXB0aW9uKCJFbnN1cmUg
dGhhdCB3ZSBjb3JyZWN0bHkgdGVhcm9mZiB0aGUgYXJndW1lbnRzIG9iamVjdHMgd2hlbiB0aHJv
d2luZyBmcm9tIGlubGluZWQgZnVuY3Rpb24iKTsKKwordmFyIGZpZnRpZXRoQXJndW1lbnRzID0g
bnVsbDsKKworZnVuY3Rpb24gZyhhKSB7IGlmIChhID09PSA1MCkgZmlmdGlldGhBcmd1bWVudHMg
PSBhcmd1bWVudHM7IGYoKTsgfQorZnVuY3Rpb24gZigpIHsgZG9TdHVmZigpOyAgfQorZnVuY3Rp
b24gZG9TdHVmZigpIHsgdGhyb3cge307IH0KKworCitmb3IgKHZhciBpID0gMDsgaSA8IDEwMDsg
aSsrKSB7IHRyeSB7ICBnKGkpIH0gY2F0Y2ggKGUpIHsgfSB9CisKK3Nob3VsZEJlKCJmaWZ0aWV0
aEFyZ3VtZW50c1swXSIsICI1MCIpOworc2hvdWxkQmUoImZpZnRpZXRoQXJndW1lbnRzLmxlbmd0
aCIsICIxIik7CisKKwo=
</data>
<flag name="review"
          id="226385"
          type_id="1"
          status="+"
          setter="ggaren"
    />
          </attachment>
      

    </bug>

</bugzilla>