145062 2015-05-15 11:28:27 -0700 DFGLICMPhase shouldn't create NodeOrigins with forExit but without semantic 2015-05-15 12:31:42 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 basile_clement basile_clement fpizlo ggaren mark.lam msaboff oldest_to_newest 1095173 0 basile_clement 2015-05-15 11:28:27 -0700 This can be hit by running e.g. sunspider/access-nsieve with DYLD_FRAMEWORK_PATH=WebKitBuild/Debug WebKitBuild/Debug/jsc --forceEagerCompilation=true --useFTLJIT=true --dumpGraphAtEachPhase=true In this case, a Phi node is converted into a JSConstant by the DFGConstantFoldingPhase, and doesn't have a NodeOrigin. Then it gets LICM'd, which unconditionally sets the NodeOrigin's forExit, and now we have a NodeOrigin with a set forExit and unset semantic, which we assert against in various places. 1095188 1 253213 basile_clement 2015-05-15 12:14:05 -0700 Created attachment 253213 Patch 1095198 2 basile_clement 2015-05-15 12:31:42 -0700 Committed r184405: <http://trac.webkit.org/changeset/184405> 253213 2015-05-15 12:14:05 -0700 2015-05-15 12:22:10 -0700 Patch bug-145062-20150515121241.patch text/plain 3832 basile_clement U3VidmVyc2lvbiBSZXZpc2lvbjogMTg0Mzk3CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCA2 YWJlYTFlOGE0ZjY4YWM3ZTJmY2E1ZDQzNjZhZDlmY2E0MjU2Y2UzLi4wZDg0MTk0MTI1YmJlNGUx M2VjNDJhNTE2YTZmNzZiOWEwZmFmYjEzIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwzMyBAQAorMjAxNS0wNS0xNSAgQmFzaWxlIENsZW1lbnQgIDxiYXNpbGVfY2xlbWVudEBh cHBsZS5jb20+CisKKyAgICAgICAgREZHTElDTVBoYXNlIHNob3VsZG4ndCBjcmVhdGUgTm9kZU9y aWdpbnMgd2l0aCBmb3JFeGl0IGJ1dCB3aXRob3V0IHNlbWFudGljCisgICAgICAgIGh0dHBzOi8v YnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNDUwNjIKKworICAgICAgICBSZXZpZXdl ZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBXZSBhc3NlcnQgaW4gdmFyaW91cyBwbGFj ZXMgKGluY2x1ZGluZyBOb2RlT3JpZ2luOjppc1NldCgpKSB0aGF0IGEKKyAgICAgICAgTm9kZU9y aWdpbidzIHNlbWFudGljIGFuZCBmb3JFeGl0IG11c3QgYmUgZWl0aGVyIGJvdGggc2V0LCBvciBi b3RoCisgICAgICAgIHVuc2V0LiAgSG93ZXZlciwgTElDTSdpbmcgYSBub2RlIHdpdGggdW5zZXQg Tm9kZU9yaWdpbiB3b3VsZCBvbmx5IHNldAorICAgICAgICBmb3JFeGl0LCBhbmQgbGVhdmUgc2Vt YW50aWMgdW5zZXQuIFRoaXMgY2FuIGZvciBpbnN0YW5jZSBoYXBwZW4gd2hlbiBhCisgICAgICAg IFBoaSBub2RlIGlzIGNvbnN0YW50LWZvbGRlZCBpbnRvIGEgSlNDb25zdGFudCwgd2hpY2ggaW4g dHVybiBnZXRzCisgICAgICAgIExJQ00nZC4KKworICAgICAgICBUaGlzIHBhdGNoIGNoYW5nZXMg REZHTElDTVBoYXNlIHRvIHNldCB0aGUgTm9kZU9yaWdpbidzIHNlbWFudGljIGluCisgICAgICAg IGFkZGl0aW9uIHRvIGl0cyBmb3JFeGl0IGlmIHNlbWFudGljIHdhcyBwcmV2aW91c2x5IHVuc2V0 LgorCisgICAgICAgIEl0IGFsc28gYWRkcyB0d28gdmFsaWRhdG9ycyB0byBERkdWYWxpZGF0ZS5j cHA6CisgICAgICAgICAtIEluIGJvdGggU1NBIGFuZCBDUFMgZm9ybSwgYSBOb2RlT3JpZ2luIHNl bWFudGljIGFuZCBmb3JFeGl0IG11c3QgYmUgZWl0aGVyIGJvdGggc2V0IG9yIGJvdGggdW5zZXQK KyAgICAgICAgIC0gSW4gQ1BTIGZvcm0sIGFsbCBub2RlcyBtdXN0IGhhdmUgYSBzZXQgTm9kZU9y aWdpbiBmb3JFeGl0ICh0aGlzIGlzCisgICAgICAgICAgIHRoZSBDUFMgY291bnRlcnBhcnQgdG8g dGhlIFNTQSB2YWxpZGF0b3IgdGhhdCBjaGVja3MgdGhhdCBhbGwgbm9kZXMKKyAgICAgICAgICAg bXVzdCBoYXZlIGEgc2V0IE5vZGVPcmlnaW4gZXhjZXB0IHBvc3NpYmx5IGZvciBhIGNvbnRpbnVv dXMgY2h1bmsgb2YKKyAgICAgICAgICAgbm9kZXMgYXQgdGhlIHRvcCBvZiBhIGJsb2NrKQorCisg ICAgICAgICogZGZnL0RGR0xJQ01QaGFzZS5jcHA6CisgICAgICAgIChKU0M6OkRGRzo6TElDTVBo YXNlOjphdHRlbXB0SG9pc3QpOgorICAgICAgICAqIGRmZy9ERkdWYWxpZGF0ZS5jcHA6CisgICAg ICAgIChKU0M6OkRGRzo6VmFsaWRhdGU6OnZhbGlkYXRlKToKKyAgICAgICAgKEpTQzo6REZHOjpW YWxpZGF0ZTo6dmFsaWRhdGVDUFMpOgorCiAyMDE1LTA1LTE0ICBGaWxpcCBQaXpsbyAgPGZwaXps b0BhcHBsZS5jb20+CiAKICAgICAgICAgUmVtb3ZlIHVudXNlZCBjb25zdGFudC1iYXNlIGFuZCBj b25zdGFudC12YWx1ZSBzdG9yZSBiYXJyaWVyIGNvZGUgaW4gdGhlIERGRwpkaWZmIC0tZ2l0IGEv U291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdMSUNNUGhhc2UuY3BwIGIvU291cmNlL0phdmFT Y3JpcHRDb3JlL2RmZy9ERkdMSUNNUGhhc2UuY3BwCmluZGV4IGM2NzdkYWU1NDZmZTVhZjc1Yzk4 NGFhZjg2NWJlMWE1ZmYyYWZlNzcuLmJmN2YxMzkzOGUxNWJjOGY5OGIxNTM5ZTlhNDIzMTBiM2Ez OWU5OTMgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHTElDTVBoYXNl LmNwcAorKysgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0xJQ01QaGFzZS5jcHAKQEAg LTI4Miw2ICsyODIsOCBAQCBwcml2YXRlOgogICAgICAgICBub2RlLT5vd25lciA9IGRhdGEucHJl SGVhZGVyOwogICAgICAgICBOb2RlT3JpZ2luIG9yaWdpbmFsT3JpZ2luID0gbm9kZS0+b3JpZ2lu OwogICAgICAgICBub2RlLT5vcmlnaW4uZm9yRXhpdCA9IGRhdGEucHJlSGVhZGVyLT50ZXJtaW5h bCgpLT5vcmlnaW4uZm9yRXhpdDsKKyAgICAgICAgaWYgKCFub2RlLT5vcmlnaW4uc2VtYW50aWMu aXNTZXQoKSkKKyAgICAgICAgICAgIG5vZGUtPm9yaWdpbi5zZW1hbnRpYyA9IG5vZGUtPm9yaWdp bi5mb3JFeGl0OwogICAgICAgICAKICAgICAgICAgLy8gTW9kaWZ5IHRoZSBzdGF0ZXMgYXQgdGhl IGVuZCBvZiB0aGUgcHJlSGVhZGVyIG9mIHRoZSBsb29wIHdlIGhvaXN0ZWQgdG8sCiAgICAgICAg IC8vIGFuZCBhbGwgcHJlLWhlYWRlcnMgaW5zaWRlIHRoZSBsb29wLgpkaWZmIC0tZ2l0IGEvU291 cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdWYWxpZGF0ZS5jcHAgYi9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvZGZnL0RGR1ZhbGlkYXRlLmNwcAppbmRleCBmODkyNDUzMTUwMzE0Nzk4OTI5OGU4Njc5 ZmZmNGQzNWQ3MWVlMzIyLi41MzU0NTU0NzQyZDU3ODA2MmM5ZWEyYzM5ZjUzY2IxYjczNjA0MWVk IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1ZhbGlkYXRlLmNwcAor KysgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1ZhbGlkYXRlLmNwcApAQCAtMTg2LDYg KzE4Niw3IEBAIHB1YmxpYzoKICAgICAgICAgICAgIGZvciAoc2l6ZV90IGkgPSAwOyBpIDwgYmxv Y2stPnNpemUoKTsgKytpKSB7CiAgICAgICAgICAgICAgICAgTm9kZSogbm9kZSA9IGJsb2NrLT5h dChpKTsKICAgICAgICAgICAgICAgICAKKyAgICAgICAgICAgICAgICBWQUxJREFURSgobm9kZSks IG5vZGUtPm9yaWdpbi5zZW1hbnRpYy5pc1NldCgpID09IG5vZGUtPm9yaWdpbi5mb3JFeGl0Lmlz U2V0KCkpOwogICAgICAgICAgICAgICAgIFZBTElEQVRFKChub2RlKSwgIW1heUV4aXQobV9ncmFw aCwgbm9kZSkgfHwgbm9kZS0+b3JpZ2luLmZvckV4aXQuaXNTZXQoKSk7CiAgICAgICAgICAgICAg ICAgVkFMSURBVEUoKG5vZGUpLCAhbm9kZS0+aGFzU3RydWN0dXJlKCkgfHwgISFub2RlLT5zdHJ1 Y3R1cmUoKSk7CiAgICAgICAgICAgICAgICAgVkFMSURBVEUoKG5vZGUpLCAhbm9kZS0+aGFzQ2Vs bE9wZXJhbmQoKSB8fCBub2RlLT5jZWxsT3BlcmFuZCgpLT52YWx1ZSgpLmlzQ2VsbCgpKTsKQEAg LTQwMiw2ICs0MDMsNyBAQCBwcml2YXRlOgogICAgICAgICAgICAgICAgIE5vZGUqIG5vZGUgPSBi bG9jay0+YXQoaSk7CiAgICAgICAgICAgICAgICAgQVNTRVJUKG5vZGVzSW5UaGlzQmxvY2suY29u dGFpbnMobm9kZSkpOwogICAgICAgICAgICAgICAgIFZBTElEQVRFKChub2RlKSwgbm9kZS0+b3Ao KSAhPSBQaGkpOworICAgICAgICAgICAgICAgIFZBTElEQVRFKChub2RlKSwgbm9kZS0+b3JpZ2lu LmZvckV4aXQuaXNTZXQoKSk7CiAgICAgICAgICAgICAgICAgZm9yICh1bnNpZ25lZCBqID0gMDsg aiA8IG1fZ3JhcGgubnVtQ2hpbGRyZW4obm9kZSk7ICsraikgewogICAgICAgICAgICAgICAgICAg ICBFZGdlIGVkZ2UgPSBtX2dyYXBoLmNoaWxkKG5vZGUsIGopOwogICAgICAgICAgICAgICAgICAg ICBpZiAoIWVkZ2UpCg==