148239 2015-08-20 13:25:28 -0700 Rare failure in regress/script-tests/sink-huge-activation.js.ftl-eager 2015-08-20 14:10:33 -0700 1 1 1 Unclassified WebKit JavaScriptCore Other All All NEW P2 Normal --- 1 fpizlo webkit-unassigned basile_clement oldest_to_newest 1119327 0 fpizlo 2015-08-20 13:25:28 -0700 Here's the text of the failure. I wasn't able to reproduce it. It was a debug build. At @53: validation failed: !edge->isPhantomAllocation() (/Volumes/Data/tertiary/OpenSource/Source/JavaScriptCore/dfg/DFGValidate.cpp:562). At time of failure: DFG for foo#<no-hash>:[0x1046dab90->0x1046da250->0x104487b00, DFGFunctionCall, 205 (NeverInline)]: Fixpoint state: FixpointConverged; Form: SSA; Unification state: GloballyUnified; Ref count state: ExactRefCount Argument formats: FlushedJSValue, FlushedBoolean Block #0 (<none>): (OSR target) Execution count: 1.000000 Predecessors: Successors: #1 (ForwardEdge) #2 (ForwardEdge) Dominated by: #0 Dominates: #0 #1 #2 Dominance Frontier: Iterated Dominance Frontier: Pre/Post Numbering: 0/2 States: StructuresAreWatched Availability: {locals = arg1:arg1:FlushedBoolean/Unavailable arg0:this:FlushedJSValue/Unavailable; heap = } Live: Values: 118:< 2:-> JSConstant(JS|PureInt, Othercell, Strong:Cell: 0x10446c790 (%CC:SymbolTable), ID: 19) 119:< 20:-> JSConstant(JS|PureInt, Other, Undefined) 49:< 2:-> JSConstant(JS|UseAsOther, Function, Weak:Cell: 0x104458ca0 (%CG:Function), ID: 39) 12:< 5:-> JSConstant(JS|UseAsOther, Otherobj, Weak:Cell: 0x104443800 (%Ak:global), ID: 413) 22:< 42:-> JSConstant(JS|UseAsOther, Boolint32, Int32: 0) 101:< 1:-> GetStack(JS|PureInt, Bool, arg1, machine:arg1, FlushedBoolean, R:Stack(6), bc#0) 102:<!0:-> KillStack(MustGen, loc0, W:SideState, bc#0) 3:<!0:-> ZombieHint(MustGen, loc0, W:SideState, bc#0) 103:<!0:-> KillStack(MustGen, loc1, W:SideState, bc#0) 5:<!0:-> ZombieHint(MustGen, loc1, W:SideState, bc#0) 104:<!0:-> KillStack(MustGen, loc2, W:SideState, bc#0) 7:<!0:-> ZombieHint(MustGen, loc2, W:SideState, bc#0) 105:<!0:-> KillStack(MustGen, loc3, W:SideState, bc#0) 9:<!0:-> ZombieHint(MustGen, loc3, W:SideState, bc#0) 106:<!0:-> KillStack(MustGen, loc0, W:SideState, bc#1) 13:<!0:-> MovHint(@12, MustGen, loc0, W:SideState, bc#1) 107:<!0:-> KillStack(MustGen, loc1, W:SideState, bc#3) 15:<!0:-> ZombieHint(MustGen, loc1, W:SideState, bc#3) 17:<!45:-> PhantomCreateActivation(JS|MustGen|UseAsOther, Otherobj, R:HeapObjectCount, W:HeapObjectCount, bc#6) 120:<!0:-> PutHint(@17, @118, MustGen, ActivationSymbolTablePLoc(0), W:SideState, bc#6) 121:<!0:-> PutHint(@17, @12, MustGen, ActivationScopePLoc(0), W:SideState, bc#6) 122:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(0), W:SideState, bc#6) 123:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(1), W:SideState, bc#6) 124:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(2), W:SideState, bc#6) 125:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(3), W:SideState, bc#6) 126:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(4), W:SideState, bc#6) 127:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(5), W:SideState, bc#6) 128:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(6), W:SideState, bc#6) 129:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(7), W:SideState, bc#6) 130:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(8), W:SideState, bc#6) 131:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(9), W:SideState, bc#6) 132:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(10), W:SideState, bc#6) 133:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(11), W:SideState, bc#6) 134:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(12), W:SideState, bc#6) 135:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(13), W:SideState, bc#6) 136:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(14), W:SideState, bc#6) 137:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(15), W:SideState, bc#6) 138:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(16), W:SideState, bc#6) 139:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(17), W:SideState, bc#6) 140:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(18), W:SideState, bc#6) 141:<!0:-> PutHint(@17, Kill:@119, MustGen, ClosureVarPLoc(19), W:SideState, bc#6) 108:<!0:-> KillStack(MustGen, loc2, W:SideState, bc#6) 18:<!0:-> MovHint(@17, MustGen, loc2, W:SideState, bc#6) 109:<!0:-> KillStack(MustGen, loc0, W:SideState, bc#11) 20:<!0:-> MovHint(@17, MustGen, loc0, W:SideState, bc#11) 142:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(16), W:SideState, bc#14) 143:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(15), W:SideState, bc#21) 144:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(10), W:SideState, bc#28) 145:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(14), W:SideState, bc#35) 146:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(9), W:SideState, bc#42) 147:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(3), W:SideState, bc#49) 148:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(13), W:SideState, bc#56) 149:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(8), W:SideState, bc#63) 150:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(2), W:SideState, bc#70) 151:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(7), W:SideState, bc#77) 152:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(18), W:SideState, bc#84) 153:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(5), W:SideState, bc#91) 154:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(0), W:SideState, bc#98) 155:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(6), W:SideState, bc#105) 156:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(4), W:SideState, bc#112) 157:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(11), W:SideState, bc#119) 158:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(19), W:SideState, bc#126) 159:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(12), W:SideState, bc#133) 160:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(17), W:SideState, bc#140) 161:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(1), W:SideState, bc#147) 44:<!0:-> Branch(Boolean:Kill:@101, MustGen, T:#1/w:1.000000, F:#2/w:1.000000, W:SideState, bc#154) States: TakeBoth, StructuresAreWatched Availability: {locals = arg1:arg1:FlushedBoolean/@101 arg0:this:FlushedJSValue/Unavailable loc0:ConflictingFlush/@17 loc2:ConflictingFlush/@17; heap = ActivationScopePLoc(@17, 0)=>ConflictingFlush/@12, ClosureVarPLoc(@17, 0)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 1)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 2)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 3)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 4)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 5)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 6)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 7)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 8)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 9)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 10)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 11)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 12)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 13)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 14)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 15)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 16)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 17)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 18)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 19)=>ConflictingFlush/@22, ActivationSymbolTablePLoc(@17, 0)=>ConflictingFlush/@118} Live: @12, @17, @22, @49, @118 Values: @12=>(Otherobj, TOP, TOP, Cell: 0x104443800 (%Ak:global), ID: 413), @17=>(None), @22=>(Boolint32, Int32: 0), @49=>(Function, TOP, TOP, Cell: 0x104458ca0 (%CG:Function), ID: 39), @118=>(Othercell, NonArray, [%CC:SymbolTable], Cell: 0x10446c790 (%CC:SymbolTable), ID: 19) Block #1 (bc#157): Execution count: 1.000000 Predecessors: #0 Successors: Dominated by: #0 #1 Dominates: #1 Dominance Frontier: Iterated Dominance Frontier: Pre/Post Numbering: 2/1 States: StructuresAreWatched Availability: {locals = arg1:arg1:FlushedBoolean/@101 arg0:this:FlushedJSValue/Unavailable loc0:ConflictingFlush/@17 loc1:DeadFlush/Undecided loc2:ConflictingFlush/@17 loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided; heap = ActivationScopePLoc(@17, 0)=>ConflictingFlush/@12, ClosureVarPLoc(@17, 0)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 1)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 2)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 3)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 4)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 5)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 6)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 7)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 8)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 9)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 10)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 11)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 12)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 13)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 14)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 15)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 16)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 17)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 18)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 19)=>ConflictingFlush/@22, ActivationSymbolTablePLoc(@17, 0)=>ConflictingFlush/@118} Live: @12, @17, @22, @49, @118 Values: @12=>(Otherobj, TOP, TOP, Cell: 0x104443800 (%Ak:global), ID: 413), @17=>(None), @22=>(Boolint32, Int32: 0), @49=>(Function, TOP, TOP, Cell: 0x104458ca0 (%CG:Function), ID: 39), @118=>(Othercell, NonArray, [%CC:SymbolTable], Cell: 0x10446c790 (%CC:SymbolTable), ID: 19) 110:<!0:-> KillStack(MustGen, loc6, W:SideState, bc#157) 46:<!0:-> MovHint(@12, MustGen, loc6, W:SideState, bc#157) 111:<!0:-> KillStack(MustGen, loc4, W:SideState, bc#164) 50:<!0:-> MovHint(@49, MustGen, loc4, W:SideState, bc#164) 53:< 2:-> NewFunction(Cell:Kill:@17, JS|UseAsOther, Function, <0x104487900, FunctionExecutable>, #<nogen>/<nogen>:[0x104487900], R:HeapObjectCount, W:HeapObjectCount, bc#172) 112:<!0:-> KillStack(MustGen, loc5, W:SideState, bc#172) 54:<!0:-> MovHint(@53, MustGen, loc5, W:SideState, bc#172) 98:<!0:-> InvalidationPoint(MustGen,PASS: regress/script-tests/sink-huge-activation.js.ftl-no-cjit-validate 116:< 2:-> MaterializeCreateActivation(KnownCell:Kill:@118, KnownCell:@12, Kill:@22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, JS|VarArgs|PureInt, Otherobj, <0x10446c790, SymbolTable>, [id0, id1, id2, id3, id4, id5, id6, id7, id8, id9, id10, id11, id12, id13, id14, id15, id16, id17, id18, id19], R:HeapObjectCount, W:HeapObjectCount, bc#6, exit: bc#176) 162:<!0:-> MovHint(@116, MustGen, loc2, W:SideState, bc#176) 163:<!0:-> ZombieHint(MustGen, loc0, W:SideState, bc#176) 56:<!0:-> Call(Kill:@49, Kill:@12, Kill:@53, JS|MustGen|VarArgs|PureInt, Other, R:World, W:Heap, bc#176) predicting Other 113:<!0:-> KillStack(MustGen, loc4, W:SideState, bc#176) 57:<!0:-> ZombieHint(MustGen, loc4, W:SideState, bc#176) 99:<!0:-> InvalidationPoint(MustGen, W:SideState, bc#176, exit: bc#185) 61:< 2:-> GetClosureVar(KnownCell:Kill:@116, JS|UseAsOther, Boolint32, scope12, R:ScopeProperties(12), bc#185) predicting Boolint32 114:<!0:-> KillStack(MustGen, loc4, W:SideState, bc#185) 62:<!0:-> MovHint(@61, MustGen, loc4, W:SideState, bc#185) 64:<!0:-> Return(Kill:@61, MustGen, W:SideState, bc#193) States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated Availability: {locals = arg1:arg1:FlushedBoolean/@101 arg0:this:FlushedJSValue/Unavailable loc1:DeadFlush/Undecided loc2:ConflictingFlush/@116 loc3:DeadFlush/Undecided loc4:ConflictingFlush/@61 loc5:ConflictingFlush/@53 loc6:ConflictingFlush/@12 loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided; heap = ActivationScopePLoc(@17, 0)=>ConflictingFlush/@12, ClosureVarPLoc(@17, 0)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 1)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 2)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 3)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 4)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 5)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 6)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 7)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 8)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 9)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 10)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 11)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 12)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 13)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 14)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 15)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 16)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 17)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 18)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 19)=>ConflictingFlush/@22, ActivationSymbolTablePLoc(@17, 0)=>ConflictingFlush/@118} Live: Values: Block #2 (bc#195): Execution count: 1.000000 Predecessors: #0 Successors: Dominated by: #0 #2 Dominates: #2 Dominance Frontier: Iterated Dominance Frontier: Pre/Post Numbering: 1/0 States: StructuresAreWatched Availability: {locals = arg1:arg1:FlushedBoolean/@101 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:ConflictingFlush/@17 loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided; heap = ActivationScopePLoc(@17, 0)=>ConflictingFlush/@12, ClosureVarPLoc(@17, 0)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 1)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 2)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 3)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 4)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 5)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 6)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 7)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 8)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 9)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 10)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 11)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 12)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 13)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 14)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 15)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 16)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 17)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 18)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 19)=>ConflictingFlush/@22, ActivationSymbolTablePLoc(@17, 0)=>ConflictingFlush/@118} Live: @22 Values: @22=>(Boolint32, Int32: 0) 115:<!0:-> KillStack(MustGen, loc4, W:SideState, bc#195) 69:<!0:-> MovHint(@22, MustGen, loc4, W:SideState, bc#195) 71:<!0:-> Return(Kill:@22, MustGen, W:SideState, bc#203) States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated Availability: {locals = arg1:arg1:FlushedBoolean/@101 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:ConflictingFlush/@17 loc3:DeadFlush/Undecided loc4:ConflictingFlush/@22 loc5:DeadFlush/Undecided loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided; heap = ActivationScopePLoc(@17, 0)=>ConflictingFlush/@12, ClosureVarPLoc(@17, 0)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 1)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 2)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 3)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 4)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 5)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 6)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 7)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 8)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 9)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 10)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 11)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 12)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 13)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 14)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 15)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 16)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 17)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 18)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 19)=>ConflictingFlush/@22, ActivationSymbolTablePLoc(@17, 0)=>ConflictingFlush/@118} Live: Values: GC Values: Strong:Cell: 0x104487900 (%EE:FunctionExecutable), ID: 16 Weak:Cell: 0x104458ca0 (%CG:Function), ID: 39 Strong:Cell: 0x10446c790 (%CC:SymbolTable), ID: 19 Weak:Cell: 0x104443800 (%Ak:global), ID: 413 Weak:Cell: 0x104458c70 (%CG:Function), ID: 39 Desired watchpoints: Watchpoint sets: 0x1047c2000 Inline watchpoint sets: 0x10442be98, 0x10442bd48, 0x10442bfe8, 0x10442b958, 0x10442b808, 0x1044290a8 Inferred values: 0x10447e460 Buffer views: Object property conditions: Structures: %Ak:global = 0x10446c8e0:[global, {parseInt:100, Object:101, Function:102, Array:103, RegExp:104, EvalError:105, RangeError:106, ReferenceError:107, SyntaxError:108, TypeError:109, URIError:110, Set:111, Map:112, Date:113, String:114, Symbol:115, Boolean:116, Number:117, Error:118, Promise:119, ArrayBuffer:120, WeakMap:121, WeakSet:122, eval:123, Intl:124, JSON:125, Math:126, Reflect:127, DataView:128, Float64Array:129, Float32Array:130, Uint32Array:131, Int32Array:132, Uint16Array:133, Int16Array:134, Uint8ClampedArray:135, Uint8Array:136, Int8Array:137, console:138, debug:139, describe:140, describeArray:141, print:142, quit:143, gc:144, fullGC:145, edenGC:146, gcHeapSize:147, deleteAllCompiledCode:148, addressOf:149, dumpCallFrame:150, version:151, run:152, load:153, readFile:154, checkSyntax:155, jscStack:156, readline:157, preciseTime:158, neverInlineFunction:159, noInline:160, numberOfDFGCompiles:161, optimizeNextInvocation:162, reoptimizationRetryCount:163, transferArrayBuffer:164, Root:165, Element:166, getElement:167, setElementRoot:168, DFGTrue:169, OSRExit:170, isFinalTier:171, predictInt32:172, isInt32:173, fiatInt52:174, effectful42:175, makeMasquerader:176, hasCustomProperties:177, createProxy:178, createRuntimeArray:179, createImpureGetter:180, setImpureGetterDelegate:181, dumpTypesForAllVariables:182, findTypeForExpression:183, returnTypeFor:184, dumpBasicBlockExecutionRanges:185, hasBasicBlockExecuted:186, enableExceptionFuzz:187, arguments:188}, NonArray, Proto:0x104457ff0] %CC:SymbolTable = 0x10442b7b0:[SymbolTable, {}, NonArray] %CG:Function = 0x10442ae80:[Function, {}, NonArray, Proto:0x104439e20] %EE:FunctionExecutable = 0x10442b900:[FunctionExecutable, {}, NonArray] ASSERTION FAILED: !edge->isPhantomAllocation() /Volumes/Data/tertiary/OpenSource/Source/JavaScriptCore/dfg/DFGValidate.cpp(562) : auto JSC::DFG::Validate::validateSSA()::<anonymous class>::operator()(const JSC::DFG::Edge &) const 1 0x102674d70 WTFCrash 2 0x1020104f2 JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&)::operator()(JSC::DFG::Edge const&) const 3 0x102010434 void JSC::DFG::Graph::doToChildren<JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&)>(JSC::DFG::Node*, JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&) const&)::'lambda'(JSC::DFG::Node*, JSC::DFG::Edge&)::operator()(JSC::DFG::Node*, JSC::DFG::Edge&) const 4 0x102010321 void JSC::DFG::Graph::doToChildrenWithNode<void JSC::DFG::Graph::doToChildren<JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&)>(JSC::DFG::Node*, JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&) const&)::'lambda'(JSC::DFG::Node*, JSC::DFG::Edge&)>(JSC::DFG::Node*, JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&) const&) 5 0x102010170 void JSC::DFG::Graph::doToChildren<JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&)>(JSC::DFG::Node*, JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&) const&) 6 0x102010107 JSC::DFG::Validate::validateSSA() 7 0x10200d27c JSC::DFG::Validate::validate() 8 0x10200b011 JSC::DFG::validate(JSC::DFG::Graph&, JSC::DFG::GraphDumpMode, WTF::CString) 9 0x101f508a3 JSC::DFG::(anonymous namespace)::dumpAndVerifyGraph(JSC::DFG::Graph&, char const*, bool) 10 0x101f50211 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) 11 0x101f4e61a JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) 12 0x102028dc0 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) 13 0x1020273b4 JSC::DFG::Worklist::threadFunction(void*) 14 0x1026d9dd9 WTF::createThread(void (*)(void*), void*, char const*)::$_0::operator()() const 15 0x1026d9dac std::__1::__function::__func<WTF::createThread(void (*)(void*), void*, char const*)::$_0, std::__1::allocator<WTF::createThread(void (*)(void*), void*, char const*)::$_0>, void ()>::operator()() 16 0x102164e2a std::__1::function<void ()>::operator()() const 17 0x1026d8d2e WTF::threadEntryPoint(void*) 18 0x1026da6b8 WTF::wtfThreadEntryPoint(void*) 19 0x7fff8f81f268 _pthread_body 20 0x7fff8f81f1e5 _pthread_body 21 0x7fff8f81d41d thread_start test_script_18665: line 2: 63192 Segmentation fault: 11 "$@" ../../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --enableFunctionDotArguments\=true --useFTLJIT\=true --ftlCrashesIfCantInitializeLLVM\=true --thresholdForJITAfterWarmUp\=10 --thresholdForJITSoon\=10 --thresholdForOptimizeAfterWarmUp\=20 --thresholdForOptimizeAfterLongWarmUp\=20 --thresholdForOptimizeSoon\=20 --thresholdForFTLOptimizeAfterWarmUp\=20 --thresholdForFTLOptimizeSoon\=20 --maximumEvalCacheableSourceLength\=150000 sink-huge-activation.js 1119349 1 basile_clement 2015-08-20 14:10:33 -0700 This is incredibly weird. It looks like the allocation sinking phase for some reason failed to realize the node at @53 should be sunk because it uses the activation at @17 (i.e. ObjectAllocationSinking::determineSinkCandidates failed its job). I have absolutely no idea what could have caused this, and was unable to reproduce it either. What revision did you see this in?