153805 2016-02-02 15:13:07 -0800 ASSERTION FAILED: !edge->isPhantomAllocation() in regress/script-tests/sink-huge-activation.js.ftl-eager in debug mode 2016-03-16 13:12:35 -0700 1 1 1 Unclassified WebKit JavaScriptCore Other All All RESOLVED FIXED P2 Normal --- 1 fpizlo fpizlo ap commit-queue keith_miller mark.lam msaboff ryanhaddad saam oldest_to_newest 1161428 0 fpizlo 2016-02-02 15:13:07 -0800 ... 1168888 1 ap 2016-02-27 12:08:44 -0800 This happens on this bot fairly often, roughly once per day: https://build.webkit.org/builders/Apple%20Yosemite%20Debug%20JSC%20(Tests)?numbuilds=50 1175089 2 saam 2016-03-15 13:47:00 -0700 I just hit it. 1175161 3 fpizlo 2016-03-15 15:36:56 -0700 I can repro. Here's the dump. At @60: validation failed: !edge->isPhantomAllocation() (/Volumes/Data/quartary/OpenSource/Source/JavaScriptCore/dfg/DFGValidate.cpp:594). At time of failure: DFG for foo#CDmn2K:[0x10ac8b400->0x10ac8ba60->0x10ac7af40, DFGFunctionCall, 205 (NeverInline)]: Fixpoint state: FixpointConverged; Form: SSA; Unification state: GloballyUnified; Ref count state: ExactRefCount Argument formats: FlushedJSValue, FlushedBoolean Block #0 (bc#0): (OSR target) Execution count: 1.000000 Predecessors: Successors: #1 (ForwardEdge) #2 (ForwardEdge) Dominated by: #0 Dominates: #0 #1 #2 Dominance Frontier: Iterated Dominance Frontier: Pre/Post Numbering: 0/2 States: StructuresAreWatched Availability: {locals = arg1:arg1:FlushedBoolean/Unavailable arg0:this:FlushedJSValue/Unavailable; heap = } Live: Values: 131:< 2:-> JSConstant(JS|PureInt, Othercell, Strong:Cell: 0x10ac3be80 (%Df:SymbolTable), ID: 19, bc#0) 132:< 20:-> JSConstant(JS|PureInt, Other, Undefined, bc#0) 28:< 42:-> JSConstant(JS|UseAsOther, Boolint32, Int32: 0, bc#0) 18:< 3:-> JSConstant(JS|UseAsOther, Otherobj, Weak:Cell: 0x10ac43fc0 (%C0:JSGlobalLexicalEnvironment), ID: 49, bc#0) 57:< 2:-> JSConstant(JS|UseAsOther, Function, Weak:Cell: 0x10ac67eb0 (%Cf:Function), ID: 50, bc#0) 51:< 2:-> JSConstant(JS|UseAsOther, Otherobj, Weak:Cell: 0x10ac37900 (%Eg:global), ID: 321, bc#0) 109:<!0:-> ExitOK(MustGen, W:SideState, bc#0) 108:< 1:-> GetStack(JS|PureInt, Bool, arg1, machine:arg1, FlushedBoolean, R:Stack(6), bc#0) 110:<!0:-> KillStack(MustGen, loc0, W:SideState, ClobbersExit, bc#0) 3:<!0:-> ZombieHint(MustGen, loc0, W:SideState, ClobbersExit, bc#0, ExitInvalid) 111:<!0:-> KillStack(MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid) 5:<!0:-> ZombieHint(MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid) 112:<!0:-> KillStack(MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid) 7:<!0:-> ZombieHint(MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid) 113:<!0:-> KillStack(MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid) 9:<!0:-> ZombieHint(MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid) 114:<!0:-> KillStack(MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid) 11:<!0:-> ZombieHint(MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid) 115:<!0:-> KillStack(MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid) 13:<!0:-> ZombieHint(MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid) 116:<!0:-> KillStack(MustGen, loc6, W:SideState, ClobbersExit, bc#0, ExitInvalid) 15:<!0:-> ZombieHint(MustGen, loc6, W:SideState, ClobbersExit, bc#0, ExitInvalid) 117:<!0:-> KillStack(MustGen, loc3, W:SideState, ClobbersExit, bc#1) 19:<!0:-> MovHint(Untyped:@18, MustGen, loc3, W:SideState, ClobbersExit, bc#1, ExitInvalid) 118:<!0:-> KillStack(MustGen, loc4, W:SideState, ClobbersExit, bc#3) 21:<!0:-> ZombieHint(MustGen, loc4, W:SideState, ClobbersExit, bc#3, ExitInvalid) 23:<!45:-> PhantomCreateActivation(JS|MustGen|UseAsOther, Otherobj, R:HeapObjectCount, W:HeapObjectCount, Exits, bc#6) 133:<!0:-> PutHint(Untyped:@23, Untyped:@131, MustGen, ActivationSymbolTablePLoc(0), W:SideState, ClobbersExit, bc#6) 134:<!0:-> PutHint(Untyped:@23, Untyped:@18, MustGen, ActivationScopePLoc(0), W:SideState, ClobbersExit, bc#6, ExitInvalid) 135:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(0), W:SideState, ClobbersExit, bc#6, ExitInvalid) 136:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(1), W:SideState, ClobbersExit, bc#6, ExitInvalid) 137:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(2), W:SideState, ClobbersExit, bc#6, ExitInvalid) 138:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(3), W:SideState, ClobbersExit, bc#6, ExitInvalid) 139:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(4), W:SideState, ClobbersExit, bc#6, ExitInvalid) 140:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(5), W:SideState, ClobbersExit, bc#6, ExitInvalid) 141:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(6), W:SideState, ClobbersExit, bc#6, ExitInvalid) 142:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(7), W:SideState, ClobbersExit, bc#6, ExitInvalid) 143:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(8), W:SideState, ClobbersExit, bc#6, ExitInvalid) 144:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(9), W:SideState, ClobbersExit, bc#6, ExitInvalid) 145:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(10), W:SideState, ClobbersExit, bc#6, ExitInvalid) 146:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(11), W:SideState, ClobbersExit, bc#6, ExitInvalid) 147:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(12), W:SideState, ClobbersExit, bc#6, ExitInvalid) 148:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(13), W:SideState, ClobbersExit, bc#6, ExitInvalid) 149:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(14), W:SideState, ClobbersExit, bc#6, ExitInvalid) 150:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(15), W:SideState, ClobbersExit, bc#6, ExitInvalid) 151:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(16), W:SideState, ClobbersExit, bc#6, ExitInvalid) 152:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(17), W:SideState, ClobbersExit, bc#6, ExitInvalid) 153:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(18), W:SideState, ClobbersExit, bc#6, ExitInvalid) 154:<!0:-> PutHint(Untyped:@23, Untyped:Kill:@132, MustGen, ClosureVarPLoc(19), W:SideState, ClobbersExit, bc#6, ExitInvalid) 155:<!0:-> ExitOK(MustGen, W:SideState, bc#6) 119:<!0:-> KillStack(MustGen, loc5, W:SideState, ClobbersExit, bc#6) 24:<!0:-> MovHint(Untyped:@23, MustGen, loc5, W:SideState, ClobbersExit, bc#6, ExitInvalid) 120:<!0:-> KillStack(MustGen, loc3, W:SideState, ClobbersExit, bc#11) 26:<!0:-> MovHint(Untyped:@23, MustGen, loc3, W:SideState, ClobbersExit, bc#11, ExitInvalid) 156:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(16), W:SideState, ClobbersExit, bc#14) 157:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(15), W:SideState, ClobbersExit, bc#21) 158:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(10), W:SideState, ClobbersExit, bc#28) 159:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(14), W:SideState, ClobbersExit, bc#35) 160:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(9), W:SideState, ClobbersExit, bc#42) 161:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(3), W:SideState, ClobbersExit, bc#49) 162:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(13), W:SideState, ClobbersExit, bc#56) 163:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(8), W:SideState, ClobbersExit, bc#63) 164:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(2), W:SideState, ClobbersExit, bc#70) 165:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(7), W:SideState, ClobbersExit, bc#77) 166:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(18), W:SideState, ClobbersExit, bc#84) 167:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(5), W:SideState, ClobbersExit, bc#91) 168:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(0), W:SideState, ClobbersExit, bc#98) 169:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(6), W:SideState, ClobbersExit, bc#105) 170:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(4), W:SideState, ClobbersExit, bc#112) 171:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(11), W:SideState, ClobbersExit, bc#119) 172:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(19), W:SideState, ClobbersExit, bc#126) 173:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(12), W:SideState, ClobbersExit, bc#133) 174:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(17), W:SideState, ClobbersExit, bc#140) 175:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(1), W:SideState, ClobbersExit, bc#147) 50:<!0:-> Branch(Boolean:Kill:@108, MustGen, T:#1/w:1.000000, F:#2/w:1.000000, W:SideState, bc#154) States: TakeBoth, StructuresAreWatched Availability: {locals = arg1:arg1:FlushedBoolean/@108 arg0:this:FlushedJSValue/Unavailable loc3:ConflictingFlush/@23 loc5:ConflictingFlush/@23; heap = ActivationSymbolTablePLoc(@23, 0)=>ConflictingFlush/@131, ActivationScopePLoc(@23, 0)=>ConflictingFlush/@18, ClosureVarPLoc(@23, 0)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 1)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 2)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 3)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 4)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 5)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 6)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 7)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 8)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 9)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 10)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 11)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 12)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 13)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 14)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 15)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 16)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 17)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 18)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 19)=>ConflictingFlush/@28} Live: @18, @23, @28, @51, @57, @131 Values: @18=>(Otherobj, NonArray, [%C0:JSGlobalLexicalEnvironment], Cell: 0x10ac43fc0 (%C0:JSGlobalLexicalEnvironment), ID: 49), @23=>(None), @28=>(Boolint32, Int32: 0), @51=>(Otherobj, TOP, TOP, Cell: 0x10ac37900 (%Eg:global), ID: 321), @57=>(Function, TOP, TOP, Cell: 0x10ac67eb0 (%Cf:Function), ID: 50), @131=>(Othercell, NonArray, [%Df:SymbolTable], Cell: 0x10ac3be80 (%Df:SymbolTable), ID: 19) Block #1 (bc#157): Execution count: 1.000000 Predecessors: #0 Successors: Dominated by: #0 #1 Dominates: #1 Dominance Frontier: Iterated Dominance Frontier: Pre/Post Numbering: 2/1 States: StructuresAreWatched Availability: {locals = arg1:arg1:FlushedBoolean/@108 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:ConflictingFlush/@23 loc4:DeadFlush/Undecided loc5:ConflictingFlush/@23 loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided; heap = ActivationSymbolTablePLoc(@23, 0)=>ConflictingFlush/@131, ActivationScopePLoc(@23, 0)=>ConflictingFlush/@18, ClosureVarPLoc(@23, 0)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 1)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 2)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 3)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 4)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 5)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 6)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 7)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 8)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 9)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 10)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 11)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 12)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 13)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 14)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 15)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 16)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 17)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 18)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 19)=>ConflictingFlush/@28} Live: @18, @23, @28, @51, @57, @131 Values: @18=>(Otherobj, NonArray, [%C0:JSGlobalLexicalEnvironment], Cell: 0x10ac43fc0 (%C0:JSGlobalLexicalEnvironment), ID: 49), @23=>(None), @28=>(Boolint32, Int32: 0), @51=>(Otherobj, TOP, TOP, Cell: 0x10ac37900 (%Eg:global), ID: 321), @57=>(Function, TOP, TOP, Cell: 0x10ac67eb0 (%Cf:Function), ID: 50), @131=>(Othercell, NonArray, [%Df:SymbolTable], Cell: 0x10ac3be80 (%Df:SymbolTable), ID: 19) 121:<!0:-> ExitOK(MustGen, W:SideState, bc#157) 122:<!0:-> KillStack(MustGen, loc10, W:SideState, ClobbersExit, bc#157) 52:<!0:-> MovHint(Untyped:@51, MustGen, loc10, W:SideState, ClobbersExit, bc#157, ExitInvalid) 123:<!0:-> KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#164) 58:<!0:-> MovHint(Untyped:@57, MustGen, loc7, W:SideState, ClobbersExit, bc#164, ExitInvalid) 60:< 2:-> NewFunction(Cell:Kill:@23, JS|UseAsOther, Function, <0x10ac7ae00, FunctionExecutable>, #<nogen>/<nogen>:[0x10ac7ae00], R:HeapObjectCount, W:HeapObjectCount, ExitsForExceptions, bc#172) 124:<!0:-> KillStack(MustGen, loc9, W:SideState, ClobbersExit, bc#172, ExitInvalid) 61:<!0:-> MovHint(Untyped:@60, MustGen, loc9, W:SideState, ClobbersExit, bc#172, ExitInvalid) 105:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#172, exit: bc#176) 129:< 2:-> MaterializeCreateActivation(KnownCell:Kill:@131, KnownCell:Kill:@18, Untyped:Kill:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, JS|VarArgs|PureInt, Otherobj, <0x10ac3be80, SymbolTable>, [id0, id1, id2, id3, id4, id5, id6, id7, id8, id9, id10, id11, id12, id13, id14, id15, id16, id17, id18, id19], R:HeapObjectCount, W:HeapObjectCount, ExitsForExceptions, bc#6, exit: bc#176) 176:<!0:-> MovHint(Untyped:@129, MustGen, loc5, W:SideState, ClobbersExit, bc#176) 177:<!0:-> ZombieHint(MustGen, loc3, W:SideState, ClobbersExit, bc#176, ExitInvalid) 178:<!0:-> ExitOK(MustGen, W:SideState, bc#176) 63:<!0:-> Call(Untyped:Kill:@57, Untyped:Kill:@51, Untyped:Kill:@60, JS|MustGen|VarArgs|PureInt, Other, R:World, W:Heap, ExitsForExceptions, ClobbersExit, bc#176) predicting Other 125:<!0:-> KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#176, ExitInvalid) 64:<!0:-> ZombieHint(MustGen, loc7, W:SideState, ClobbersExit, bc#176, ExitInvalid) 106:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#176, exit: bc#185) 68:< 2:-> GetClosureVar(KnownCell:Kill:@129, JS|UseAsOther, Boolint32, scope12, R:ScopeProperties(12), Exits, bc#185) predicting Boolint32 126:<!0:-> KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#185) 69:<!0:-> MovHint(Untyped:@68, MustGen, loc7, W:SideState, ClobbersExit, bc#185, ExitInvalid) 71:<!0:-> Return(Untyped:Kill:@68, MustGen, W:SideState, Exits, bc#193) States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated Availability: {locals = arg1:arg1:FlushedBoolean/@108 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:ConflictingFlush/@129 loc6:DeadFlush/Undecided loc7:ConflictingFlush/@68 loc8:DeadFlush/Undecided loc9:ConflictingFlush/@60 loc10:ConflictingFlush/@51 loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided; heap = ActivationSymbolTablePLoc(@23, 0)=>ConflictingFlush/@131, ActivationScopePLoc(@23, 0)=>ConflictingFlush/@18, ClosureVarPLoc(@23, 0)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 1)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 2)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 3)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 4)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 5)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 6)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 7)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 8)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 9)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 10)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 11)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 12)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 13)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 14)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 15)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 16)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 17)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 18)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 19)=>ConflictingFlush/@28} Live: Values: Block #2 (bc#195): Execution count: 1.000000 Predecessors: #0 Successors: Dominated by: #0 #2 Dominates: #2 Dominance Frontier: Iterated Dominance Frontier: Pre/Post Numbering: 1/0 States: StructuresAreWatched Availability: {locals = arg1:arg1:FlushedBoolean/@108 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:ConflictingFlush/@23 loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided; heap = ActivationSymbolTablePLoc(@23, 0)=>ConflictingFlush/@131, ActivationScopePLoc(@23, 0)=>ConflictingFlush/@18, ClosureVarPLoc(@23, 0)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 1)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 2)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 3)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 4)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 5)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 6)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 7)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 8)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 9)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 10)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 11)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 12)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 13)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 14)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 15)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 16)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 17)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 18)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 19)=>ConflictingFlush/@28} Live: @28 Values: @28=>(Boolint32, Int32: 0) 127:<!0:-> ExitOK(MustGen, W:SideState, bc#195) 128:<!0:-> KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#195) 76:<!0:-> MovHint(Untyped:@28, MustGen, loc7, W:SideState, ClobbersExit, bc#195, ExitInvalid) 78:<!0:-> Return(Untyped:Kill:@28, MustGen, W:SideState, Exits, bc#203) States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated Availability: {locals = arg1:arg1:FlushedBoolean/@108 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:ConflictingFlush/@23 loc6:DeadFlush/Undecided loc7:ConflictingFlush/@28 loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided; heap = ActivationSymbolTablePLoc(@23, 0)=>ConflictingFlush/@131, ActivationScopePLoc(@23, 0)=>ConflictingFlush/@18, ClosureVarPLoc(@23, 0)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 1)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 2)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 3)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 4)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 5)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 6)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 7)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 8)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 9)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 10)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 11)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 12)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 13)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 14)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 15)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 16)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 17)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 18)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 19)=>ConflictingFlush/@28} Live: Values: GC Values: Strong:Cell: 0x10ac7ae00 (%CO:FunctionExecutable), ID: 15 Weak:Cell: 0x10ac67eb0 (%Cf:Function), ID: 50 Weak:Cell: 0x10ac37900 (%Eg:global), ID: 321 Strong:Cell: 0x10ac3be80 (%Df:SymbolTable), ID: 19 Weak:Cell: 0x10ac43fc0 (%C0:JSGlobalLexicalEnvironment), ID: 49 Weak:Cell: 0x10ac67e80 (%Cf:Function), ID: 50 Desired watchpoints: Watchpoint sets: 0x10ade0370 Inline watchpoint sets: 0x10ac27fe0, 0x10ac24ee0, 0x10ac278e0, 0x10ac27760, 0x10ac27d60, 0x10ac276e0, 0x10ac267e0, 0x10ac27e60 Inferred values: 0x10ac62060 Buffer views: Object property conditions: Inferred types: Structures: %C0:JSGlobalLexicalEnvironment = 0x10ac26780:[JSGlobalLexicalEnvironment, {}, NonArray, Leaf] %CO:FunctionExecutable = 0x10ac27880:[FunctionExecutable, {}, NonArray, Leaf] %Cf:Function = 0x10ac26700:[Function, {}, NonArray, Proto:0x10ac2dde0] %Df:SymbolTable = 0x10ac27680:[SymbolTable, {}, NonArray, Leaf] %Eg:global = 0x10ac69c80:[global, {parseInt:100, Object:101, Function:102, Array:103, RegExp:104, EvalError:105, RangeError:106, ReferenceError:107, SyntaxError:108, TypeError:109, URIError:110, Proxy:111, Set:112, Map:113, Date:114, String:115, Symbol:116, Boolean:117, Number:118, Error:119, Promise:120, ArrayBuffer:121, WeakMap:122, WeakSet:123, eval:124, Intl:125, JSON:126, Math:127, Reflect:128, DataView:129, Float64Array:130, Float32Array:131, Uint32Array:132, Int32Array:133, Uint16Array:134, Int16Array:135, Uint8ClampedArray:136, Uint8Array:137, Int8Array:138, PrivateSymbol.Int8Array:139, PrivateSymbol.Int16Array:140, PrivateSymbol.Int32Array:141, PrivateSymbol.Uint8Array:142, PrivateSymbol.Uint8ClampedArray:143, PrivateSymbol.Uint16Array:144, PrivateSymbol.Uint32Array:145, PrivateSymbol.Float32Array:146, PrivateSymbol.Float64Array:147, console:148, debug:149, describe:150, describeArray:151, print:152, quit:153, abort:154, gc:155, fullGC:156, edenGC:157, forceGCSlowPaths:158, gcHeapSize:159, addressOf:160, version:161, run:162, load:163, readFile:164, checkSyntax:165, jscStack:166, readline:167, preciseTime:168, neverInlineFunction:169, noInline:170, noDFG:171, numberOfDFGCompiles:172, optimizeNextInvocation:173, reoptimizationRetryCount:174, transferArrayBuffer:175, failNextNewCodeBlock:176, Root:177, Element:178, getElement:179, setElementRoot:180, SimpleObject:181, getHiddenValue:182, setHiddenValue:183, DFGTrue:184, OSRExit:185, isFinalTier:186, predictInt32:187, isInt32:188, fiatInt52:189, effectful42:190, makeMasquerader:191, hasCustomProperties:192, createProxy:193, createRuntimeArray:194, createImpureGetter:195, createCustomGetterObject:196, setImpureGetterDelegate:197, dumpTypesForAllVariables:198, findTypeForExpression:199, returnTypeFor:200, dumpBasicBlockExecutionRanges:201, hasBasicBlockExecuted:202, basicBlockExecutionCount:203, enableExceptionFuzz:204, drainMicrotasks:205, is32BitPlatform:206, loadModule:207, checkModuleSyntax:208, platformSupportsSamplingProfiler:209, generateHeapSnapshot:210, startSamplingProfiler:211, samplingProfilerStackTraces:212}, NonArray, Proto:0x10ac4fff0, Has been dictionary, Leaf] ASSERTION FAILED: !edge->isPhantomAllocation() /Volumes/Data/quartary/OpenSource/Source/JavaScriptCore/dfg/DFGValidate.cpp(594) : auto JSC::DFG::Validate::validateSSA()::<anonymous class>::operator()(const JSC::DFG::Edge &) const 1175170 4 fpizlo 2016-03-15 15:52:04 -0700 I'm beginning to think that this is an awesome race condition. This analysis probably needs to save the value of node->castOperand<FunctionExecutable*>()->singletonFunction()->isStillValid() so that it makes up its mind. Right now, it's possible that we will decide that a NewFunction is not a sink candidate and then later decide that it doesn't escape its activation, because the watchpoint fired and so the NewFunction suddenly started to seem like a sink candidate *after* we already excluded it from that list. 1175265 5 274167 fpizlo 2016-03-15 20:37:59 -0700 Created attachment 274167 the patch 1175387 6 274167 mark.lam 2016-03-16 10:20:03 -0700 Comment on attachment 274167 the patch r=me 1175464 7 fpizlo 2016-03-16 13:12:35 -0700 Landed in http://trac.webkit.org/changeset/198296 274167 2016-03-15 20:37:59 -0700 2016-03-16 10:20:03 -0700 the patch blah.patch text/plain 4066 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTk4MjU2KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDMxIEBA CisyMDE2LTAzLTE1ICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg QVNTRVJUSU9OIEZBSUxFRDogIWVkZ2UtPmlzUGhhbnRvbUFsbG9jYXRpb24oKSBpbiByZWdyZXNz L3NjcmlwdC10ZXN0cy9zaW5rLWh1Z2UtYWN0aXZhdGlvbi5qcy5mdGwtZWFnZXIgaW4gZGVidWcg bW9kZQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTUz ODA1CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVGhl IG9iamVjdCBhbGxvY2F0aW9uIHNpbmtpbmcgcGhhc2UgdXNlcyBJbmZlcnJlZFZhbHVlOjppc1N0 aWxsVmFsaWQoKSBpbiB0aGUgb3Bwb3NpdGUKKyAgICAgICAgd2F5IGZyb20gbW9zdCBjbGllbnRz OiBpdCB3aWxsIGRvIGFuICpleHRyYSogb3B0aW1pemF0aW9uIGlmIGl0IHJldHVybnMgZmFsc2Uu IFRoZQorICAgICAgICBwaGFzZSB3aWxsIGZpcnN0IGNvbXB1dGUgc2luayBjYW5kaWRhdGVzIGFu ZCB0aGVuIGl0IHdpbGwgY29tcHV0ZSBtYXRlcmlhbGl6YXRpb24KKyAgICAgICAgcG9pbnRzLiBJ ZiBzb21ldGhpbmcgaXMgYSBzaW5rIGNhbmRpZGF0ZSB0aGVuIGl0IGlzIG5vdCBhIG1hdGVyaWFs aXphdGlvbiBwb2ludC4gQQorICAgICAgICBOZXdGdW5jdGlvbiBub2RlIG1heSBhcHBlYXIgYXMg bm90IGJlaW5nIGEgc2luayBjYW5kaWRhdGUgZHVyaW5nIHRoZSBmaXJzdCBwYXNzLCBzbyBpdCdz CisgICAgICAgIG5vdCBhZGRlZCB0byB0aGUgc2V0IG9mIHRoaW5ncyB0aGF0IHdpbGwgdHVybiBp bnRvIFBoYW50b21OZXdGdW5jdGlvbi4gQnV0IG9uIHRoZSBzZWNvbmQKKyAgICAgICAgcGFzcyB3 aGVyZSB3ZSBhZGQgbWF0ZXJpYWxpemF0aW9ucywgd2UgY2hlY2sgaXNTdGlsbFZhbGlkKCkgYWdh aW4uIE5vdyB0aGlzIG1heSBiZWNvbWUKKyAgICAgICAgZmFsc2UsIHNvIHRoYXQgc2Vjb25kIHBh c3MgdGhpbmdzIHRoYXQgTmV3RnVuY3Rpb24gaXMgYSBzaW5rIGNhbmRpZGF0ZSAoZXZlbiB0aG91 Z2ggaXQncworICAgICAgICBub3QgaW4gdGhlIHNpbmsgY2FuZGlkYXRlcyBzZXQpIGFuZCBzbyBp cyBub3QgYSBtYXRlcmlhbGl6YXRpb24gcG9pbnQuCisKKyAgICAgICAgVGhpcyBtYW5pZmVzdHMg YXMgdGhlIE5ld0Z1bmN0aW9uIHJlZmVycmluZyB0byBhIFBoYW50b21DcmVhdGVBY3RpdmF0aW9u IG9yIHdoYXRldmVyLgorCisgICAgICAgIFRoZSBzb2x1dGlvbiBpcyB0byBoYXZlIHRoZSBwaGFz ZSBjYWNoZSByZXN1bHRzIG9mIGNhbGxzIHRvIGlzU3RpbGxWYWxpZCgpLiBJdCdzIE9LIGlmCisg ICAgICAgIHdlIGp1c3QgcmVtZW1iZXIgdGhlIHJlc3VsdCBvZiB0aGUgZmlyc3QgY2FsbCBhbmQg YXNzdW1lIHRoYXQgaXQncyBub3QgYSBzaW5rIGNhbmRpZGF0ZS4KKyAgICAgICAgVGhhdCdzIHRo ZSB3b3JzdCB0aGF0IGNhbiBoYXBwZW4uCisKKyAgICAgICAgTm8gbmV3IHRlc3RzIHNpbmNlIHRo aXMgaXMgYSBzdXBlciBoYXJkIHJhY2UgYW5kIHNpbmstaHVnZS1hY3RpdmF0aW9uIHNlZW1lZCB0 byBhbHJlYWR5CisgICAgICAgIGJlIGNhdGNoaW5nIGl0LgorCisgICAgICAgICogZGZnL0RGR09i amVjdEFsbG9jYXRpb25TaW5raW5nUGhhc2UuY3BwOgorCiAyMDE2LTAzLTE1ICBCZW5qYW1pbiBQ b3VsYWluICA8YnBvdWxhaW5AYXBwbGUuY29tPgogCiAgICAgICAgIFtKU0NdIEhlbHAgY2xhbmcg Z2VuZXJhdGUgYmV0dGVyIGNvZGUgb24gYXJyYXlQcm90b0Z1bmNUb1N0cmluZygpCkluZGV4OiBT b3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR09iamVjdEFsbG9jYXRpb25TaW5raW5nUGhhc2Uu Y3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHT2JqZWN0QWxs b2NhdGlvblNpbmtpbmdQaGFzZS5jcHAJKHJldmlzaW9uIDE5ODIyOCkKKysrIFNvdXJjZS9KYXZh U2NyaXB0Q29yZS9kZmcvREZHT2JqZWN0QWxsb2NhdGlvblNpbmtpbmdQaGFzZS5jcHAJKHdvcmtp bmcgY29weSkKQEAgLTgzOCw3ICs4MzgsNyBAQCBwcml2YXRlOgogICAgICAgICBjYXNlIE5ld0Z1 bmN0aW9uOgogICAgICAgICBjYXNlIE5ld0Fycm93RnVuY3Rpb246CiAgICAgICAgIGNhc2UgTmV3 R2VuZXJhdG9yRnVuY3Rpb246IHsKLSAgICAgICAgICAgIGlmIChub2RlLT5jYXN0T3BlcmFuZDxG dW5jdGlvbkV4ZWN1dGFibGUqPigpLT5zaW5nbGV0b25GdW5jdGlvbigpLT5pc1N0aWxsVmFsaWQo KSkgeworICAgICAgICAgICAgaWYgKGlzU3RpbGxWYWxpZChub2RlLT5jYXN0T3BlcmFuZDxGdW5j dGlvbkV4ZWN1dGFibGUqPigpLT5zaW5nbGV0b25GdW5jdGlvbigpKSkgewogICAgICAgICAgICAg ICAgIG1faGVhcC5lc2NhcGUobm9kZS0+Y2hpbGQxKCkubm9kZSgpKTsKICAgICAgICAgICAgICAg ICBicmVhazsKICAgICAgICAgICAgIH0KQEAgLTg1NSw3ICs4NTUsNyBAQCBwcml2YXRlOgogICAg ICAgICB9CiAKICAgICAgICAgY2FzZSBDcmVhdGVBY3RpdmF0aW9uOiB7Ci0gICAgICAgICAgICBp ZiAobm9kZS0+Y2FzdE9wZXJhbmQ8U3ltYm9sVGFibGUqPigpLT5zaW5nbGV0b25TY29wZSgpLT5p c1N0aWxsVmFsaWQoKSkgeworICAgICAgICAgICAgaWYgKGlzU3RpbGxWYWxpZChub2RlLT5jYXN0 T3BlcmFuZDxTeW1ib2xUYWJsZSo+KCktPnNpbmdsZXRvblNjb3BlKCkpKSB7CiAgICAgICAgICAg ICAgICAgbV9oZWFwLmVzY2FwZShub2RlLT5jaGlsZDEoKS5ub2RlKCkpOwogICAgICAgICAgICAg ICAgIGJyZWFrOwogICAgICAgICAgICAgfQpAQCAtMjE3Myw2ICsyMTczLDE1IEBAIHByaXZhdGU6 CiAgICAgICAgIH0KICAgICB9CiAKKyAgICAvLyBUaGlzIGlzIGEgZ3JlYXQgd2F5IG9mIGFza2lu ZyB2YWx1ZS0+aXNTdGlsbFZhbGlkKCkgd2l0aG91dCBoYXZpbmcgdG8gd29ycnkgYWJvdXQgZ2V0 dGluZworICAgIC8vIGRpZmZlcmVudCBhbnN3ZXJzLiBJdCB0dXJucyBvdXQgdGhhdCB0aGlzIGFu YWx5c2lzIHdvcmtzIE9LIHJlZ2FyZGxlc3Mgb2Ygd2hhdCB0aGlzCisgICAgLy8gcmV0dXJucyBi dXQgYnJlYWtzIGJhZGx5IGlmIHRoaXMgY2hhbmdlcyBpdHMgbWluZCBmb3IgYW55IHBhcnRpY3Vs YXIgSW5mZXJyZWRWYWx1ZS4gVGhpcworICAgIC8vIG1ldGhvZCBwcm90ZWN0cyB1cyBmcm9tIHRo YXQuCisgICAgYm9vbCBpc1N0aWxsVmFsaWQoSW5mZXJyZWRWYWx1ZSogdmFsdWUpCisgICAgewor ICAgICAgICByZXR1cm4gbV92YWxpZEluZmVycmVkVmFsdWVzLmFkZCh2YWx1ZSwgdmFsdWUtPmlz U3RpbGxWYWxpZCgpKS5pdGVyYXRvci0+dmFsdWU7CisgICAgfQorCiAgICAgU1NBQ2FsY3VsYXRv ciBtX3BvaW50ZXJTU0E7CiAgICAgU1NBQ2FsY3VsYXRvciBtX2FsbG9jYXRpb25TU0E7CiAgICAg SGFzaFNldDxOb2RlKj4gbV9zaW5rQ2FuZGlkYXRlczsKQEAgLTIxODMsNiArMjE5Miw4IEBAIHBy aXZhdGU6CiAgICAgSW5zZXJ0aW9uU2V0IG1faW5zZXJ0aW9uU2V0OwogICAgIENvbWJpbmVkTGl2 ZW5lc3MgbV9jb21iaW5lZExpdmVuZXNzOwogCisgICAgSGFzaE1hcDxJbmZlcnJlZFZhbHVlKiwg Ym9vbD4gbV92YWxpZEluZmVycmVkVmFsdWVzOworCiAgICAgSGFzaE1hcDxOb2RlKiwgTm9kZSo+ IG1fbWF0ZXJpYWxpemF0aW9uVG9Fc2NhcGVlOwogICAgIEhhc2hNYXA8Tm9kZSosIFZlY3RvcjxO b2RlKj4+IG1fbWF0ZXJpYWxpemF0aW9uU2l0ZVRvTWF0ZXJpYWxpemF0aW9uczsKICAgICBIYXNo TWFwPE5vZGUqLCBWZWN0b3I8UHJvbW90ZWRIZWFwTG9jYXRpb24+PiBtX21hdGVyaWFsaXphdGlv blNpdGVUb1JlY292ZXJpZXM7Cg==