174900 2017-07-27 09:55:27 -0700 ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread 2017-07-28 16:26:24 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 mark.lam ysuzuki commit-queue fpizlo jfbastien keith_miller msaboff saam ysuzuki oldest_to_newest 1332664 0 mark.lam 2017-07-27 09:55:27 -0700 Debug build JSC tests are failing: ** The following JSC stress test failures have been introduced: microbenchmarks/deltablue-varargs.js.ftl-eager microbenchmarks/deltablue-varargs.js.ftl-eager-no-cjit microbenchmarks/deltablue-varargs.js.ftl-eager-no-cjit-b3o1 The commit range that introduced this failure is: 219725:219732. The likely culprit (given the assertion failure) is https://trac.webkit.org/r219727. 1332672 1 ysuzuki 2017-07-27 10:15:48 -0700 I'm looking it now. 1332673 2 ysuzuki 2017-07-27 10:17:44 -0700 OK, I've reproduced it with ftl-eager-no-cjit configuration. Cool, it's no CJIT :D 1332675 3 ysuzuki 2017-07-27 10:39:57 -0700 In this arguments elimination phase, due to high cost of AI, we intentionally do not run AI. Instead, we use ForceOSRExit etc. (pseudo terminals) not to look into unreachable nodes. The problem is that even transforming phase also checks this pseudo terminals. BB1 1: ForceOSRExit 2: CreateDirectArguments BB2 3: GetButterfly(@2) 4: ForceOSRExit In the above case, @2 is not converted to PhantomDirectArguments. But @3 is processed. And the assertion fires. 1332676 4 ysuzuki 2017-07-27 10:41:08 -0700 (In reply to Yusuke Suzuki from comment #3) > In this arguments elimination phase, due to high cost of AI, we > intentionally do not run AI. > Instead, we use ForceOSRExit etc. (pseudo terminals) not to look into > unreachable nodes. > The problem is that even transforming phase also checks this pseudo > terminals. > > > BB1 > 1: ForceOSRExit > 2: CreateDirectArguments > > BB2 > 3: GetButterfly(@2) > 4: ForceOSRExit > > In the above case, @2 is not converted to PhantomDirectArguments. > But @3 is processed. And the assertion fires. I think the reasonable fix is not listing candidates after pseudo exits. 1332679 5 saam 2017-07-27 10:57:25 -0700 (In reply to Yusuke Suzuki from comment #4) > (In reply to Yusuke Suzuki from comment #3) > > In this arguments elimination phase, due to high cost of AI, we > > intentionally do not run AI. > > Instead, we use ForceOSRExit etc. (pseudo terminals) not to look into > > unreachable nodes. > > The problem is that even transforming phase also checks this pseudo > > terminals. > > > > > > BB1 > > 1: ForceOSRExit > > 2: CreateDirectArguments > > > > BB2 > > 3: GetButterfly(@2) > > 4: ForceOSRExit > > > > In the above case, @2 is not converted to PhantomDirectArguments. > > But @3 is processed. And the assertion fires. > > I think the reasonable fix is not listing candidates after pseudo exits. Sounds reasonable to me. 1332680 6 316556 ysuzuki 2017-07-27 11:14:47 -0700 Created attachment 316556 Patch 1332912 7 316556 commit-queue 2017-07-28 00:26:00 -0700 Comment on attachment 316556 Patch Clearing flags on attachment: 316556 Committed r219997: <http://trac.webkit.org/changeset/219997> 1332913 8 commit-queue 2017-07-28 00:26:02 -0700 All reviewed patches have been landed. Closing bug. 1333120 9 webkit-bug-importer 2017-07-28 16:26:24 -0700 <rdar://problem/33601432> 316556 2017-07-27 11:14:47 -0700 2017-07-28 00:26:00 -0700 Patch bug-174900-20170728031446.patch text/plain 4043 ysuzuki U3VidmVyc2lvbiBSZXZpc2lvbjogMjE5OTgyCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCAw MWE1YWRlZTlmMWE3MDA3NzVlZDAyMjFkYWMzNjViNDBkZjE3ODI4Li4wNTMxOWUzYWQ0MmNhMzFh NjZjOGVkMzY2ZmU0NTc4YTU1OGRmNjJhIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs NSArMSwzMCBAQAogMjAxNy0wNy0yNyAgWXVzdWtlIFN1enVraSAgPHV0YXRhbmUudGVhQGdtYWls LmNvbT4KIAorICAgICAgICBBU1NFUlRJT04gRkFJTEVEOiBjYW5kaWRhdGUtPm9wKCkgPT0gUGhh bnRvbUNyZWF0ZVJlc3QgfHwgY2FuZGlkYXRlLT5vcCgpID09IFBoYW50b21EaXJlY3RBcmd1bWVu dHMgfHwgY2FuZGlkYXRlLT5vcCgpID09IFBoYW50b21DbG9uZWRBcmd1bWVudHMgfHwgY2FuZGlk YXRlLT5vcCgpID09IFBoYW50b21TcHJlYWQgfHwgY2FuZGlkYXRlLT5vcCgpID09IFBoYW50b21O ZXdBcnJheVdpdGhTcHJlYWQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i dWcuY2dpP2lkPTE3NDkwMAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgor CisgICAgICAgIEluIHRoZSBhcmd1bWVudHMgZWxpbWluYXRpb24gcGhhc2UsIGR1ZSB0byBoaWdo IGNvc3Qgb2YgQUksIHdlIGludGVudGlvbmFsbHkgZG8gbm90IHJ1biBBSS4KKyAgICAgICAgSW5z dGVhZCwgd2UgdXNlIEZvcmNlT1NSRXhpdCBldGMuIChwc2V1ZG8gdGVybWluYWxzKSBub3QgdG8g bG9vayBpbnRvIHVucmVhY2hhYmxlIG5vZGVzLgorICAgICAgICBUaGUgcHJvYmxlbSBpcyB0aGF0 IGV2ZW4gdHJhbnNmb3JtaW5nIHBoYXNlIGFsc28gY2hlY2tzIHRoaXMgcHNldWRvIHRlcm1pbmFs cy4KKworICAgICAgICAgICAgQkIxCisgICAgICAgICAgICAxOiBGb3JjZU9TUkV4aXQKKyAgICAg ICAgICAgIDI6IENyZWF0ZURpcmVjdEFyZ3VtZW50cworCisgICAgICAgICAgICBCQjIKKyAgICAg ICAgICAgIDM6IEdldEJ1dHRlcmZseShAMikKKyAgICAgICAgICAgIDQ6IEZvcmNlT1NSRXhpdAor CisgICAgICAgIEluIHRoZSBhYm92ZSBjYXNlLCBAMiBpcyBub3QgY29udmVydGVkIHRvIFBoYW50 b21EaXJlY3RBcmd1bWVudHMuIEJ1dCBAMyBpcyBwcm9jZXNzZWQuIEFuZCB0aGUgYXNzZXJ0aW9u IGZpcmVzLgorCisgICAgICAgIEluIHRoaXMgcGF0Y2gsIHdlIGRvIG5vdCBsaXN0IGNhbmRpZGF0 ZXMgdXAgYWZ0ZXIgc2VlaW5nIHBzZXVkbyB0ZXJtaW5hbHMgaW4gYmFzaWMgYmxvY2tzLgorCisg ICAgICAgICogZGZnL0RGR0FyZ3VtZW50c0VsaW1pbmF0aW9uUGhhc2UuY3BwOgorCisyMDE3LTA3 LTI3ICBZdXN1a2UgU3V6dWtpICA8dXRhdGFuZS50ZWFAZ21haWwuY29tPgorCiAgICAgICAgIFVu cmV2aWV3ZWQsIGJ1aWxkIGZpeCBmb3IgQ0xvb3AKICAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTE3MTYzNwogCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNj cmlwdENvcmUvZGZnL0RGR0FyZ3VtZW50c0VsaW1pbmF0aW9uUGhhc2UuY3BwIGIvU291cmNlL0ph dmFTY3JpcHRDb3JlL2RmZy9ERkdBcmd1bWVudHNFbGltaW5hdGlvblBoYXNlLmNwcAppbmRleCBm ZDZiZjk4ZTZkMjJiZGNlNTJkYWViYzgzMjM0MmRjNGYwY2JmM2Q5Li5iYWEwYmNlMzQ5YzA1OTgy MTZlNzA4ZTM3NjU4NWVkZTYxMTQwOGFiIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvZGZnL0RGR0FyZ3VtZW50c0VsaW1pbmF0aW9uUGhhc2UuY3BwCisrKyBiL1NvdXJjZS9KYXZh U2NyaXB0Q29yZS9kZmcvREZHQXJndW1lbnRzRWxpbWluYXRpb25QaGFzZS5jcHAKQEAgLTE1Miw2 ICsxNTIsOCBAQCBjbGFzcyBBcmd1bWVudHNFbGltaW5hdGlvblBoYXNlIDogcHVibGljIFBoYXNl IHsKICAgICAgICAgICAgICAgICBkZWZhdWx0OgogICAgICAgICAgICAgICAgICAgICBicmVhazsK ICAgICAgICAgICAgICAgICB9CisgICAgICAgICAgICAgICAgaWYgKG5vZGUtPmlzUHNldWRvVGVy bWluYWwoKSkKKyAgICAgICAgICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgICAgICB9CiAgICAg ICAgIH0KICAgICAgICAgCmRpZmYgLS1naXQgYS9KU1Rlc3RzL0NoYW5nZUxvZyBiL0pTVGVzdHMv Q2hhbmdlTG9nCmluZGV4IGQ1NTE0MDQyZTFhNWE1NTczY2VjOTVkYzQ2MGFmZDdmNDA5ZTMxZDEu LjRjNmMwMmIwNmYwYWY0ZjY3YzY0NTRjNjkxZDkwOGU1MzMwZjM4ZDIgMTAwNjQ0Ci0tLSBhL0pT VGVzdHMvQ2hhbmdlTG9nCisrKyBiL0pTVGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDUgKzEsMTcgQEAK IDIwMTctMDctMjcgIFl1c3VrZSBTdXp1a2kgIDx1dGF0YW5lLnRlYUBnbWFpbC5jb20+CiAKKyAg ICAgICAgQVNTRVJUSU9OIEZBSUxFRDogY2FuZGlkYXRlLT5vcCgpID09IFBoYW50b21DcmVhdGVS ZXN0IHx8IGNhbmRpZGF0ZS0+b3AoKSA9PSBQaGFudG9tRGlyZWN0QXJndW1lbnRzIHx8IGNhbmRp ZGF0ZS0+b3AoKSA9PSBQaGFudG9tQ2xvbmVkQXJndW1lbnRzIHx8IGNhbmRpZGF0ZS0+b3AoKSA9 PSBQaGFudG9tU3ByZWFkIHx8IGNhbmRpZGF0ZS0+b3AoKSA9PSBQaGFudG9tTmV3QXJyYXlXaXRo U3ByZWFkCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0x NzQ5MDAKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAq IHN0cmVzcy9hcmd1bWVudHMtZWxpbWluYXRpb24tY2FuZGlkYXRlLWxpc3RpbmdzLXNob3VsZC1y ZXNwZWN0LXBzZXVkby10ZXJtaW5hbHMuanM6IEFkZGVkLgorICAgICAgICAoc2lkZUVmZmVjdCk6 CisgICAgICAgIChhcmdzKToKKyAgICAgICAgKHRlc3QpOgorCisyMDE3LTA3LTI3ICBZdXN1a2Ug U3V6dWtpICA8dXRhdGFuZS50ZWFAZ21haWwuY29tPgorCiAgICAgICAgIEhvaXN0IERPTSBiaW5k aW5nIGF0dHJpYnV0ZSBnZXR0ZXIgcHJvbG9ndWUgaW50byBKYXZhU2NyaXB0Q29yZSB0YWtpbmcg YWR2YW50YWdlIG9mIERPTUpJVCAvIENoZWNrU3ViQ2xhc3MKICAgICAgICAgaHR0cHM6Ly9idWdz LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE3MTYzNwogCmRpZmYgLS1naXQgYS9KU1Rlc3Rz L3N0cmVzcy9hcmd1bWVudHMtZWxpbWluYXRpb24tY2FuZGlkYXRlLWxpc3RpbmdzLXNob3VsZC1y ZXNwZWN0LXBzZXVkby10ZXJtaW5hbHMuanMgYi9KU1Rlc3RzL3N0cmVzcy9hcmd1bWVudHMtZWxp bWluYXRpb24tY2FuZGlkYXRlLWxpc3RpbmdzLXNob3VsZC1yZXNwZWN0LXBzZXVkby10ZXJtaW5h bHMuanMKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMC4uYjNlNjc1ZjQ2OTMxOWNjNzFiZTczZmNlYmQyNmUyMmFjOWIwZDI0 MQotLS0gL2Rldi9udWxsCisrKyBiL0pTVGVzdHMvc3RyZXNzL2FyZ3VtZW50cy1lbGltaW5hdGlv bi1jYW5kaWRhdGUtbGlzdGluZ3Mtc2hvdWxkLXJlc3BlY3QtcHNldWRvLXRlcm1pbmFscy5qcwpA QCAtMCwwICsxLDI4IEBACit2YXIgaW5kZXggPSAwOworZnVuY3Rpb24gc2lkZUVmZmVjdCgpCit7 CisgICAgcmV0dXJuIGluZGV4KysgPT09IDA7Cit9Citub0lubGluZShzaWRlRWZmZWN0KTsKKwor ZnVuY3Rpb24gYXJncyhmbGFnKQoreworICAgIHZhciBhID0gYXJndW1lbnRzOworICAgIGlmIChm bGFnKSB7CisgICAgICAgIHJldHVybiBhWzRdICsgYVs1XTsKKyAgICB9CisgICAgcmV0dXJuIGEu bGVuZ3RoOworfQorCitmdW5jdGlvbiB0ZXN0KGZsYWcpCit7CisgICAgYXJncyhmbGFnLCAwLCAx LCAyKTsKKyAgICBpZiAoc2lkZUVmZmVjdCgpKSB7CisgICAgICAgIE9TUkV4aXQoKTsKKyAgICAg ICAgYXJncyhzaWRlRWZmZWN0KCksIDAsIDEsIDIpOworICAgIH0KK30KK25vSW5saW5lKHRlc3Qp OworCitmb3IgKHZhciBpID0gMDsgaSA8IDFlMzsgKytpKQorICAgIHRlc3QoZmFsc2UpOwo=