<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>199821</bug_id>
          
          <creation_ts>2019-07-15 19:43:05 -0700</creation_ts>
          <short_desc>ArgumentsEliminationPhase should insert KillStack nodes before PutStack nodes that it adds.</short_desc>
          <delta_ts>2019-07-19 12:13:44 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Mark Lam">mark.lam</reporter>
          <assigned_to name="Mark Lam">mark.lam</assigned_to>
          <cc>ews-watchlist</cc>
    
    <cc>fpizlo</cc>
    
    <cc>keith_miller</cc>
    
    <cc>msaboff</cc>
    
    <cc>rmorisset</cc>
    
    <cc>saam</cc>
    
    <cc>tzagallo</cc>
    
    <cc>webkit-bug-importer</cc>
    
    <cc>ysuzuki</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1553082</commentid>
    <comment_count>0</comment_count>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2019-07-15 19:43:05 -0700</bug_when>
    <thetext>&lt;rdar://problem/52452328&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1553085</commentid>
    <comment_count>1</comment_count>
      <attachid>374184</attachid>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2019-07-15 19:57:20 -0700</bug_when>
    <thetext>Created attachment 374184
proposed patch.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1553097</commentid>
    <comment_count>2</comment_count>
      <attachid>374184</attachid>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2019-07-15 20:31:45 -0700</bug_when>
    <thetext>Comment on attachment 374184
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=374184&amp;action=review

&gt; Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp:254
&gt;          }

I also would like to suggest that filling [mandatoryMinimum, limit] range with `setFlush(FlushedAt(ConflictingFlush));` (KillStack) to represent the precise availability information in this phase.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1553098</commentid>
    <comment_count>3</comment_count>
      <attachid>374184</attachid>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2019-07-15 20:32:02 -0700</bug_when>
    <thetext>Comment on attachment 374184
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=374184&amp;action=review

&gt;&gt; Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp:254
&gt;&gt;          }
&gt; 
&gt; I also would like to suggest that filling [mandatoryMinimum, limit] range with `setFlush(FlushedAt(ConflictingFlush));` (KillStack) to represent the precise availability information in this phase.

Typo, [mandatoryMinimum, limit).</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1553124</commentid>
    <comment_count>4</comment_count>
      <attachid>374184</attachid>
    <who name="EWS Watchlist">ews-watchlist</who>
    <bug_when>2019-07-15 22:13:25 -0700</bug_when>
    <thetext>Comment on attachment 374184
proposed patch.

Attachment 374184 did not pass jsc-ews (mac):
Output: https://webkit-queues.webkit.org/results/12747824

New failing tests:
microbenchmarks/string-concat-long-convert.js.ftl-eager
microbenchmarks/string-concat-long.js.default
stress/load-varargs-then-inlined-call-and-exit.js.ftl-no-cjit-validate-sampling-profiler
stress/varargs-varargs-inlined-exit.js.ftl-eager-no-cjit-b3o1
stress/load-varargs-then-inlined-call-and-exit-strict.js.ftl-eager
stress/load-varargs-then-inlined-call-and-exit.js.ftl-eager
stress/load-varargs-then-inlined-call-exit-in-foo.js.ftl-eager-no-cjit-b3o1
microbenchmarks/string-concat-long.js.ftl-eager-no-cjit-b3o1
microbenchmarks/string-concat-long-convert.js.ftl-eager-no-cjit
microbenchmarks/call-spread-call.js.ftl-eager-no-cjit
microbenchmarks/call-spread-apply.js.ftl-no-cjit-b3o0
stress/tailCallForwardArguments.js.ftl-eager-no-cjit-b3o1
stress/construct-varargs-inline-smaller-Foo.js.ftl-eager-no-cjit
microbenchmarks/call-spread-apply.js.default
stress/construct-varargs-inline-smaller-Foo.js.ftl-eager
stress/varargs-varargs-inlined-exit.js.ftl-no-cjit-validate-sampling-profiler
microbenchmarks/call-spread-call.js.ftl-eager-no-cjit-b3o1
stress/varargs-varargs-inlined-exit-strict-mode.js.ftl-eager
microbenchmarks/string-concat-long-convert.js.ftl-no-cjit-no-put-stack-validate
stress/varargs-varargs-inlined-exit-strict-mode.js.ftl-no-cjit-b3o0
stress/get-argument-by-val-in-inlined-varargs-call-out-of-bounds.js.ftl-no-cjit-validate-sampling-profiler
stress/load-varargs-then-inlined-call.js.ftl-eager-no-cjit
stress/spread-multi-layers.js.bytecode-cache
stress/load-varargs-then-inlined-call-inlined.js.ftl-no-cjit-no-put-stack-validate
stress/load-varargs-then-inlined-call-and-exit.js.ftl-no-cjit-small-pool
stress/load-varargs-then-inlined-call-exit-in-foo.js.ftl-eager
stress/spread-multi-layers.js.ftl-no-cjit-b3o0
microbenchmarks/call-spread-call.js.ftl-no-cjit-small-pool
stress/varargs-varargs-inlined-exit-strict-mode.js.ftl-no-cjit-validate-sampling-profiler
stress/load-varargs-elimination-bounds-check-barely.js.ftl-eager-no-cjit-b3o1
stress/varargs-varargs-inlined-exit-strict-mode.js.ftl-no-cjit-no-put-stack-validate
microbenchmarks/string-concat-long-convert.js.bytecode-cache
stress/load-varargs-elimination-bounds-check.js.ftl-no-cjit-validate-sampling-profiler
microbenchmarks/call-spread-call.js.ftl-no-cjit-validate-sampling-profiler
microbenchmarks/call-spread-apply.js.bytecode-cache
stress/varargs-varargs-inlined-exit.js.ftl-eager
stress/construct-varargs-inline-smaller-Foo.js.ftl-no-cjit-no-put-stack-validate
stress/load-varargs-then-inlined-call-and-exit-strict.js.ftl-eager-no-cjit
stress/load-varargs-then-inlined-call-inlined.js.ftl-no-cjit-validate-sampling-profiler
stress/load-varargs-elimination-bounds-check-barely.js.ftl-no-cjit-no-put-stack-validate
stress/load-varargs-then-inlined-call-inlined.js.ftl-eager
microbenchmarks/string-concat-long.js.ftl-eager
microbenchmarks/call-spread-apply.js.ftl-eager-no-cjit
stress/load-varargs-then-inlined-call-exit-in-foo.js.ftl-eager-no-cjit
microbenchmarks/string-concat-long.js.bytecode-cache
stress/spread-multi-layers.js.default
stress/load-varargs-then-inlined-call-inlined.js.ftl-eager-no-cjit-b3o1
stress/construct-varargs-inline-smaller-Foo.js.ftl-eager-no-cjit-b3o1
stress/varargs-varargs-inlined-exit.js.ftl-eager-no-cjit
stress/get-argument-by-val-in-inlined-varargs-call-out-of-bounds.js.ftl-eager-no-cjit-b3o1
stress/spread-multi-layers.js.ftl-eager
stress/spread-multi-layers.js.ftl-eager-no-cjit-b3o1
microbenchmarks/string-concat-long.js.ftl-no-cjit-b3o0
stress/load-varargs-elimination-bounds-check-barely.js.ftl-no-cjit-validate-sampling-profiler
microbenchmarks/string-concat-long.js.ftl-no-cjit-small-pool
microbenchmarks/string-concat-long-convert.js.ftl-no-cjit-b3o0
stress/proxy-call.js.ftl-eager
stress/load-varargs-elimination-bounds-check.js.ftl-eager
microbenchmarks/string-concat-long.js.ftl-eager-no-cjit
stress/load-varargs-then-inlined-call.js.ftl-no-cjit-small-pool
stress/varargs-varargs-inlined-exit.js.ftl-no-cjit-no-put-stack-validate
stress/get-argument-by-val-in-inlined-varargs-call-out-of-bounds.js.ftl-no-cjit-no-put-stack-validate
stress/load-varargs-then-inlined-call-inlined.js.ftl-no-cjit-small-pool
stress/load-varargs-then-inlined-call.js.ftl-no-cjit-no-put-stack-validate
stress/load-varargs-then-inlined-call-exit-in-foo.js.ftl-no-cjit-validate-sampling-profiler
stress/load-varargs-elimination-bounds-check.js.ftl-eager-no-cjit-b3o1
microbenchmarks/string-concat-long-convert.js.default
microbenchmarks/call-spread-apply.js.ftl-eager-no-cjit-b3o1
microbenchmarks/call-spread-call.js.ftl-no-cjit-no-put-stack-validate
stress/spread-multi-layers.js.ftl-eager-no-cjit
stress/load-varargs-then-inlined-call-and-exit-strict.js.ftl-no-cjit-validate-sampling-profiler
microbenchmarks/call-spread-apply.js.ftl-no-cjit-validate-sampling-profiler
stress/load-varargs-then-inlined-call-exit-in-foo.js.ftl-no-cjit-no-put-stack-validate
microbenchmarks/string-concat-long-convert.js.ftl-eager-no-cjit-b3o1
stress/proxy-call.js.ftl-eager-no-cjit-b3o1
stress/load-varargs-then-inlined-call-and-exit.js.ftl-eager-no-cjit-b3o1
stress/load-varargs-elimination-bounds-check-barely.js.ftl-eager
stress/load-varargs-elimination-bounds-check.js.ftl-no-cjit-b3o0
microbenchmarks/call-spread-apply.js.ftl-no-cjit-no-put-stack-validate
stress/construct-varargs-inline-smaller-Foo.js.ftl-no-cjit-validate-sampling-profiler
stress/load-varargs-elimination-bounds-check-barely.js.ftl-eager-no-cjit
stress/load-varargs-then-inlined-call-and-exit-strict.js.ftl-no-cjit-b3o0
stress/load-varargs-then-inlined-call.js.ftl-eager
stress/load-varargs-elimination-bounds-check.js.ftl-no-cjit-no-put-stack-validate
stress/spread-multi-layers.js.ftl-no-cjit-validate-sampling-profiler
stress/load-varargs-then-inlined-call-and-exit-strict.js.ftl-eager-no-cjit-b3o1
stress/load-varargs-then-inlined-call-and-exit-strict.js.ftl-no-cjit-no-put-stack-validate
microbenchmarks/string-concat-long.js.ftl-no-cjit-validate-sampling-profiler
stress/load-varargs-then-inlined-call-and-exit.js.ftl-no-cjit-b3o0
stress/get-argument-by-val-in-inlined-varargs-call-out-of-bounds.js.ftl-eager-no-cjit
microbenchmarks/string-concat-long-convert.js.ftl-no-cjit-small-pool
stress/load-varargs-elimination-bounds-check.js.ftl-eager-no-cjit
microbenchmarks/call-spread-call.js.ftl-eager
stress/varargs-varargs-inlined-exit.js.ftl-no-cjit-b3o0
microbenchmarks/call-spread-call.js.default
stress/load-varargs-then-inlined-call.js.ftl-eager-no-cjit-b3o1
stress/varargs-varargs-inlined-exit-strict-mode.js.ftl-eager-no-cjit
microbenchmarks/call-spread-apply.js.ftl-eager
microbenchmarks/call-spread-call.js.bytecode-cache
stress/proxy-call.js.ftl-eager-no-cjit
stress/load-varargs-then-inlined-call-inlined.js.ftl-eager-no-cjit
microbenchmarks/string-concat-long.js.ftl-no-cjit-no-put-stack-validate
stress/spread-multi-layers.js.ftl-no-cjit-no-put-stack-validate
stress/varargs-varargs-inlined-exit-strict-mode.js.ftl-eager-no-cjit-b3o1
stress/load-varargs-then-inlined-call-and-exit.js.ftl-no-cjit-no-put-stack-validate
stress/get-argument-by-val-in-inlined-varargs-call-out-of-bounds.js.ftl-eager
stress/load-varargs-then-inlined-call-and-exit.js.ftl-eager-no-cjit
stress/load-varargs-elimination-bounds-check-barely.js.ftl-no-cjit-b3o0
stress/load-varargs-then-inlined-call.js.ftl-no-cjit-validate-sampling-profiler
microbenchmarks/string-concat-long-convert.js.ftl-no-cjit-validate-sampling-profiler
stress/get-argument-by-val-in-inlined-varargs-call-out-of-bounds.js.ftl-no-cjit-b3o0
apiTests</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1553132</commentid>
    <comment_count>5</comment_count>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2019-07-15 23:44:18 -0700</bug_when>
    <thetext>(In reply to Build Bot from comment #4)
&gt; Comment on attachment 374184 [details]
&gt; proposed patch.
&gt; 
&gt; Attachment 374184 [details] did not pass jsc-ews (mac):
&gt; Output: https://webkit-queues.webkit.org/results/12747824
&gt; 
&gt; New failing tests:
&gt; microbenchmarks/string-concat-long-convert.js.ftl-eager
&gt; microbenchmarks/string-concat-long.js.default
&gt; stress/load-varargs-then-inlined-call-and-exit.js.ftl-no-cjit-validate-
&gt; sampling-profiler
&gt; stress/varargs-varargs-inlined-exit.js.ftl-eager-no-cjit-b3o1
&gt; stress/load-varargs-then-inlined-call-and-exit-strict.js.ftl-eager
&gt; stress/load-varargs-then-inlined-call-and-exit.js.ftl-eager
&gt; stress/load-varargs-then-inlined-call-exit-in-foo.js.ftl-eager-no-cjit-b3o1
&gt; microbenchmarks/string-concat-long.js.ftl-eager-no-cjit-b3o1
&gt; microbenchmarks/string-concat-long-convert.js.ftl-eager-no-cjit
&gt; microbenchmarks/call-spread-call.js.ftl-eager-no-cjit
&gt; microbenchmarks/call-spread-apply.js.ftl-no-cjit-b3o0
&gt; stress/tailCallForwardArguments.js.ftl-eager-no-cjit-b3o1
&gt; stress/construct-varargs-inline-smaller-Foo.js.ftl-eager-no-cjit
&gt; microbenchmarks/call-spread-apply.js.default
&gt; stress/construct-varargs-inline-smaller-Foo.js.ftl-eager
&gt; stress/varargs-varargs-inlined-exit.js.ftl-no-cjit-validate-sampling-profiler
&gt; microbenchmarks/call-spread-call.js.ftl-eager-no-cjit-b3o1
&gt; stress/varargs-varargs-inlined-exit-strict-mode.js.ftl-eager
&gt; microbenchmarks/string-concat-long-convert.js.ftl-no-cjit-no-put-stack-
&gt; validate
&gt; stress/varargs-varargs-inlined-exit-strict-mode.js.ftl-no-cjit-b3o0
&gt; stress/get-argument-by-val-in-inlined-varargs-call-out-of-bounds.js.ftl-no-
&gt; cjit-validate-sampling-profiler
&gt; stress/load-varargs-then-inlined-call.js.ftl-eager-no-cjit
&gt; stress/spread-multi-layers.js.bytecode-cache
&gt; stress/load-varargs-then-inlined-call-inlined.js.ftl-no-cjit-no-put-stack-
&gt; validate
&gt; stress/load-varargs-then-inlined-call-and-exit.js.ftl-no-cjit-small-pool
&gt; stress/load-varargs-then-inlined-call-exit-in-foo.js.ftl-eager
&gt; stress/spread-multi-layers.js.ftl-no-cjit-b3o0
&gt; microbenchmarks/call-spread-call.js.ftl-no-cjit-small-pool
&gt; stress/varargs-varargs-inlined-exit-strict-mode.js.ftl-no-cjit-validate-
&gt; sampling-profiler
&gt; stress/load-varargs-elimination-bounds-check-barely.js.ftl-eager-no-cjit-b3o1
&gt; stress/varargs-varargs-inlined-exit-strict-mode.js.ftl-no-cjit-no-put-stack-
&gt; validate
&gt; microbenchmarks/string-concat-long-convert.js.bytecode-cache
&gt; stress/load-varargs-elimination-bounds-check.js.ftl-no-cjit-validate-
&gt; sampling-profiler
&gt; microbenchmarks/call-spread-call.js.ftl-no-cjit-validate-sampling-profiler
&gt; microbenchmarks/call-spread-apply.js.bytecode-cache
&gt; stress/varargs-varargs-inlined-exit.js.ftl-eager
&gt; stress/construct-varargs-inline-smaller-Foo.js.ftl-no-cjit-no-put-stack-
&gt; validate
&gt; stress/load-varargs-then-inlined-call-and-exit-strict.js.ftl-eager-no-cjit
&gt; stress/load-varargs-then-inlined-call-inlined.js.ftl-no-cjit-validate-
&gt; sampling-profiler
&gt; stress/load-varargs-elimination-bounds-check-barely.js.ftl-no-cjit-no-put-
&gt; stack-validate
&gt; stress/load-varargs-then-inlined-call-inlined.js.ftl-eager
&gt; microbenchmarks/string-concat-long.js.ftl-eager
&gt; microbenchmarks/call-spread-apply.js.ftl-eager-no-cjit
&gt; stress/load-varargs-then-inlined-call-exit-in-foo.js.ftl-eager-no-cjit
&gt; microbenchmarks/string-concat-long.js.bytecode-cache
&gt; stress/spread-multi-layers.js.default
&gt; stress/load-varargs-then-inlined-call-inlined.js.ftl-eager-no-cjit-b3o1
&gt; stress/construct-varargs-inline-smaller-Foo.js.ftl-eager-no-cjit-b3o1
&gt; stress/varargs-varargs-inlined-exit.js.ftl-eager-no-cjit
&gt; stress/get-argument-by-val-in-inlined-varargs-call-out-of-bounds.js.ftl-
&gt; eager-no-cjit-b3o1
&gt; stress/spread-multi-layers.js.ftl-eager
&gt; stress/spread-multi-layers.js.ftl-eager-no-cjit-b3o1
&gt; microbenchmarks/string-concat-long.js.ftl-no-cjit-b3o0
&gt; stress/load-varargs-elimination-bounds-check-barely.js.ftl-no-cjit-validate-
&gt; sampling-profiler
&gt; microbenchmarks/string-concat-long.js.ftl-no-cjit-small-pool
&gt; microbenchmarks/string-concat-long-convert.js.ftl-no-cjit-b3o0
&gt; stress/proxy-call.js.ftl-eager
&gt; stress/load-varargs-elimination-bounds-check.js.ftl-eager
&gt; microbenchmarks/string-concat-long.js.ftl-eager-no-cjit
&gt; stress/load-varargs-then-inlined-call.js.ftl-no-cjit-small-pool
&gt; stress/varargs-varargs-inlined-exit.js.ftl-no-cjit-no-put-stack-validate
&gt; stress/get-argument-by-val-in-inlined-varargs-call-out-of-bounds.js.ftl-no-
&gt; cjit-no-put-stack-validate
&gt; stress/load-varargs-then-inlined-call-inlined.js.ftl-no-cjit-small-pool
&gt; stress/load-varargs-then-inlined-call.js.ftl-no-cjit-no-put-stack-validate
&gt; stress/load-varargs-then-inlined-call-exit-in-foo.js.ftl-no-cjit-validate-
&gt; sampling-profiler
&gt; stress/load-varargs-elimination-bounds-check.js.ftl-eager-no-cjit-b3o1
&gt; microbenchmarks/string-concat-long-convert.js.default
&gt; microbenchmarks/call-spread-apply.js.ftl-eager-no-cjit-b3o1
&gt; microbenchmarks/call-spread-call.js.ftl-no-cjit-no-put-stack-validate
&gt; stress/spread-multi-layers.js.ftl-eager-no-cjit
&gt; stress/load-varargs-then-inlined-call-and-exit-strict.js.ftl-no-cjit-
&gt; validate-sampling-profiler
&gt; microbenchmarks/call-spread-apply.js.ftl-no-cjit-validate-sampling-profiler
&gt; stress/load-varargs-then-inlined-call-exit-in-foo.js.ftl-no-cjit-no-put-
&gt; stack-validate
&gt; microbenchmarks/string-concat-long-convert.js.ftl-eager-no-cjit-b3o1
&gt; stress/proxy-call.js.ftl-eager-no-cjit-b3o1
&gt; stress/load-varargs-then-inlined-call-and-exit.js.ftl-eager-no-cjit-b3o1
&gt; stress/load-varargs-elimination-bounds-check-barely.js.ftl-eager
&gt; stress/load-varargs-elimination-bounds-check.js.ftl-no-cjit-b3o0
&gt; microbenchmarks/call-spread-apply.js.ftl-no-cjit-no-put-stack-validate
&gt; stress/construct-varargs-inline-smaller-Foo.js.ftl-no-cjit-validate-sampling-
&gt; profiler
&gt; stress/load-varargs-elimination-bounds-check-barely.js.ftl-eager-no-cjit
&gt; stress/load-varargs-then-inlined-call-and-exit-strict.js.ftl-no-cjit-b3o0
&gt; stress/load-varargs-then-inlined-call.js.ftl-eager
&gt; stress/load-varargs-elimination-bounds-check.js.ftl-no-cjit-no-put-stack-
&gt; validate
&gt; stress/spread-multi-layers.js.ftl-no-cjit-validate-sampling-profiler
&gt; stress/load-varargs-then-inlined-call-and-exit-strict.js.ftl-eager-no-cjit-
&gt; b3o1
&gt; stress/load-varargs-then-inlined-call-and-exit-strict.js.ftl-no-cjit-no-put-
&gt; stack-validate
&gt; microbenchmarks/string-concat-long.js.ftl-no-cjit-validate-sampling-profiler
&gt; stress/load-varargs-then-inlined-call-and-exit.js.ftl-no-cjit-b3o0
&gt; stress/get-argument-by-val-in-inlined-varargs-call-out-of-bounds.js.ftl-
&gt; eager-no-cjit
&gt; microbenchmarks/string-concat-long-convert.js.ftl-no-cjit-small-pool
&gt; stress/load-varargs-elimination-bounds-check.js.ftl-eager-no-cjit
&gt; microbenchmarks/call-spread-call.js.ftl-eager
&gt; stress/varargs-varargs-inlined-exit.js.ftl-no-cjit-b3o0
&gt; microbenchmarks/call-spread-call.js.default
&gt; stress/load-varargs-then-inlined-call.js.ftl-eager-no-cjit-b3o1
&gt; stress/varargs-varargs-inlined-exit-strict-mode.js.ftl-eager-no-cjit
&gt; microbenchmarks/call-spread-apply.js.ftl-eager
&gt; microbenchmarks/call-spread-call.js.bytecode-cache
&gt; stress/proxy-call.js.ftl-eager-no-cjit
&gt; stress/load-varargs-then-inlined-call-inlined.js.ftl-eager-no-cjit
&gt; microbenchmarks/string-concat-long.js.ftl-no-cjit-no-put-stack-validate
&gt; stress/spread-multi-layers.js.ftl-no-cjit-no-put-stack-validate
&gt; stress/varargs-varargs-inlined-exit-strict-mode.js.ftl-eager-no-cjit-b3o1
&gt; stress/load-varargs-then-inlined-call-and-exit.js.ftl-no-cjit-no-put-stack-
&gt; validate
&gt; stress/get-argument-by-val-in-inlined-varargs-call-out-of-bounds.js.ftl-eager
&gt; stress/load-varargs-then-inlined-call-and-exit.js.ftl-eager-no-cjit
&gt; stress/load-varargs-elimination-bounds-check-barely.js.ftl-no-cjit-b3o0
&gt; stress/load-varargs-then-inlined-call.js.ftl-no-cjit-validate-sampling-
&gt; profiler
&gt; microbenchmarks/string-concat-long-convert.js.ftl-no-cjit-validate-sampling-
&gt; profiler
&gt; stress/get-argument-by-val-in-inlined-varargs-call-out-of-bounds.js.ftl-no-
&gt; cjit-b3o0
&gt; apiTests

I&apos;m not sure yet why this crash is caused. But here is my rough guess.
This is caused by inconsistency between argument-count-information in DFG argument elimination phase and availability phase.
In DFG argument elimination phase, we drive more analysis to determine static argument count of LoadVarargs by leveraging inlineCallFrame information. On the other hand, availability analysis simply says it is mandatory-minimum. I&apos;m guessing that DFG argument elimination emits nodes which heavily rely on that LoadVarargs emits N elements, which are larger than mandatory-minimum.
Without using this information in OSR availability analysis, we fail to retrieve OSR information for that nodes. For example,

LoadVarargs(mandatoryMinimum = 0, limit = 3, =&gt; @1, @2, @3)
... inlining ...
    SomeNode(...) whose OSR exit retrieves @3. And when emitting this node, we heavily assumed on that @3 exists in the stack. Based on more detailed analysis in argument elimination phase.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1553133</commentid>
    <comment_count>6</comment_count>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2019-07-15 23:46:19 -0700</bug_when>
    <thetext>And, I now understand that AI should say makeHeap for known args (that count also needs to be the count in DFG argument elimination phase), and for the other nodes, I think we can say, &quot;(...).merge(SpecHeapTop)&quot; instead of &quot;makeFullTop()&quot;.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1553141</commentid>
    <comment_count>7</comment_count>
      <attachid>374184</attachid>
    <who name="Saam Barati">saam</who>
    <bug_when>2019-07-16 01:01:30 -0700</bug_when>
    <thetext>Comment on attachment 374184
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=374184&amp;action=review

&gt; Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:475
&gt; +            m_state.operand(data-&gt;start.offset() + i).makeFullTop();

this feels weird given they can literally be any bits. Like, if we actually wrote here at runtime, HeapTop is the correct value. But if we didn’t, it’s garbage. Why not just clear the AI value. What does AI do for modeling the nodes that could actually read from these stack slots? I think that might be the GetArgumentByIndex (or similar) that has some logic for OOB argument accesses.

Wasn’t the bug here when we do tail call loop optimization to an inlined varargs frame?

&gt; Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp:996
&gt; +                                // FIXME: should we use mandatoryMinimum here instead of limit?

This seems fine but also not needed.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1553148</commentid>
    <comment_count>8</comment_count>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2019-07-16 01:16:26 -0700</bug_when>
    <thetext>Another guess: The original LoadVarargs for inlinee in reflect is a bit tricky. It is initially created as LoadVarargs w/ mandatoryMinimum=1, because `inlinee` function&apos;s parameter is 1. However, we never pass the arguments object which has length &gt;=1: arguments is always empty. So, if LoadVarargs exists, it always causes OSR exit. I think this is a bit missing case of arity-fixup + LoadVarargs. And I think we should fix it anyway: prohibiting inlining, or come up with a good idea handling this.
But in this script, we do not perform OSR exit for this. This is because we exploit that we can remove LoadVarargs in argument elimination phase. This sounds interesting, and I&apos;m not surprised if we have a bug with arity-fixup + argument elimination + mandatoryMinimum.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1553438</commentid>
    <comment_count>9</comment_count>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2019-07-16 21:03:31 -0700</bug_when>
    <thetext>Today, we (Mark and I) found the issue in argument-elimination phase, and I now believe fixing argument-elimination phase is the right fix.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1553467</commentid>
    <comment_count>10</comment_count>
      <attachid>374282</attachid>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2019-07-17 02:42:55 -0700</bug_when>
    <thetext>Created attachment 374282
proposed patch.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1553657</commentid>
    <comment_count>11</comment_count>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2019-07-17 13:31:43 -0700</bug_when>
    <thetext>Thanks for the review.  Landed in r247532: &lt;http://trac.webkit.org/r247532&gt;.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1554282</commentid>
    <comment_count>12</comment_count>
      <attachid>374282</attachid>
    <who name="Saam Barati">saam</who>
    <bug_when>2019-07-19 12:13:44 -0700</bug_when>
    <thetext>Comment on attachment 374282
proposed patch.

LGTM too</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>374184</attachid>
            <date>2019-07-15 19:57:20 -0700</date>
            <delta_ts>2019-07-17 01:09:43 -0700</delta_ts>
            <desc>proposed patch.</desc>
            <filename>bug-199821.patch</filename>
            <type>text/plain</type>
            <size>6749</size>
            <attacher name="Mark Lam">mark.lam</attacher>
            
              <data encoding="base64">SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n
CShyZXZpc2lvbiAyNDc0NjYpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA
QCAtMSwzICsxLDEzIEBACisyMDE5LTA3LTE1ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNv
bT4KKworICAgICAgICBPU1JBdmFpbGFiaWxpdHlBbmFseXNpc1BoYXNlIHNob3VsZCBub3QgYXNz
dW1lIFNldEFyZ3VtZW50TWF5YmUgaW5pdGlhbGl6ZXMgaXRzIHN0YWNrIHNsb3QuCisgICAgICAg
IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xOTk4MjEKKyAgICAgICAg
PHJkYXI6Ly9wcm9ibGVtLzUyNDUyMzI4PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo
T09QUyEpLgorCisgICAgICAgICogc3RyZXNzL29zci1hdmFpbGFiaWxpdHktc2hvdWxkLW5vdC1h
c3N1bWUtU2V0QXJndW1lbnRNYXliZS1pbnRpaWFsaXplcy10aGUtc3RhY2suanM6IEFkZGVkLgor
CiAyMDE5LTA3LTE1ICBZdXN1a2UgU3V6dWtpICA8eXN1enVraUBhcHBsZS5jb20+CiAKICAgICAg
ICAgW0pTQ10gSW1wcm92ZSB3YXNtIHdwdCB0ZXN0IHJlc3VsdHMgYnkgZml4aW5nIG1pc2NlbGxh
bmVvdXMgaXNzdWVzCkluZGV4OiBKU1Rlc3RzL3N0cmVzcy9vc3ItYXZhaWxhYmlsaXR5LXNob3Vs
ZC1ub3QtYXNzdW1lLVNldEFyZ3VtZW50TWF5YmUtaW50aWlhbGl6ZXMtdGhlLXN0YWNrLmpzCj09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT0KLS0tIEpTVGVzdHMvc3RyZXNzL29zci1hdmFpbGFiaWxpdHktc2hvdWxkLW5vdC1h
c3N1bWUtU2V0QXJndW1lbnRNYXliZS1pbnRpaWFsaXplcy10aGUtc3RhY2suanMJKG5vbmV4aXN0
ZW50KQorKysgSlNUZXN0cy9zdHJlc3Mvb3NyLWF2YWlsYWJpbGl0eS1zaG91bGQtbm90LWFzc3Vt
ZS1TZXRBcmd1bWVudE1heWJlLWludGlpYWxpemVzLXRoZS1zdGFjay5qcwkod29ya2luZyBjb3B5
KQpAQCAtMCwwICsxLDI1IEBACisvL0AgcnVuRGVmYXVsdCgiLS10aHJlc2hvbGRGb3JKSVRBZnRl
cldhcm1VcD0xMCIsICItLXRocmVzaG9sZEZvckZUTE9wdGltaXplQWZ0ZXJXYXJtVXA9MTAwMCIs
ICItLXVzZUNvbmN1cnJlbnRKSVQ9ZmFsc2UiKQorCisndXNlIHN0cmljdCc7CisKK2Z1bmN0aW9u
IGlubGluZWUodmFsdWUpIHsKKyAgICBmb3IgKGxldCBpID0gMDsgaSA8IGFyZ3VtZW50cy5sZW5n
dGg7IGkrKykgeworICAgIH0KKyAgICBsZXQgdG1wID0gdmFsdWUgKyAxOworfQorCitmdW5jdGlv
biByZWZsZWN0KCkgeworICAgIHJldHVybiBpbmxpbmVlLmFwcGx5KHVuZGVmaW5lZCwgYXJndW1l
bnRzKTsKK30KKworZnVuY3Rpb24gdGVzdChhcnIpIHsKKyAgICBsZXQgb2JqZWN0ID0gaW5saW5l
ZS5hcHBseSh1bmRlZmluZWQsIGFycik7CisgICAgcmVmbGVjdCgpOworfQorCitmb3IgKGxldCBp
ID0gMDsgaSA8IDEwMDAwOyBpKyspIHsKKyAgICBsZXQgYXJyID0gW107CisgICAgZm9yIChsZXQg
aiA9IDA7IGogPCAxICsgaSAlIDEwMDsgaisrKQorICAgICAgICBhcnIucHVzaCgxKTsKKyAgICB0
ZXN0KGFycik7Cit9CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCj09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDI0NzQ2
NSkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cJKHdvcmtpbmcgY29weSkKQEAg
LTEsMyArMSwyNyBAQAorMjAxOS0wNy0xNSAgTWFyayBMYW0gIDxtYXJrLmxhbUBhcHBsZS5jb20+
CisKKyAgICAgICAgT1NSQXZhaWxhYmlsaXR5QW5hbHlzaXNQaGFzZSBzaG91bGQgbm90IGFzc3Vt
ZSBTZXRBcmd1bWVudE1heWJlIGluaXRpYWxpemVzIGl0cyBzdGFjayBzbG90LgorICAgICAgICBo
dHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTk5ODIxCisgICAgICAgIDxy
ZGFyOi8vcHJvYmxlbS81MjQ1MjMyOD4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P
UFMhKS4KKworICAgICAgICAqIGRmZy9ERkdBYnN0cmFjdEludGVycHJldGVySW5saW5lcy5oOgor
ICAgICAgICAoSlNDOjpERkc6OkFic3RyYWN0SW50ZXJwcmV0ZXI8QWJzdHJhY3RTdGF0ZVR5cGU+
OjpleGVjdXRlRWZmZWN0cyk6CisgICAgICAgIC0gVGhlIHJhbmdlIGJldHdlZW4gdGhlIExvYWRW
YXJhcmdzIG1hbmRhdG9yeU1pbmltdW0gYW5kIGxpbWl0IGFyZSBub3QgZ3VhcmFudGVlZAorICAg
ICAgICAgIHRvIGhhdmUgYSB2YWxpZCBTcGVjSGVhcFRvcCB2YWx1ZS4gIEZpeCBBSSB0byBtb2Rl
bCBpdCBhcyBTcGVjRnVsbFRvcCBpbnN0ZWFkLgorCisgICAgICAgICogZGZnL0RGR0FyZ3VtZW50
c0VsaW1pbmF0aW9uUGhhc2UuY3BwOgorICAgICAgICAtIFdoaWxlIGl0IGlzIGNvbnNlcnZhdGl2
ZSB0byBpbml0aWFsaXplIHRoZSBzdGFjayBzbG90cyBiZXR3ZWVuIHRoZSBtYW5kYXRvcnlNaW5p
bXVtCisgICAgICAgICAgYW5kIGxpbWl0LCB0aGlzIG1heSBub3QgbmUgbmVjZXNzYXJ5LiAgQWRk
ZWQgRklYTUVzIHRvIGNvbnNpZGVyIHJlcGxhY2luZworICAgICAgICAgIGxpbWl0IHdpdGggbWFu
ZGF0b3J5TWluaW11bSBoZXJlIGV2ZW50dWFsbHkuCisKKyAgICAgICAgKiBkZmcvREZHT1NSQXZh
aWxhYmlsaXR5QW5hbHlzaXNQaGFzZS5jcHA6CisgICAgICAgIChKU0M6OkRGRzo6TG9jYWxPU1JB
dmFpbGFiaWxpdHlDYWxjdWxhdG9yOjpleGVjdXRlTm9kZSk6CisgICAgICAgIC0gT1NSQXZhaWxh
YmlsaXR5QW5hbHlzaXNQaGFzZSBzaG91bGQgbm90IGFzc2lnbiBsb2MgbnVtYmVycyB0byB2YWx1
ZXMKKyAgICAgICAgICB0aGF0IGNvbWUgZnJvbSBTZXRBcmd1bWVudE1heWJlLiAgQXNzaWduaW5n
IHRoZSBsb2MgbnVtYmVycyB3b3VsZCBtaXNsZWFkIE9TUgorICAgICAgICAgIGV4aXRzIHRvIHJl
Y292ZXIgdGhvc2UgdmFsdWVzIGZyb20gcG90ZW50aWFsbHkgdW5pbml0aWFsaXplZCBzdGFjayBz
bG90cy4KKwogMjAxOS0wNy0xNSAgU2FhZ2FyIEpoYSAgPHNhYWdhcmpoYUBhcHBsZS5jb20+CiAK
ICAgICAgICAgS2V5d29yZCBsb29rdXAgY2FuIHVzZSBtZW1jbXAgdG8gZ2V0IGFyb3VuZCB1bmFs
aWduZWQgbG9hZCB1bmRlZmluZWQgYmVoYXZpb3IKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29y
ZS9kZmcvREZHQWJzdHJhY3RJbnRlcnByZXRlcklubGluZXMuaAo9PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3Vy
Y2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0Fic3RyYWN0SW50ZXJwcmV0ZXJJbmxpbmVzLmgJKHJl
dmlzaW9uIDI0NzQ2NSkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHQWJzdHJhY3RJ
bnRlcnByZXRlcklubGluZXMuaAkod29ya2luZyBjb3B5KQpAQCAtNDY5LDggKzQ2OSwxMCBAQCBi
b29sIEFic3RyYWN0SW50ZXJwcmV0ZXI8QWJzdHJhY3RTdGF0ZVR5CiAgICAgICAgIH0KICAgICAg
ICAgTG9hZFZhcmFyZ3NEYXRhKiBkYXRhID0gbm9kZS0+bG9hZFZhcmFyZ3NEYXRhKCk7CiAgICAg
ICAgIG1fc3RhdGUub3BlcmFuZChkYXRhLT5jb3VudCkuc2V0Tm9uQ2VsbFR5cGUoU3BlY0ludDMy
T25seSk7Ci0gICAgICAgIGZvciAodW5zaWduZWQgaSA9IGRhdGEtPmxpbWl0IC0gMTsgaS0tOykK
KyAgICAgICAgZm9yICh1bnNpZ25lZCBpID0gMDsgaSA8IGRhdGEtPm1hbmRhdG9yeU1pbmltdW07
ICsraSkKICAgICAgICAgICAgIG1fc3RhdGUub3BlcmFuZChkYXRhLT5zdGFydC5vZmZzZXQoKSAr
IGkpLm1ha2VIZWFwVG9wKCk7CisgICAgICAgIGZvciAodW5zaWduZWQgaSA9IGRhdGEtPm1hbmRh
dG9yeU1pbmltdW07IGkgPCBkYXRhLT5saW1pdDsgKytpKQorICAgICAgICAgICAgbV9zdGF0ZS5v
cGVyYW5kKGRhdGEtPnN0YXJ0Lm9mZnNldCgpICsgaSkubWFrZUZ1bGxUb3AoKTsKICAgICAgICAg
YnJlYWs7CiAgICAgfQogCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0FyZ3Vt
ZW50c0VsaW1pbmF0aW9uUGhhc2UuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0
Q29yZS9kZmcvREZHQXJndW1lbnRzRWxpbWluYXRpb25QaGFzZS5jcHAJKHJldmlzaW9uIDI0NzQ2
NSkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHQXJndW1lbnRzRWxpbWluYXRpb25Q
aGFzZS5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTk5Myw2ICs5OTMsNyBAQCBwcml2YXRlOgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1bnNpZ25lZCBzdG9yZUluZGV4ID0gZm9yd2Fy
ZE5vZGUoY2FuZGlkYXRlLCAwKTsKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUkVM
RUFTRV9BU1NFUlQoc3RvcmVJbmRleCA8PSBsaW1pdCk7CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIE5vZGUqIHVuZGVmaW5lZCA9IG51bGxwdHI7CisgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIC8vIEZJWE1FOiBzaG91bGQgd2UgdXNlIG1hbmRhdG9yeU1pbmltdW0gaGVy
ZSBpbnN0ZWFkIG9mIGxpbWl0PwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmb3Ig
KDsgc3RvcmVJbmRleCA8IGxpbWl0OyArK3N0b3JlSW5kZXgpIHsKICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIGlmICghdW5kZWZpbmVkKSB7CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgdW5kZWZpbmVkID0gaW5zZXJ0aW9uU2V0Lmluc2VydENvbnN0
YW50KApAQCAtMTAzMiw2ICsxMDMzLDggQEAgcHJpdmF0ZToKICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgLy8gRGVmaW5lIG91ciBsaW1pdCB0byBleGNsdWRlICJ0aGlzIiwgc2luY2Ug
dGhhdCdzIGEgYml0IGVhc2llciB0byByZWFzb24gYWJvdXQuCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIHVuc2lnbmVkIGxpbWl0ID0gdmFyYXJnc0RhdGEtPmxpbWl0IC0gMTsKICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTm9kZSogdW5kZWZpbmVkID0gbnVsbHB0cjsK
KworICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvLyBGSVhNRTogc2hvdWxkIHdlIHVz
ZSBtYW5kYXRvcnlNaW5pbXVtIGhlcmUgaW5zdGVhZCBvZiBsaW1pdD8KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgZm9yICh1bnNpZ25lZCBzdG9yZUluZGV4ID0gMDsgc3RvcmVJbmRl
eCA8IGxpbWl0OyArK3N0b3JlSW5kZXgpIHsKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIC8vIEZpcnN0IGRldGVybWluZSBpZiB3ZSBoYXZlIGFuIGVsZW1lbnQgd2UgY2FuIGxv
YWQsIGFuZCBsb2FkIGl0IGlmCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAv
LyBwb3NzaWJsZS4KSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHT1NSQXZhaWxh
YmlsaXR5QW5hbHlzaXNQaGFzZS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRD
b3JlL2RmZy9ERkdPU1JBdmFpbGFiaWxpdHlBbmFseXNpc1BoYXNlLmNwcAkocmV2aXNpb24gMjQ3
NDY1KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdPU1JBdmFpbGFiaWxpdHlBbmFs
eXNpc1BoYXNlLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMSw1ICsxLDUgQEAKIC8qCi0gKiBDb3B5
cmlnaHQgKEMpIDIwMTMtMjAxNSBBcHBsZSBJbmMuIEFsbCByaWdodHMgcmVzZXJ2ZWQuCisgKiBD
b3B5cmlnaHQgKEMpIDIwMTMtMjAxOSBBcHBsZSBJbmMuIEFsbCByaWdodHMgcmVzZXJ2ZWQuCiAg
KgogICogUmVkaXN0cmlidXRpb24gYW5kIHVzZSBpbiBzb3VyY2UgYW5kIGJpbmFyeSBmb3Jtcywg
d2l0aCBvciB3aXRob3V0CiAgKiBtb2RpZmljYXRpb24sIGFyZSBwZXJtaXR0ZWQgcHJvdmlkZWQg
dGhhdCB0aGUgZm9sbG93aW5nIGNvbmRpdGlvbnMKQEAgLTI0OCw3ICsyNDgsNyBAQCB2b2lkIExv
Y2FsT1NSQXZhaWxhYmlsaXR5Q2FsY3VsYXRvcjo6ZXhlCiAgICAgICAgIExvYWRWYXJhcmdzRGF0
YSogZGF0YSA9IG5vZGUtPmxvYWRWYXJhcmdzRGF0YSgpOwogICAgICAgICBtX2F2YWlsYWJpbGl0
eS5tX2xvY2Fscy5vcGVyYW5kKGRhdGEtPmNvdW50KSA9CiAgICAgICAgICAgICBBdmFpbGFiaWxp
dHkoRmx1c2hlZEF0KEZsdXNoZWRJbnQzMiwgZGF0YS0+bWFjaGluZUNvdW50KSk7Ci0gICAgICAg
IGZvciAodW5zaWduZWQgaSA9IGRhdGEtPmxpbWl0OyBpLS07KSB7CisgICAgICAgIGZvciAodW5z
aWduZWQgaSA9IGRhdGEtPm1hbmRhdG9yeU1pbmltdW07IGktLTspIHsKICAgICAgICAgICAgIG1f
YXZhaWxhYmlsaXR5Lm1fbG9jYWxzLm9wZXJhbmQoVmlydHVhbFJlZ2lzdGVyKGRhdGEtPnN0YXJ0
Lm9mZnNldCgpICsgaSkpID0KICAgICAgICAgICAgICAgICBBdmFpbGFiaWxpdHkoRmx1c2hlZEF0
KEZsdXNoZWRKU1ZhbHVlLCBWaXJ0dWFsUmVnaXN0ZXIoZGF0YS0+bWFjaGluZVN0YXJ0Lm9mZnNl
dCgpICsgaSkpKTsKICAgICAgICAgfQo=
</data>
<flag name="commit-queue"
          id="389988"
          type_id="3"
          status="-"
          setter="ews-watchlist"
    />
          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>374282</attachid>
            <date>2019-07-17 02:42:55 -0700</date>
            <delta_ts>2019-07-17 11:31:18 -0700</delta_ts>
            <desc>proposed patch.</desc>
            <filename>bug-199821.patch</filename>
            <type>text/plain</type>
            <size>6932</size>
            <attacher name="Mark Lam">mark.lam</attacher>
            
              <data encoding="base64">SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n
CShyZXZpc2lvbiAyNDc1MDUpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA
QCAtMSwzICsxLDEzIEBACisyMDE5LTA3LTE2ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNv
bT4KKworICAgICAgICBBcmd1bWVudHNFbGltaW5hdGlvblBoYXNlIHNob3VsZCBpbnNlcnQgS2ls
bFN0YWNrIG5vZGVzIGJlZm9yZSBQdXRTdGFjayBub2RlcyB0aGF0IGl0IGFkZHMuCisgICAgICAg
IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xOTk4MjEKKyAgICAgICAg
PHJkYXI6Ly9wcm9ibGVtLzUyNDUyMzI4PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo
T09QUyEpLgorCisgICAgICAgICogc3RyZXNzL2FyZ3VtZW50cy1lbGltaW5hdGlvbi1zaG91bGQt
aW5zZXJ0LUtpbGxTdGFja3MtYmVmb3JlLWFkZGVkLVB1dFN0YWNrcy5qczogQWRkZWQuCisKIDIw
MTktMDctMTYgIEtlaXRoIE1pbGxlciAgPGtlaXRoX21pbGxlckBhcHBsZS5jb20+CiAKICAgICAg
ICAgVW5yZXZpZXdlZCwgdGVzdDI2MiBnYXJkZW5pbmcuCkluZGV4OiBKU1Rlc3RzL3N0cmVzcy9h
cmd1bWVudHMtZWxpbWluYXRpb24tc2hvdWxkLWluc2VydC1LaWxsU3RhY2tzLWJlZm9yZS1hZGRl
ZC1QdXRTdGFja3MuanMKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gSlNUZXN0cy9zdHJlc3MvYXJndW1lbnRzLWVs
aW1pbmF0aW9uLXNob3VsZC1pbnNlcnQtS2lsbFN0YWNrcy1iZWZvcmUtYWRkZWQtUHV0U3RhY2tz
LmpzCShub25leGlzdGVudCkKKysrIEpTVGVzdHMvc3RyZXNzL2FyZ3VtZW50cy1lbGltaW5hdGlv
bi1zaG91bGQtaW5zZXJ0LUtpbGxTdGFja3MtYmVmb3JlLWFkZGVkLVB1dFN0YWNrcy5qcwkod29y
a2luZyBjb3B5KQpAQCAtMCwwICsxLDI1IEBACisvL0AgcnVuRGVmYXVsdCgiLS10aHJlc2hvbGRG
b3JKSVRBZnRlcldhcm1VcD0xMCIsICItLXRocmVzaG9sZEZvckZUTE9wdGltaXplQWZ0ZXJXYXJt
VXA9MTAwMCIsICItLXVzZUNvbmN1cnJlbnRKSVQ9ZmFsc2UiKQorCisndXNlIHN0cmljdCc7CisK
K2Z1bmN0aW9uIGlubGluZWUodmFsdWUpIHsKKyAgICBmb3IgKGxldCBpID0gMDsgaSA8IGFyZ3Vt
ZW50cy5sZW5ndGg7IGkrKykgeworICAgIH0KKyAgICBsZXQgdG1wID0gdmFsdWUgKyAxOworfQor
CitmdW5jdGlvbiByZWZsZWN0KCkgeworICAgIHJldHVybiBpbmxpbmVlLmFwcGx5KHVuZGVmaW5l
ZCwgYXJndW1lbnRzKTsKK30KKworZnVuY3Rpb24gdGVzdChhcnIpIHsKKyAgICBsZXQgb2JqZWN0
ID0gaW5saW5lZS5hcHBseSh1bmRlZmluZWQsIGFycik7CisgICAgcmVmbGVjdCgpOworfQorCitm
b3IgKGxldCBpID0gMDsgaSA8IDEwMDAwOyBpKyspIHsKKyAgICBsZXQgYXJyID0gW107CisgICAg
Zm9yIChsZXQgaiA9IDA7IGogPCAxICsgaSAlIDEwMDsgaisrKQorICAgICAgICBhcnIucHVzaCgx
KTsKKyAgICB0ZXN0KGFycik7Cit9CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdl
TG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cJKHJldmlz
aW9uIDI0NzUwNSkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cJKHdvcmtpbmcg
Y29weSkKQEAgLTEsMyArMSw2NSBAQAorMjAxOS0wNy0xNiAgTWFyayBMYW0gIDxtYXJrLmxhbUBh
cHBsZS5jb20+CisKKyAgICAgICAgQXJndW1lbnRzRWxpbWluYXRpb25QaGFzZSBzaG91bGQgaW5z
ZXJ0IEtpbGxTdGFjayBub2RlcyBiZWZvcmUgUHV0U3RhY2sgbm9kZXMgdGhhdCBpdCBhZGRzLgor
ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTk5ODIxCisg
ICAgICAgIDxyZGFyOi8vcHJvYmxlbS81MjQ1MjMyOD4KKworICAgICAgICBSZXZpZXdlZCBieSBO
T0JPRFkgKE9PUFMhKS4KKworICAgICAgICBFeGNsdWRpbmcgdGhlIEFyZ3VtZW50c0VsaW1pbmF0
aW9uUGhhc2UsIFB1dFN0YWNrIG5vZGVzIGFyZSBjb252ZXJ0ZWQgZnJvbSBTZXRMb2NhbAorICAg
ICAgICBub2RlcyBpbiB0aGUgU1NBQ29udmVyc2lvblBoYXNlLiAgU2V0TG9jYWwgbm9kZXMgYXJl
IGFsd2F5cyBwcmVjZWRlZCBieSBNb3ZIaW50IG5vZGVzLAorICAgICAgICBhbmQgdGhlIFNTQUNv
bnZlcnNpb25QaGFzZSBhbHdheXMgaW5zZXJ0cyBhIEtpbGxTdGFjayBub2RlIGJlZm9yZSBhIE1v
dkhpbnQgbm9kZS4KKyAgICAgICAgSGVuY2UsIGEgUHV0U3RhY2sgbm9kZSBpcyBhbHdheXMgcHJl
Y2VkZWQgYnkgYSBLaWxsU3RhY2sgbm9kZS4KKworICAgICAgICBIb3dldmVyLCB0aGUgQXJndW1l
bnRzRWxpbWluYXRpb25QaGFzZSBjYW4gY29udmVydCBMb2FkVmFyYXJncyBub2RlcyBpbnRvIGEg
c2VyaWVzCisgICAgICAgIG9mIG9uZSBvciBtb3JlIFB1dFN0YWNrcyBub2RlcywgYW5kIGl0IHBy
ZXBlbmRzIE1vdkhpbnQgbm9kZXMgYmVmb3JlIHRoZSBQdXRTdGFjaworICAgICAgICBub2Rlcy4g
IEhvd2V2ZXIsIGl0IG5lZ2xlY3RzIHRvIHByZXBlbmQgS2lsbFN0YWNrIG5vZGVzIGFzIHdlbGwu
ICBTaW5jZSB0aGUKKyAgICAgICAgQXJndW1lbnRzRWxpbWluYXRpb25QaGFzZSBydW5zIGFmdGVy
IHRoZSBTU0FDb252ZXJzaW9uUGhhc2UsIHRoZSBQdXRTdGFjayBub2RlcworICAgICAgICBhZGRl
ZCBkdXJpbmcgQXJndW1lbnRzRWxpbWluYXRpb24gd2lsbCBub3QgYmUgcHJlY2VkZWQgYnkgS2ls
bFN0YWNrIG5vZGVzLgorCisgICAgICAgIFRoaXMgcGF0Y2ggZml4ZXMgdGhpcyBieSBpbnNlcnRp
bmcgYSBLaWxsU3RhY2sgaW4gdGhlIEFyZ3VtZW50c0VsaW1pbmF0aW9uUGhhc2UKKyAgICAgICAg
YmVmb3JlIGl0IGluc2VydHMgYSBNb3ZIaW50IGFuZCBhIFB1dFN0YWNrIG5vZGUuCisKKyAgICAg
ICAgQ29uc2lkZXIgdGhpcyB0ZXN0IGNhc2Ugd2hpY2ggY2FuIG1hbmlmZXN0IHRoZSBhYm92ZSBp
c3N1ZSBhcyBhIGNyYXNoOgorCisgICAgICAgICAgICBmdW5jdGlvbiBpbmxpbmVlKHZhbHVlKSB7
CisgICAgICAgICAgICAgICAgLi4uCisgICAgICAgICAgICAgICAgbGV0IHRtcCA9IHZhbHVlICsg
MTsKKyAgICAgICAgICAgIH0KKworICAgICAgICAgICAgZnVuY3Rpb24gcmVmbGVjdCgpIHsKKyAg
ICAgICAgICAgICAgICByZXR1cm4gaW5saW5lZS5hcHBseSh1bmRlZmluZWQsIGFyZ3VtZW50cyk7
CisgICAgICAgICAgICB9CisKKyAgICAgICAgICAgIGZ1bmN0aW9uIHRlc3QoYXJyKSB7CisgICAg
ICAgICAgICAgICAgbGV0IG9iamVjdCA9IGlubGluZWUuYXBwbHkodW5kZWZpbmVkLCBhcnIpOyAg
IC8vIFVzZXMgYSBsb3Qgb2YgU2V0QXJndW1lbnRNYXliZSBub2Rlcy4KKyAgICAgICAgICAgICAg
ICByZWZsZWN0KCk7ICAgIC8vIENhbGxzIHdpdGggYSBMb2FkVmFyYXJnLCB3aGljaCBnZXRzIGNv
bnZlcnRlZCBpbnRvIGEgUHV0U3RhY2sgb2YgYSBjb25zdGFudC4KKyAgICAgICAgICAgIH0KKwor
ICAgICAgICBJbiB0aGlzIHRlc3QgY2FzZSwgd2UgaGF2ZSBhIHNjZW5hcmlvIHdoZXJlIGEgU2V0
QXJndW1lbnRNYXliZSdzIHN0YWNrCisgICAgICAgIHNsb3QgaXMgcmV1c2VkIGFzIHRoZSBzdGFj
ayBzbG90IGZvciBhIFB1dFN0YWNrIGxhdGVyLiAgSGVyZSwgdGhlIFB1dFN0YWNrIHdpbGwKKyAg
ICAgICAgcHV0IGEgY29uc3RhbnQgdW5kZWZpbmVkIHZhbHVlLiAgQ29pbmNpZGVudGFsbHksIHRo
ZSBTZXRBcmd1bWVudE1heWJlIG1heSBhbHNvCisgICAgICAgIGluaXRpYWxpemUgdGhhdCBzdGFj
ayBzbG90IHRvIGEgY29uc3RhbnQgdW5kZWZpbmVkIHZhbHVlLiAgTm90ZSB0aGF0IGJ5IHRoZSB0
aW1lCisgICAgICAgIHRoZSBQdXRTdGFjayBleGVjdXRlcywgdGhlIFNldEFyZ3VtZW50TWF5YmUn
cyBzdGFjayBzbG90IGlzIGRlYWQuICBUaGUgbGl2ZW5lc3Mgb2YKKyAgICAgICAgdGhlc2UgMiB2
YWx1ZXMgYXJlIGRpc3RpbmN0LgorCisgICAgICAgIEhvd2V2ZXIsIGJlY2F1c2Ugd2Ugd2VyZSBt
aXNzaW5nIGEgS2lsbFN0YWNrIGJlZm9yZSB0aGUgUHV0U3RhY2ssIE9TUiBhdmFpbGFiaWxpdHkK
KyAgICAgICAgYW5hbHlzaXMgZ2V0cyBtaXNsZWQgaW50byB0aGlua2luZyB0aGF0IHRoZSBQdXRT
dGFjayBjb25zdGFudCB2YWx1ZSBpcyBzdGlsbCBpbiB0aGUKKyAgICAgICAgc3RhY2sgc2xvdCBi
ZWNhdXNlIHRoZSB2YWx1ZSBsZWZ0IHRoZXJlIGJ5IHRoZSBTZXRBcmd1bWVudE1heWJlIGhhc24n
dCBiZWVuIGtpbGxlZAorICAgICAgICBvZmYgeWV0LiAgQXMgYSByZXN1bHQsIE9TUiBleGl0IGNv
ZGUgd2lsbCBhdHRlbXB0IHRvIHJlY292ZXIgdGhlIFB1dFN0YWNrJ3MgdW5kZWZpbmVkCisgICAg
ICAgIGNvbnN0YW50IGJ5IGxvYWRpbmcgZnJvbSB0aGUgc3RhY2sgc2xvdCBpbnN0ZWFkIG9mIG1h
dGVyaWFsaXppbmcgaXQuICBTaW5jZQorICAgICAgICBTZXRBcmd1bWVudE1heWJlIG1heSBub3Qg
YWN0dWFsbHkgaW5pdGlhbGl6ZSB0aGUgc3RhY2sgc2xvdCwgd2UgZ2V0IGEgY3Jhc2ggaW4gT1NS
CisgICAgICAgIGV4aXQgd2hlbiB3ZSB0cnkgdG8gcmVjb3ZlciB0aGUgUHV0U3RhY2sgY29uc3Rh
bnQgdmFsdWUgZnJvbSB0aGUgc3RhY2sgc2xvdCwgYW5kCisgICAgICAgIGVuZCB1cCB1c2luZyB3
aGF0IGV2ZXIganVuayB2YWx1ZSB3ZSByZWFkIGZyb20gdGhlcmUuCisKKyAgICAgICAgRml4aW5n
IHRoZSBBcmd1bWVudHNFbGltaW5hdGlvblBoYXNlIHRvIGluc2VydCBLaWxsU3RhY2sgYmVmb3Jl
IHRoZSBQdXRTdGFjaworICAgICAgICByZW1vdmVzIHRoaXMgY29uZmxhdGlvbiBvZiB0aGUgUHV0
U3RhY2sncyBjb25zdGFudCB2YWx1ZSB3aXRoIHRoZSBTZXRBcmd1bWVudE1heWJlJ3MKKyAgICAg
ICAgY29uc3RhbnQgdmFsdWUgaW4gdGhlIHNhbWUgc3RhY2sgc2xvdC4gIEFuZCwgT1NSIGF2YWls
YWJpbGl0eSBhbmFseXNpcyB3aWxsIG5vCisgICAgICAgIGxvbmdlciBiZSBtaXNsZWQgdG8gbG9h
ZCB0aGUgUHV0U3RhY2sncyBjb25zdGFudCB2YWx1ZSBmcm9tIHRoZSBzdGFjaywgYnV0IHdpbGwK
KyAgICAgICAgbWF0ZXJpYWxpemUgdGhlIGNvbnN0YW50IGluc3RlYWQuCisKKyAgICAgICAgKiBk
ZmcvREZHQXJndW1lbnRzRWxpbWluYXRpb25QaGFzZS5jcHA6CisKIDIwMTktMDctMTYgIENocmlz
dG9waGVyIFJlaWQgIDxjaHJpcy5yZWlkQHNvbnkuY29tPgogCiAgICAgICAgIEJ5dGVjb2RlIGNh
Y2hlIHNob3VsZCB1c2UgRmlsZVN5c3RlbQpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2Rm
Zy9ERkdBcmd1bWVudHNFbGltaW5hdGlvblBoYXNlLmNwcAo9PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2Uv
SmF2YVNjcmlwdENvcmUvZGZnL0RGR0FyZ3VtZW50c0VsaW1pbmF0aW9uUGhhc2UuY3BwCShyZXZp
c2lvbiAyNDc1MDUpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0FyZ3VtZW50c0Vs
aW1pbmF0aW9uUGhhc2UuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC04NjEsNiArODYxLDkgQEAgcHJp
dmF0ZToKICAgICAgICAgICAgICAgICAgICAgICAgICAgICBub2RlSW5kZXgsIG5vZGUtPm9yaWdp
bi53aXRoRXhpdE9LKGNhbkV4aXQpLAogICAgICAgICAgICAgICAgICAgICAgICAgICAgIGpzTnVt
YmVyKGFyZ3VtZW50Q291bnRJbmNsdWRpbmdUaGlzKSk7CiAgICAgICAgICAgICAgICAgICAgICAg
ICBpbnNlcnRpb25TZXQuaW5zZXJ0Tm9kZSgKKyAgICAgICAgICAgICAgICAgICAgICAgICAgICBu
b2RlSW5kZXgsIFNwZWNOb25lLCBLaWxsU3RhY2ssIG5vZGUtPm9yaWdpbi50YWtlVmFsaWRFeGl0
KGNhbkV4aXQpLAorICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9wSW5mbyh2YXJhcmdzRGF0
YS0+Y291bnQub2Zmc2V0KCkpKTsKKyAgICAgICAgICAgICAgICAgICAgICAgIGluc2VydGlvblNl
dC5pbnNlcnROb2RlKAogICAgICAgICAgICAgICAgICAgICAgICAgICAgIG5vZGVJbmRleCwgU3Bl
Y05vbmUsIE1vdkhpbnQsIG5vZGUtPm9yaWdpbi50YWtlVmFsaWRFeGl0KGNhbkV4aXQpLAogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIE9wSW5mbyh2YXJhcmdzRGF0YS0+Y291bnQub2Zmc2V0
KCkpLCBFZGdlKGFyZ3VtZW50Q291bnRJbmNsdWRpbmdUaGlzTm9kZSkpOwogICAgICAgICAgICAg
ICAgICAgICAgICAgaW5zZXJ0aW9uU2V0Lmluc2VydE5vZGUoCkBAIC04NzUsNiArODc4LDggQEAg
cHJpdmF0ZToKICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtX2dyYXBoLm1fc3RhY2tBY2Nl
c3NEYXRhLmFkZChyZWcsIEZsdXNoZWRKU1ZhbHVlKTsKICAgICAgICAgICAgICAgICAgICAgICAg
IAogICAgICAgICAgICAgICAgICAgICAgICAgaW5zZXJ0aW9uU2V0Lmluc2VydE5vZGUoCisgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgbm9kZUluZGV4LCBTcGVjTm9uZSwgS2lsbFN0YWNrLCBu
b2RlLT5vcmlnaW4udGFrZVZhbGlkRXhpdChjYW5FeGl0KSwgT3BJbmZvKHJlZy5vZmZzZXQoKSkp
OworICAgICAgICAgICAgICAgICAgICAgICAgaW5zZXJ0aW9uU2V0Lmluc2VydE5vZGUoCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgbm9kZUluZGV4LCBTcGVjTm9uZSwgTW92SGludCwgbm9k
ZS0+b3JpZ2luLnRha2VWYWxpZEV4aXQoY2FuRXhpdCksCiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgT3BJbmZvKHJlZy5vZmZzZXQoKSksIEVkZ2UodmFsdWUpKTsKICAgICAgICAgICAgICAg
ICAgICAgICAgIGluc2VydGlvblNldC5pbnNlcnROb2RlKAo=
</data>
<flag name="review"
          id="390070"
          type_id="1"
          status="+"
          setter="fpizlo"
    />
          </attachment>
      

    </bug>

</bugzilla>