289680 2025-03-13 00:52:32 -0700 DFG ASSERTION FAILED: AI-clobberize disagreement; AI says NotClobbered while clobberize says (Direct:[Heap], Super:[World]) 2025-03-13 13:29:09 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 katoshi1337 ysuzuki bfulgham webkit-bug-importer ysuzuki oldest_to_newest 2102811 0 katoshi1337 2025-03-13 00:52:32 -0700 commit: c5e0671158732bcdf83d26d4a964a0d88b2ca02c PoC: ``` for (let i1 = -409186827; i1 != -268435456;) { new WeakMap(); new SharedArrayBuffer(); } ``` command: ./jsc ./poc.js logs: ``` // CRASH INFO // ========== // TERMSIG: 6 // STDERR: // DFG ASSERTION FAILED: AI-clobberize disagreement; AI says NotClobbered while clobberize says (Direct:[Heap], Super:[World]) // /home/fuzzer/webkit/WebKit-c5e0671158732bcdf83d26d4a964a0d88b2ca02c/Source/JavaScriptCore/dfg/DFGCFAPhase.cpp(229) : void JSC::DFG::CFAPhase::performBlockCFA(BasicBlock *) // // While handling node D@121 // // Graph at time of failure: // // 11: DFG for <global>#C01K4u:[0x7ee9790f9470->0x7ee9790f9360->0x7ee97924c1e0, DFGGlobal, 212]: // 11: Fixpoint state: FixpointNotConverged; Form: ThreadedCPS; Unification state: GloballyUnified; Ref count state: EverythingIsLive // 11: Arguments for block#0: D@0 // // 0 11: Block #0 (bc#0): (OSR target) // 0 11: Execution count: 1.000000 // 0 11: Predecessors: // 0 11: Successors: #2 #1 // 0 11: Dominated by: #root #0 // 0 11: Dominates: #0 #1 #2 // 0 11: Dominance Frontier: // 0 11: Iterated Dominance Frontier: // 0 11: States: StructuresAreWatched // 0 11: Vars Before: arg0:(BytecodeTop, TOP, TOP, none:StructuresAreClobbered) // 0 11: Intersected Vars Before: arg0:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc0:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc1:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc2:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc3:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc4:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc5:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc6:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc7:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc8:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc9:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc10:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc11:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc12:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc13:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc14:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc15:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc16:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc17:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc18:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc19:(FullTop, TOP, TOP, none:StructuresAreClobbered) // 0 11: Var Links: arg0:D@0 // 0 0 11: D@0:< 1:-> SetArgumentDefinitely(IsFlushed, this(A~<Object>/FlushedJSValue), W:SideState, bc#0, ExitValid) predicting GlobalProxy // 1 0 11: D@1:< 1:-> JSConstant(JS|PureInt, Other, Undefined, bc#0, ExitValid) // 2 0 11: D@2:<!0:-> MovHint(Check:Untyped:D@1, MustGen, loc0, W:SideState, ClobbersExit, bc#0, ExitValid) // 3 0 11: D@3:< 1:-> SetLocal(Check:Untyped:D@1, loc0(B~<Other>/FlushedJSValue), W:Stack(loc0), bc#0, ExitInvalid) predicting Other // 4 0 11: D@4:<!0:-> MovHint(Check:Untyped:D@1, MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid) // 5 0 11: D@5:< 1:-> SetLocal(Check:Untyped:D@1, loc1(C~<Other>/FlushedJSValue), W:Stack(loc1), bc#0, ExitInvalid) predicting Other // 6 0 11: D@6:<!0:-> MovHint(Check:Untyped:D@1, MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid) // 7 0 11: D@7:< 1:-> SetLocal(Check:Untyped:D@1, loc2(D~<Other>/FlushedJSValue), W:Stack(loc2), bc#0, ExitInvalid) predicting Other // 8 0 11: D@8:<!0:-> MovHint(Check:Untyped:D@1, MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid) // 9 0 11: D@9:< 1:-> SetLocal(Check:Untyped:D@1, loc3(E~<Other>/FlushedJSValue), W:Stack(loc3), bc#0, ExitInvalid) predicting Other // 10 0 11: D@10:<!0:-> MovHint(Check:Untyped:D@1, MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid) // 11 0 11: D@11:< 1:-> SetLocal(Check:Untyped:D@1, loc4(F~<Other>/FlushedJSValue), W:Stack(loc4), bc#0, ExitInvalid) predicting Other // 12 0 11: D@12:< 1:-> GetCallee(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, Function, R:Stack(callee), bc#0, ExitInvalid) // 13 0 11: D@13:< 1:-> GetScope(KnownCell:D@12, JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, OtherObj, bc#0, ExitInvalid) // 14 0 11: D@14:<!0:-> MovHint(Check:Untyped:D@13, MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid) // 15 0 11: D@15:<!0:-> ExitOK(MustGen, W:SideState, bc#0, ExitValid) // 16 0 11: D@16:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#0, ExitValid) // 17 0 11: D@17:< 1:-> SetLocal(Check:Untyped:D@13, loc4(G~<Object>/FlushedJSValue), W:Stack(loc4), bc#0, exit: bc#1, ExitValid) predicting OtherObj // 18 0 11: D@18:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, Other, Undefined, bc#1, ExitValid) // 19 0 11: D@19:<!0:-> MovHint(Check:Untyped:D@18, MustGen, loc5, W:SideState, ClobbersExit, bc#1, ExitValid) // 20 0 11: D@20:< 1:-> SetLocal(Check:Untyped:D@18, loc5(H~<Other>/FlushedJSValue), W:Stack(loc5), bc#1, exit: bc#4, ExitValid) predicting Other // 21 0 11: D@21:< 1:-> JSConstant(JS|PureInt, OtherCell, Strong:Cell: 0x7ee979268130 (%CW:Immutable Butterfly,ArrayWithDouble), StructureID: 18880, bc#4, ExitValid) // 22 0 11: D@22:< 1:-> NewArrayBuffer(JS|PureInt, Array, <0x7ee979268130, Immutable Butterfly>, vectorLengthHint = 7, CopyOnWriteArrayWithDouble, R:HeapObjectCount, W:HeapObjectCount, Exits, bc#4, ExitValid) // 23 0 11: D@23:<!0:-> MovHint(Check:Untyped:D@22, MustGen, loc5, W:SideState, ClobbersExit, bc#4, ExitValid) // 24 0 11: D@24:< 1:-> SetLocal(Check:Untyped:D@22, loc5(I~<Array>/FlushedJSValue), W:Stack(loc5), bc#4, exit: bc#9, ExitValid) predicting Array // 25 0 11: D@25:< 1:-> JSConstant(JS|PureInt, OtherCell, Strong:Cell: 0x7ee97914c1a0 (%Dx:Immutable Butterfly,ArrayWithInt32), StructureID: 18656, bc#9, ExitValid) // 26 0 11: D@26:< 1:-> NewArrayBuffer(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, Array, <0x7ee97914c1a0, Immutable Butterfly>, vectorLengthHint = 1, CopyOnWriteArrayWithInt32, R:HeapObjectCount, W:HeapObjectCount, Exits, bc#9, ExitValid) // 27 0 11: D@27:<!0:-> MovHint(Check:Untyped:D@26, MustGen, loc5, W:SideState, ClobbersExit, bc#9, ExitValid) // 28 0 11: D@28:< 1:-> SetLocal(Check:Untyped:D@26, loc5(J~<Array>/FlushedJSValue), W:Stack(loc5), bc#9, exit: bc#14, ExitValid) predicting Array // 29 0 11: D@29:< 1:-> JSConstant(JS|PureNum|NeedsNaNOrInfinity|UseAsOther|UseAsInt|ReallyWantsInt, NonBoolInt32, Int32: 2, bc#14, ExitValid) // 30 0 11: D@30:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, NonBoolInt32, Int32: 56466, bc#14, ExitValid) // 31 0 11: D@156:<!0:-> ArrayifyToStructure(Cell:D@26, Int32:D@29, MustGen, Int32+OriginalCopyOnWriteArray+InBounds+Convert+Write, %Ar:Array,ArrayWithInt32, R:JSCell_indexingType,JSCell_structureID,JSObject_butterfly, W:JSCell_indexingType,JSCell_structureID,JSObject_butterfly,Watchpoint_fire, Exits, bc#14, ExitValid) // 32 0 11: D@157:< 1:-> GetButterfly(Cell:D@26, Storage|PureInt, R:JSObject_butterfly, bc#14, ExitValid) // 33 0 11: D@31:<!0:-> PutByValDirect(KnownCell:D@26, Int32:D@29, Int32:D@30, Check:Untyped:D@157, MustGen|VarArgs, Int32+OriginalCopyOnWriteArray+InBounds+Convert+Write, R:Butterfly_publicLength,Butterfly_vectorLength,IndexedInt32Properties, W:IndexedInt32Properties, Exits, ClobbersExit, bc#14, ExitValid) // 34 0 11: D@186:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#20, ExitValid) // 35 0 11: D@32:< 1:-> JSConstant(JS|PureNum|NeedsNaNOrInfinity|UseAsOther|UseAsInt|ReallyWantsInt, NonBoolInt32, Int32: 3, bc#20, ExitValid) // 36 0 11: D@33:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, NonBoolInt32, Int32: 998143057, bc#20, ExitValid) // 37 0 11: D@158:<!0:-> CheckStructure(Cell:D@26, MustGen, [%Ar:Array,ArrayWithInt32], R:JSCell_structureID, Exits, bc#20, ExitValid) // 38 0 11: D@159:< 1:-> GetButterfly(Cell:D@26, Storage|PureInt, R:JSObject_butterfly, bc#20, ExitValid) // 39 0 11: D@34:<!0:-> PutByValDirect(KnownCell:D@26, Int32:D@32, Int32:D@33, Check:Untyped:D@159, MustGen|VarArgs, Int32+OriginalNonCopyOnWriteArray+ToHole+AsIs+Write, R:Butterfly_publicLength,Butterfly_vectorLength,IndexedInt32Properties, W:Butterfly_publicLength,IndexedInt32Properties, Exits, ClobbersExit, bc#20, ExitValid) // 40 0 11: D@35:< 1:-> JSConstant(JS|PureNum|NeedsNaNOrInfinity|UseAsOther|UseAsInt|ReallyWantsInt, NonBoolInt32, Int32: 4, bc#26, ExitValid) // 41 0 11: D@36:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, NonBoolInt32, Int32: -14, bc#26, ExitValid) // 42 0 11: D@160:<!0:-> CheckStructure(Cell:D@26, MustGen, [%Ar:Array,ArrayWithInt32], R:JSCell_structureID, Exits, bc#26, ExitValid) // 43 0 11: D@161:< 1:-> GetButterfly(Cell:D@26, Storage|PureInt, R:JSObject_butterfly, bc#26, ExitValid) // 44 0 11: D@37:<!0:-> PutByValDirect(KnownCell:D@26, Int32:D@35, Int32:D@36, Check:Untyped:D@161, MustGen|VarArgs, Int32+OriginalNonCopyOnWriteArray+ToHole+AsIs+Write, R:Butterfly_publicLength,Butterfly_vectorLength,IndexedInt32Properties, W:Butterfly_publicLength,IndexedInt32Properties, Exits, ClobbersExit, bc#26, ExitValid) // 45 0 11: D@38:< 1:-> JSConstant(JS|PureNum|NeedsNaNOrInfinity|UseAsOther|UseAsInt|ReallyWantsInt, NonBoolInt32, Int32: 5, bc#32, ExitValid) // 46 0 11: D@39:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, NonBoolInt32, Int32: 646500229, bc#32, ExitValid) // 47 0 11: D@162:<!0:-> CheckStructure(Cell:D@26, MustGen, [%Ar:Array,ArrayWithInt32], R:JSCell_structureID, Exits, bc#32, ExitValid) // 48 0 11: D@163:< 1:-> GetButterfly(Cell:D@26, Storage|PureInt, R:JSObject_butterfly, bc#32, ExitValid) // 49 0 11: D@40:<!0:-> PutByValDirect(KnownCell:D@26, Int32:D@38, Int32:D@39, Check:Untyped:D@163, MustGen|VarArgs, Int32+OriginalNonCopyOnWriteArray+ToHole+AsIs+Write, R:Butterfly_publicLength,Butterfly_vectorLength,IndexedInt32Properties, W:Butterfly_publicLength,IndexedInt32Properties, Exits, ClobbersExit, bc#32, ExitValid) // 50 0 11: D@41:< 1:-> JSConstant(JS|PureNum|NeedsNaNOrInfinity|UseAsOther|UseAsInt|ReallyWantsInt, NonBoolInt32, Int32: 8, bc#38, ExitValid) // 51 0 11: D@42:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, NonBoolInt32, Int32: 268435439, bc#38, ExitValid) // 52 0 11: D@164:<!0:-> CheckStructure(Cell:D@26, MustGen, [%Ar:Array,ArrayWithInt32], R:JSCell_structureID, Exits, bc#38, ExitValid) // 53 0 11: D@165:< 1:-> GetButterfly(Cell:D@26, Storage|PureInt, R:JSObject_butterfly, bc#38, ExitValid) // 54 0 11: D@43:<!0:-> PutByValDirect(KnownCell:D@26, Int32:D@41, Int32:D@42, Check:Untyped:D@165, MustGen|VarArgs, Int32+OriginalNonCopyOnWriteArray+OutOfBounds+AsIs+Write, R:World, W:Heap, Exits, ClobbersExit, bc#38, ExitValid) // 55 0 11: D@187:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#44, ExitValid) // 56 0 11: D@44:< 1:-> JSConstant(JS|PureNum|NeedsNaNOrInfinity|UseAsOther|UseAsInt|ReallyWantsInt, NonBoolInt32, Int32: 9, bc#44, ExitValid) // 57 0 11: D@45:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, NonInt32AsInt52, Double: -4476578029604175872, -2147483649.000000, bc#44, ExitValid) // 58 0 11: D@166:<!0:-> ArrayifyToStructure(Cell:D@26, Int32:D@44, MustGen, Double+OriginalNonCopyOnWriteArray+ToHole+Convert+Write, %Bu:Array,ArrayWithDouble, R:JSCell_indexingType,JSCell_structureID,JSObject_butterfly, W:JSCell_indexingType,JSCell_structureID,JSObject_butterfly,Watchpoint_fire, Exits, bc#44, ExitValid) // 59 0 11: D@167:< 1:-> GetButterfly(Cell:D@26, Storage|PureInt, R:JSObject_butterfly, bc#44, ExitValid) // 60 0 11: D@178:< 1:-> DoubleConstant(Double|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, BytecodeDouble, Double: -4476578029604175872, -2147483649.000000, bc#44, ExitValid) // 61 0 11: D@46:<!0:-> PutByValDirect(KnownCell:D@26, Int32:D@44, DoubleRepReal:D@178<Double>, Check:Untyped:D@167, MustGen|VarArgs, Double+OriginalNonCopyOnWriteArray+ToHole+Convert+Write, R:Butterfly_publicLength,Butterfly_vectorLength,IndexedDoubleProperties, W:Butterfly_publicLength,IndexedDoubleProperties, Exits, ClobbersExit, bc#44, ExitValid) // 62 0 11: D@188:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#50, ExitValid) // 63 0 11: D@47:< 1:-> JSConstant(JS|PureNum|NeedsNaNOrInfinity|UseAsOther|UseAsInt|ReallyWantsInt, NonBoolInt32, Int32: 10, bc#50, ExitValid) // 64 0 11: D@48:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, NonBoolInt32, Int32: 1088171092, bc#50, ExitValid) // 65 0 11: D@168:<!0:-> CheckStructure(Cell:D@26, MustGen, [%Bu:Array,ArrayWithDouble], R:JSCell_structureID, Exits, bc#50, ExitValid) // 66 0 11: D@169:< 1:-> GetButterfly(Cell:D@26, Storage|PureInt, R:JSObject_butterfly, bc#50, ExitValid) // 67 0 11: D@179:< 1:-> DoubleConstant(Double|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, BytecodeDouble, Double: 4742350928357621760, 1088171092.000000, bc#50, ExitValid) // 68 0 11: D@49:<!0:-> PutByValDirect(KnownCell:D@26, Int32:D@47, DoubleRepReal:D@179<Double>, Check:Untyped:D@169, MustGen|VarArgs, Double+OriginalNonCopyOnWriteArray+ToHole+AsIs+Write, R:Butterfly_publicLength,Butterfly_vectorLength,IndexedDoubleProperties, W:Butterfly_publicLength,IndexedDoubleProperties, Exits, ClobbersExit, bc#50, ExitValid) // 69 0 11: D@50:< 1:-> JSConstant(JS|PureNum|NeedsNaNOrInfinity|UseAsOther|UseAsInt|ReallyWantsInt, NonBoolInt32, Int32: 11, bc#56, ExitValid) // 70 0 11: D@51:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, NonBoolInt32, Int32: -2147483648, bc#56, ExitValid) // 71 0 11: D@170:<!0:-> CheckStructure(Cell:D@26, MustGen, [%Bu:Array,ArrayWithDouble], R:JSCell_structureID, Exits, bc#56, ExitValid) // 72 0 11: D@171:< 1:-> GetButterfly(Cell:D@26, Storage|PureInt, R:JSObject_butterfly, bc#56, ExitValid) // 73 0 11: D@180:< 1:-> DoubleConstant(Double|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, BytecodeDouble, Double: -4476578029606273024, -2147483648.000000, bc#56, ExitValid) // 74 0 11: D@52:<!0:-> PutByValDirect(KnownCell:D@26, Int32:D@50, DoubleRepReal:D@180<Double>, Check:Untyped:D@171, MustGen|VarArgs, Double+OriginalNonCopyOnWriteArray+ToHole+AsIs+Write, R:Butterfly_publicLength,Butterfly_vectorLength,IndexedDoubleProperties, W:Butterfly_publicLength,IndexedDoubleProperties, Exits, ClobbersExit, bc#56, ExitValid) // 75 0 11: D@53:< 1:-> JSConstant(JS|PureNum|NeedsNaNOrInfinity|UseAsOther|UseAsInt|ReallyWantsInt, NonBoolInt32, Int32: 12, bc#62, ExitValid) // 76 0 11: D@54:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, NonBoolInt32, Int32: 3, bc#62, ExitValid) // 77 0 11: D@172:<!0:-> CheckStructure(Cell:D@26, MustGen, [%Bu:Array,ArrayWithDouble], R:JSCell_structureID, Exits, bc#62, ExitValid) // 78 0 11: D@173:< 1:-> GetButterfly(Cell:D@26, Storage|PureInt, R:JSObject_butterfly, bc#62, ExitValid) // 79 0 11: D@181:< 1:-> DoubleConstant(Double|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, BytecodeDouble, Double: 4613937818241073152, 3.000000, bc#62, ExitValid) // 80 0 11: D@55:<!0:-> PutByValDirect(KnownCell:D@26, Int32:D@53, DoubleRepReal:D@181<Double>, Check:Untyped:D@173, MustGen|VarArgs, Double+OriginalNonCopyOnWriteArray+ToHole+AsIs+Write, R:Butterfly_publicLength,Butterfly_vectorLength,IndexedDoubleProperties, W:Butterfly_publicLength,IndexedDoubleProperties, Exits, ClobbersExit, bc#62, ExitValid) // 81 0 11: D@56:< 1:-> JSConstant(JS|PureNum|NeedsNaNOrInfinity|UseAsOther|UseAsInt|ReallyWantsInt, NonBoolInt32, Int32: 13, bc#68, ExitValid) // 82 0 11: D@57:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, NonBoolInt32, Int32: -268435456, bc#68, ExitValid) // 83 0 11: D@174:<!0:-> CheckStructure(Cell:D@26, MustGen, [%Bu:Array,ArrayWithDouble], R:JSCell_structureID, Exits, bc#68, ExitValid) // 84 0 11: D@175:< 1:-> GetButterfly(Cell:D@26, Storage|PureInt, R:JSObject_butterfly, bc#68, ExitValid) // 85 0 11: D@182:< 1:-> DoubleConstant(Double|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, BytecodeDouble, Double: -4490088828488384512, -268435456.000000, bc#68, ExitValid) // 86 0 11: D@58:<!0:-> PutByValDirect(KnownCell:D@26, Int32:D@56, DoubleRepReal:D@182<Double>, Check:Untyped:D@175, MustGen|VarArgs, Double+OriginalNonCopyOnWriteArray+ToHole+AsIs+Write, R:Butterfly_publicLength,Butterfly_vectorLength,IndexedDoubleProperties, W:Butterfly_publicLength,IndexedDoubleProperties, Exits, ClobbersExit, bc#68, ExitValid) // 87 0 11: D@59:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, NonBoolInt32, Int32: 15, bc#74, ExitValid) // 88 0 11: D@60:<!0:-> ForceOSRExit(MustGen, W:SideState, Exits, bc#74, ExitValid) // 89 0 11: D@61:<!0:-> PutById(Check:Cell:D@26, Check:Untyped:D@59, MustGen, cachable-id {uid:(length)}, R:World, W:Heap, Exits, ClobbersExit, bc#74, ExitValid) // 90 0 11: D@189:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#80, ExitValid) // 91 0 11: D@62:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, OtherObj, Weak:Object: 0x7ee979230180 with butterfly (nil)(base=0xfffffffffffffff8) (Structure %BQ:JSGlobalLexicalEnvironment), StructureID: 235456, bc#80, ExitValid) // 92 0 11: D@63:<!0:-> MovHint(Check:Untyped:D@62, MustGen, loc6, W:SideState, ClobbersExit, bc#80, ExitValid) // 93 0 11: D@64:<!0:-> Check(MustGen, bc#80, ExitInvalid) // 94 0 11: D@65:< 1:-> SetLocal(Check:Untyped:D@62, loc6(K~<Object>/FlushedJSValue), W:Stack(loc6), bc#80, exit: bc#87, ExitValid) predicting OtherObj // 95 0 11: D@66:< 1:-> NewArray(JS|VarArgs|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, Array, vectorLengthHint = 5, ArrayWithUndecided, R:HeapObjectCount, W:HeapObjectCount, Exits, bc#87, ExitValid) // 96 0 11: D@67:<!0:-> MovHint(Check:Untyped:D@66, MustGen, loc7, W:SideState, ClobbersExit, bc#87, ExitValid) // 97 0 11: D@68:< 1:-> SetLocal(Check:Untyped:D@66, loc7(L~<Array>/FlushedJSValue), W:Stack(loc7), bc#87, exit: bc#93, ExitValid) predicting Array // 98 0 11: D@69:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, OtherObj, Weak:Object: 0x7ee979230180 with butterfly (nil)(base=0xfffffffffffffff8) (Structure %BQ:JSGlobalLexicalEnvironment), StructureID: 235456, bc#93, ExitValid) // 99 0 11: D@70:<!0:-> PutGlobalVariable(Check:Cell:D@69, Check:Untyped:D@66, MustGen, global(0x7ee97b0a9580), W:Absolute(139541256770944), Exits, ClobbersExit, bc#93, ExitValid) // 100 0 11: D@71:<!0:-> NotifyWrite(MustGen, 0x7ee97b1e1b00, W:Watchpoint_fire,SideState, ClobbersExit, bc#93, ExitInvalid) // 101 0 11: D@72:<!0:-> Check(MustGen, bc#93, ExitInvalid) // 102 0 11: D@190:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#101, ExitValid) // 103 0 11: D@73:<!0:-> MovHint(Check:Untyped:D@18, MustGen, loc5, W:SideState, ClobbersExit, bc#101, ExitValid) // 104 0 11: D@74:< 1:-> SetLocal(Check:Untyped:D@18, loc5(M~/FlushedJSValue), W:Stack(loc5), bc#101, exit: bc#104, ExitValid) predicting OtherObj|Other // 105 0 11: D@75:< 1:-> JSConstant(JS|PureNum|NeedsNaNOrInfinity|UseAsOther|ReallyWantsInt, NonBoolInt32, Int32: -409186827, bc#104, ExitValid) // 106 0 11: D@76:<!0:-> MovHint(Check:Untyped:D@75, MustGen, loc6, W:SideState, ClobbersExit, bc#104, ExitValid) // 107 0 11: D@77:< 1:-> SetLocal(Check:Int32:D@75, loc6(N<Int32>/FlushedInt32), W:Stack(loc6), Exits, bc#104, exit: bc#107, ExitValid) predicting NonBoolInt32 // 108 0 11: D@78:< 1:-> CompareEq(Check:Int32:D@75, Check:Int32:D@57, Boolean|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, Bool, Exits, bc#107, ExitValid) // 109 0 11: D@79:<!0:-> Branch(Check:KnownBoolean:D@78, MustGen, T:#2/w:1.000000, F:#1/w:10.000000, W:SideState, bc#107, ExitInvalid) // 0 11: States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated // 0 11: Vars After: // 0 11: Var Links: arg0:D@0 loc0:D@3 loc1:D@5 loc2:D@7 loc3:D@9 loc4:D@17 loc5:D@74 loc6:D@77 loc7:D@68 // // 1 11: Block #1 (bc#111): (OSR target) // 1 11: Execution count: 10.000000 // 1 11: Predecessors: #0 #1 // 1 11: Successors: #2 #1 // 1 11: Dominated by: #root #0 #1 // 1 11: Dominates: #1 // 1 11: Dominance Frontier: #1 #2 // 1 11: Iterated Dominance Frontier: #1 #2 // 1 11: Loop header, contains: #1 // 1 11: Containing loop headers: #1 // 1 11: Phi Nodes: D@153<loc4,1>->(D@153, D@17), D@154<loc6,1>->(D@154, D@77), D@155<this,1, IsFlushed>->(D@155, D@0) // 1 11: States: StructuresAreWatched // 1 11: Vars Before: arg0:(GlobalProxy, NonArray, [%Ac:JSGlobalProxy], Object: 0x7ee979248160 with butterfly (nil)(base=0xfffffffffffffff8) (Structure %Ac:JSGlobalProxy), StructureID: 250944, none:StructuresAreClobbered) loc4:(OtherObj, NonArray, [%BQ:JSGlobalLexicalEnvironment], Object: 0x7ee979230180 with butterfly (nil)(base=0xfffffffffffffff8) (Structure %BQ:JSGlobalLexicalEnvironment), StructureID: 235456, none:StructuresAreClobbered) loc6:(NonBoolInt32, Int32: -409186827, none:StructuresAreClobbered) // 1 11: Intersected Vars Before: arg0:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc0:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc1:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc2:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc3:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc4:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc5:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc6:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc7:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc8:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc9:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc10:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc11:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc12:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc13:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc14:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc15:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc16:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc17:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc18:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc19:(FullTop, TOP, TOP, none:StructuresAreClobbered) // 1 11: Var Links: arg0:D@155 loc4:D@153 loc6:D@154 // 0 1 11: D@80:<!0:-> LoopHint(MustGen, W:SideState, bc#111, ExitValid) // 1 1 11: D@81:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#112, ExitValid) // 2 1 11: D@82:< 1:-> JSConstant(JS|PureInt, Empty, <JSValue()>, bc#113, ExitValid) // 3 1 11: D@83:<!0:-> MovHint(Check:Untyped:D@82, MustGen, loc7, W:SideState, ClobbersExit, bc#113, ExitValid) // 4 1 11: D@84:< 1:-> SetLocal(Check:Untyped:D@82, loc7(O~/FlushedJSValue), W:Stack(loc7), bc#113, exit: bc#116, ExitValid) predicting Empty // 5 1 11: D@85:<!0:-> MovHint(Check:Untyped:D@82, MustGen, loc8, W:SideState, ClobbersExit, bc#116, ExitValid) // 6 1 11: D@86:< 1:-> SetLocal(Check:Untyped:D@82, loc8(P~/FlushedJSValue), W:Stack(loc8), bc#116, exit: bc#119, ExitValid) predicting Empty // 7 1 11: D@87:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, OtherObj, Weak:Object: 0x7ee97922d5a0 with butterfly 0x7ee9790ef0c8(base=0x7ee9790eecc0) (Structure %CL:global), StructureID: 250832, bc#119, ExitValid) // 8 1 11: D@88:<!0:-> MovHint(Check:Untyped:D@87, MustGen, loc9, W:SideState, ClobbersExit, bc#119, ExitValid) // 9 1 11: D@89:<!0:-> GetLocal(Check:Untyped:D@153, JS|MustGen|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, OtherObj, loc4(G~<Object>/FlushedJSValue), R:Stack(loc4), bc#119, ExitInvalid) predicting OtherObj // 10 1 11: D@90:<!0:-> Check(MustGen, bc#119, ExitInvalid) // 11 1 11: D@91:< 1:-> SetLocal(Check:Untyped:D@87, loc9(R~<Object>/FlushedJSValue), W:Stack(loc9), bc#119, exit: bc#126, ExitValid) predicting OtherObj // 12 1 11: D@92:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, OtherObj, Weak:Object: 0x7ee97922d5a0 with butterfly 0x7ee9790ef0c8(base=0x7ee9790eecc0) (Structure %CL:global), StructureID: 250832, bc#126, ExitValid) // 13 1 11: D@93:<!0:-> Check(MustGen, bc#126, ExitValid) // 14 1 11: D@94:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, OtherObj, Weak:Object: 0x7ee9790e2980 with butterfly 0x7ee97923f848(base=0x7ee97923f820) (Structure %An:Function), StructureID: 253632, bc#126, ExitValid) // 15 1 11: D@95:<!0:-> Check(MustGen, bc#126, ExitValid) // 16 1 11: D@96:<!0:-> MovHint(Check:Untyped:D@94, MustGen, loc10, W:SideState, ClobbersExit, bc#126, ExitValid) // 17 1 11: D@97:< 1:-> SetLocal(Check:Untyped:D@94, loc10(S~<Object>/FlushedJSValue), W:Stack(loc10), bc#126, exit: bc#135, ExitValid) predicting OtherObj // 18 1 11: D@98:<!0:-> MovHint(Check:Untyped:D@94, MustGen, loc12, W:SideState, ClobbersExit, bc#135, ExitValid) // 19 1 11: D@99:< 1:-> SetLocal(Check:Untyped:D@94, loc12(T~<Object>/FlushedJSValue), W:Stack(loc12), bc#135, exit: bc#138, ExitValid) predicting OtherObj // 20 1 11: D@100:<!0:-> FilterCallLinkStatus(Check:Untyped:D@94, MustGen, Statically Proved, InternalFunction: Object: 0x7ee9790e2980 with butterfly 0x7ee97923f848(base=0x7ee97923f820) (Structure 0x7ee80003dec0:[0x3dec0/253632, Function, (0/0, 3/4){length:64, name:65, prototype:66}, NonArray, Unknown, Proto:0x7ee9790e2620, Leaf]), StructureID: 253632, W:SideState, bc#138, ExitValid) // 21 1 11: D@101:<!0:-> Construct(Check:Untyped:D@94, Check:Untyped:D@94, JS|MustGen|VarArgs|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther|UseAsInt|ReallyWantsInt, WeakMapObject, R:World, W:Heap, ExitsForExceptions, ClobbersExit, bc#138, ExitValid) predicting WeakMapObject // 22 1 11: D@102:<!0:-> MovHint(Check:Untyped:D@101, MustGen, loc7, W:SideState, ClobbersExit, bc#138, ExitInvalid) // 23 1 11: D@183:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#138, exit: bc#145, ExitValid) // 24 1 11: D@103:< 1:-> SetLocal(Check:Untyped:D@101, loc7(U~<Object>/FlushedJSValue), W:Stack(loc7), bc#138, exit: bc#145, ExitValid) predicting WeakMapObject // 25 1 11: D@104:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, OtherObj, Weak:Object: 0x7ee97922d5a0 with butterfly 0x7ee9790ef0c8(base=0x7ee9790eecc0) (Structure %CL:global), StructureID: 250832, bc#145, ExitValid) // 26 1 11: D@105:<!0:-> MovHint(Check:Untyped:D@104, MustGen, loc9, W:SideState, ClobbersExit, bc#145, ExitValid) // 27 1 11: D@106:<!0:-> Check(MustGen, bc#145, ExitInvalid) // 28 1 11: D@107:< 1:-> SetLocal(Check:Untyped:D@104, loc9(V~<Object>/FlushedJSValue), W:Stack(loc9), bc#145, exit: bc#152, ExitValid) predicting OtherObj // 29 1 11: D@108:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, OtherObj, Weak:Object: 0x7ee97922d5a0 with butterfly 0x7ee9790ef0c8(base=0x7ee9790eecc0) (Structure %CL:global), StructureID: 250832, bc#152, ExitValid) // 30 1 11: D@109:<!0:-> Check(MustGen, bc#152, ExitValid) // 31 1 11: D@110:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, OtherObj, Weak:Object: 0x7ee9790e2950 with butterfly 0x7ee97923ea48(base=0x7ee97923ea20) (Structure %CR:Function), StructureID: 249600, bc#152, ExitValid) // 32 1 11: D@111:<!0:-> Check(MustGen, bc#152, ExitValid) // 33 1 11: D@112:<!0:-> MovHint(Check:Untyped:D@110, MustGen, loc10, W:SideState, ClobbersExit, bc#152, ExitValid) // 34 1 11: D@113:< 1:-> SetLocal(Check:Untyped:D@110, loc10(W~<Object>/FlushedJSValue), W:Stack(loc10), bc#152, exit: bc#161, ExitValid) predicting OtherObj // 35 1 11: D@114:<!0:-> MovHint(Check:Untyped:D@101, MustGen, loc13, W:SideState, ClobbersExit, bc#161, ExitValid) // 36 1 11: D@115:< 1:-> SetLocal(Check:Untyped:D@101, loc13(X~<Object>/FlushedJSValue), W:Stack(loc13), bc#161, exit: bc#164, ExitValid) predicting WeakMapObject // 37 1 11: D@116:<!0:-> MovHint(Check:Untyped:D@110, MustGen, loc14, W:SideState, ClobbersExit, bc#164, ExitValid) // 38 1 11: D@117:< 1:-> SetLocal(Check:Untyped:D@110, loc14(Y~<Object>/FlushedJSValue), W:Stack(loc14), bc#164, exit: bc#167, ExitValid) predicting OtherObj // 39 1 11: D@118:<!0:-> FilterCallLinkStatus(Check:Untyped:D@110, MustGen, Statically Proved, InternalFunction: Object: 0x7ee9790e2950 with butterfly 0x7ee97923ea48(base=0x7ee97923ea20) (Structure 0x7ee80003cf00:[0x3cf00/249600, Function, (0/0, 4/4){length:64, name:65, prototype:66, Symbol.species:67}, NonArray, Unknown, Proto:0x7ee9790e2620, Leaf]), StructureID: 249600, W:SideState, bc#167, ExitValid) // 40 1 11: D@119:<!0:-> CheckIsConstant(Cell:D@110, MustGen, <0x7ee9790e2950, Function>, Exits, bc#167, ExitValid) // 41 1 11: D@120:<!0:-> Check(MustGen, bc#167, ExitValid) // 42 1 11: D@121:<!0:-> NewTypedArrayBuffer(Check:Untyped:D@101, JS|MustGen|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, OtherObj, %ED:ArrayBuffer, R:World, W:Heap, Exits, ClobbersExit, bc#167, ExitValid) // 43 1 11: D@122:<!0:-> MovHint(Check:Untyped:D@121, MustGen, loc8, W:SideState, ClobbersExit, bc#167, ExitInvalid) // 44 1 11: D@123:<!0:-> Check(MustGen, bc#167, ExitInvalid) // 45 1 11: D@124:<!0:-> Check(MustGen, bc#167, ExitInvalid) // 46 1 11: D@125:<!0:-> Check(MustGen, bc#167, ExitInvalid) // 47 1 11: D@184:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#167, exit: bc#174, ExitValid) // 48 1 11: D@126:< 1:-> SetLocal(Check:Untyped:D@121, loc8(Z~<Object>/FlushedJSValue), W:Stack(loc8), bc#167, exit: bc#174, ExitValid) predicting OtherObj // 49 1 11: D@127:< 1:-> JSConstant(JS|PureInt, Other, Undefined, bc#174, ExitValid) // 50 1 11: D@128:<!0:-> MovHint(Check:Untyped:D@127, MustGen, loc5, W:SideState, ClobbersExit, bc#174, ExitValid) // 51 1 11: D@129:< 1:-> SetLocal(Check:Untyped:D@127, loc5(AB~<Other>/FlushedJSValue), W:Stack(loc5), bc#174, exit: bc#177, ExitValid) predicting Other // 52 1 11: D@130:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, OtherObj, Weak:Object: 0x7ee979230180 with butterfly (nil)(base=0xfffffffffffffff8) (Structure %BQ:JSGlobalLexicalEnvironment), StructureID: 235456, bc#177, ExitValid) // 53 1 11: D@131:<!0:-> MovHint(Check:Untyped:D@130, MustGen, loc9, W:SideState, ClobbersExit, bc#177, ExitValid) // 54 1 11: D@132:<!0:-> Check(MustGen, bc#177, ExitInvalid) // 55 1 11: D@133:< 1:-> SetLocal(Check:Untyped:D@130, loc9(BB~<Object>/FlushedJSValue), W:Stack(loc9), bc#177, exit: bc#184, ExitValid) predicting OtherObj // 56 1 11: D@134:<!0:-> Check(MustGen, bc#184, ExitValid) // 57 1 11: D@135:< 1:-> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, Array, Weak:Object: 0x7ee9791502a0 with butterfly 0x7ee9791401f8(base=0x7ee9791401d0) (Structure %Am:Array,ArrayWithUndecided), StructureID: 253744, bc#184, ExitValid) // 58 1 11: D@136:<!0:-> MovHint(Check:Untyped:D@135, MustGen, loc10, W:SideState, ClobbersExit, bc#184, ExitValid) // 59 1 11: D@137:< 1:-> SetLocal(Check:Untyped:D@135, loc10(CB~<Array>/FlushedJSValue), W:Stack(loc10), bc#184, exit: bc#193, ExitValid) predicting Array // 60 1 11: D@138:<!0:-> MovHint(Check:Untyped:D@121, MustGen, loc5, W:SideState, ClobbersExit, bc#193, ExitValid) // 61 1 11: D@139:< 1:-> SetLocal(Check:Untyped:D@121, loc5(M~/FlushedJSValue), W:Stack(loc5), bc#193, exit: bc#196, ExitValid) predicting OtherObj|Other // 62 1 11: D@140:<!0:-> GetLocal(Check:Untyped:D@154, JS|MustGen|PureNum|NeedsNaNOrInfinity|UseAsOther|UseAsInt|ReallyWantsInt, NonBoolInt32, loc6(N<Int32>/FlushedInt32), R:Stack(loc6), bc#196, ExitValid) predicting NonBoolInt32 // 63 1 11: D@176:<!0:-> Arrayify(Check:Cell:D@135, Check:Int32:D@140, MustGen, Contiguous+Array+OutOfBounds+Convert+Write, R:JSCell_indexingType,JSCell_structureID,JSObject_butterfly, W:JSCell_indexingType,JSCell_structureID,JSObject_butterfly,Watchpoint_fire, Exits, bc#196, ExitValid) // 64 1 11: D@177:< 1:-> GetButterfly(Check:Cell:D@135, Storage|PureInt, R:JSObject_butterfly, Exits, bc#196, ExitValid) // 65 1 11: D@141:<!0:-> PutByVal(Check:KnownCell:D@135, Check:Int32:D@140, Check:Untyped:D@121, Check:Untyped:D@177, MustGen|VarArgs, Contiguous+Array+OutOfBounds+Convert+Write, R:World, W:Heap, Exits, ClobbersExit, bc#196, ExitValid) // 66 1 11: D@185:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#202, ExitValid) // 67 1 11: D@142:< 1:-> ArithBitNot(Check:Int32:D@140, Int32|PureInt, Int32, Exits, bc#202, ExitValid) // 68 1 11: D@143:<!0:-> MovHint(Check:Untyped:D@142, MustGen, loc7, W:SideState, ClobbersExit, bc#202, ExitInvalid) // 69 1 11: D@144:< 1:-> SetLocal(Check:Untyped:D@142, loc7(FB~<Int32>/FlushedJSValue), W:Stack(loc7), bc#202, exit: bc#206, ExitValid) predicting Int32 // 70 1 11: D@145:< 1:-> JSConstant(JS|PureNum|NeedsNaNOrInfinity|UseAsOther, NonBoolInt32, Int32: -268435456, bc#206, ExitValid) // 71 1 11: D@146:< 1:-> CompareEq(Check:Int32:D@140, Check:Int32:D@145, Boolean|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, Bool, Exits, bc#206, ExitValid) // 72 1 11: D@147:<!0:-> Branch(Check:KnownBoolean:D@146, MustGen, T:#2/w:1.000000, F:#1/w:10.000000, W:SideState, bc#206, ExitInvalid) // 1 11: States: InvalidBranchDirection, StructuresAreWatched // 1 11: Vars After: // 1 11: Var Links: arg0:D@155 loc4:D@89 loc5:D@139 loc6:D@140 loc7:D@144 loc8:D@126 loc9:D@133 loc10:D@137 loc12:D@99 loc13:D@115 loc14:D@117 // // 2 11: Block #2 (bc#210): // 2 11: Execution count: 1.000000 // 2 11: Predecessors: #0 #1 // 2 11: Successors: // 2 11: Dominated by: #root #0 #2 // 2 11: Dominates: #2 // 2 11: Dominance Frontier: // 2 11: Iterated Dominance Frontier: // 2 11: Phi Nodes: D@151<loc5,1>->(D@139, D@74), D@152<this,1, IsFlushed>->(D@155, D@0) // 2 11: States: StructuresAreWatched, CurrentlyCFAUnreachable // 2 11: Vars Before: <empty> // 2 11: Intersected Vars Before: arg0:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc0:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc1:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc2:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc3:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc4:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc5:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc6:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc7:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc8:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc9:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc10:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc11:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc12:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc13:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc14:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc15:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc16:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc17:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc18:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc19:(FullTop, TOP, TOP, none:StructuresAreClobbered) // 2 11: Var Links: arg0:D@152 loc5:D@151 // 0 2 11: D@148:<!0:-> GetLocal(Check:Untyped:D@151, JS|MustGen|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, OtherObj|Other, loc5(M~/FlushedJSValue), R:Stack(loc5), bc#210, ExitValid) predicting OtherObj|Other // 1 2 11: D@149:<!0:-> Return(Check:Untyped:D@148, MustGen, W:SideState, Exits, bc#210, ExitValid) // 2 2 11: D@150:<!0:-> Flush(Check:Untyped:D@152, MustGen|IsFlushed, this(A~<Object>/FlushedJSValue), R:Stack(this), W:SideState, bc#210, ExitValid) predicting GlobalProxy // 2 11: States: InvalidBranchDirection, StructuresAreWatched // 2 11: Vars After: <empty> // 2 11: Var Links: arg0:D@150 loc5:D@148 // // 11: GC Values: // 11: Strong:Cell: 0x7ee979268130 (%CW:Immutable Butterfly,ArrayWithDouble), StructureID: 18880 // 11: Strong:Cell: 0x7ee97914c1a0 (%Dx:Immutable Butterfly,ArrayWithInt32), StructureID: 18656 // 11: Weak:Object: 0x7ee979230180 with butterfly (nil)(base=0xfffffffffffffff8) (Structure %BQ:JSGlobalLexicalEnvironment), StructureID: 235456 // 11: Weak:Object: 0x7ee97922d5a0 with butterfly 0x7ee9790ef0c8(base=0x7ee9790eecc0) (Structure %CL:global), StructureID: 250832 // 11: Weak:Object: 0x7ee9790e2980 with butterfly 0x7ee97923f848(base=0x7ee97923f820) (Structure %An:Function), StructureID: 253632 // 11: Weak:Object: 0x7ee9790e2950 with butterfly 0x7ee97923ea48(base=0x7ee97923ea20) (Structure %CR:Function), StructureID: 249600 // 11: Weak:Object: 0x7ee9791502a0 with butterfly 0x7ee9791401f8(base=0x7ee9791401d0) (Structure %Am:Array,ArrayWithUndecided), StructureID: 253744 // 11: Weak:Object: 0x7ee979248160 with butterfly (nil)(base=0xfffffffffffffff8) (Structure %Ac:JSGlobalProxy), StructureID: 250944 // 11: Desired watchpoints: // 11: Watchpoint sets: 0x7ee97b1e0d00, 0x7ee97b1e1b00 // 11: Inline watchpoint sets: 0x7ee80003cf68, 0x7ee80003df28, 0x7ee80003cef8, 0x7ee800004948, 0x7ee8000041d8, 0x7ee8000042b8, 0x7ee80003a548, 0x7ee800039828, 0x7ee800004a28, 0x7ee80003df98, 0x7ee80003a778, 0x7ee800004868, 0x7ee80003d4a8 // 11: SymbolTables: // 11: FunctionExecutables: // 11: Buffer views: // 11: Object property conditions: <Object: 0x7ee97922d5a0 with butterfly 0x7ee9790ef0c8(base=0x7ee9790eecc0) (Structure %CL:global), StructureID: 250832: Equivalence of WeakMap with Object: 0x7ee9790e2980 with butterfly 0x7ee97923f848(base=0x7ee97923f820) (Structure %An:Function), StructureID: 253632>, <Object: 0x7ee97922d5a0 with butterfly 0x7ee9790ef0c8(base=0x7ee9790eecc0) (Structure %CL:global), StructureID: 250832: Equivalence of SharedArrayBuffer with Object: 0x7ee9790e2950 with butterfly 0x7ee97923ea48(base=0x7ee97923ea20) (Structure %CR:Function), StructureID: 249600> // 11: Structures: // 11: %Ac:JSGlobalProxy = 0x7ee80003d440:[0x3d440/250944, JSGlobalProxy, (0/0, 0/0){}, NonArray, Unknown, Proto:0x7ee9790dd100, Leaf] // 11: %Am:Array,ArrayWithUndecided = 0x7ee80003df30:[0x3df30/253744, Array, (0/0, 1/4){-409186827:64}, ArrayWithUndecided, PropertyAddition, Proto:0x7ee979150270, Leaf] // 11: %An:Function = 0x7ee80003dec0:[0x3dec0/253632, Function, (0/0, 3/4){length:64, name:65, prototype:66}, NonArray, Unknown, Proto:0x7ee9790e2620, Leaf] // 11: %Ar:Array,ArrayWithInt32 = 0x7ee80003a400:[0x3a400/238592, Array, (0/0, 0/0){}, ArrayWithInt32, Unknown, Proto:0x7ee979150270] // 11: %BQ:JSGlobalLexicalEnvironment = 0x7ee8000397c0:[0x397c0/235456, JSGlobalLexicalEnvironment, (0/0, 0/0){}, NonArray, Unknown, Leaf] // 11: %Bu:Array,ArrayWithDouble = 0x7ee80003a4e0:[0x3a4e0/238816, Array, (0/0, 0/0){}, ArrayWithDouble, Unknown, Proto:0x7ee979150270, Leaf] // 11: %CL:global = 0x7ee80003d3d0:[0x3d3d0/250832, global, (0/0, 95/128){Object:64, Function:65, Array:66, RegExp:67, Iterator:68, SharedArrayBuffer:69, String:70, Promise:71, BigInt:72, Symbol:73, WeakRef:74, FinalizationRegistry:75, Intl:76, WebAssembly:77, Symbol.toStringTag:78, testLoopCount:79, wasmTestLoopCount:80, atob:81, btoa:82, disassembleBase64:83, debug:84, describe:85, describeArray:86, print:87, printErr:88, prettyPrint:89, gc:90, fullGC:91, edenGC:92, jscStack:93, preciseTime:94, neverInlineFunction:95, noInline:96, noDFG:97, noFTL:98, noOSRExitFuzzing:99, numberOfDFGCompiles:100, callerIsBBQOrOMGCompiled:101, jscOptions:102, optimizeNextInvocation:103, reoptimizationRetryCount:104, transferArrayBuffer:105, OSRExit:106, isFinalTier:107, predictInt32:108, isInt32:109, isPureNaN:110, fiatInt52:111, effectful42:112, makeMasquerader:113, hasCustomProperties:114, createGlobalObject:115, createHeapBigInt:116, useBigInt32:117, isBigInt32:118, isHeapBigInt:119, createNonRopeNonAtomString:120, dumpTypesForAllVariables:121, drainMicrotasks:122, setTimeout:123, releaseWeakRefs:124, finalizationRegistryLiveCount:125, finalizationRegistryDeadCount:126, getRandomSeed:127, setRandomSeed:128, isRope:129, callerSourceOrigin:130, is32BitPlatform:131, checkModuleSyntax:132, checkScriptSyntax:133, platformSupportsSamplingProfiler:134, generateHeapSnapshot:135, generateHeapSnapshotForGCDebugging:136, resetSuperSamplerState:137, ensureArrayStorage:138, startSamplingProfiler:139, samplingProfilerStackTraces:140, maxArguments:141, asyncTestStart:142, asyncTestPassed:143, WebAssemblyMemoryMode:144, console:145, waiterListSize:146, waitForReport:147, heapCapacity:148, flashHeapAccess:149, disableRichSourceInfo:150, mallocInALoop:151, totalCompileTime:152, setUnhandledRejectionCallback:153, asDoubleNumber:154, dropAllLocks:155, performance:156, fuzzilli:157, WeakMap:158}, NonArray, ChangePrototype, Proto:0x7ee9790dd100, Dictionary, Leaf] // 11: %CR:Function = 0x7ee80003cf00:[0x3cf00/249600, Function, (0/0, 4/4){length:64, name:65, prototype:66, Symbol.species:67}, NonArray, Unknown, Proto:0x7ee9790e2620, Leaf] // 11: %CW:Immutable Butterfly,ArrayWithDouble = 0x7ee8000049c0:[0x49c0/18880, Immutable Butterfly, (0/0, 0/0){}, CopyOnWriteArrayWithDouble, Unknown, Leaf] // 11: %Dx:Immutable Butterfly,ArrayWithInt32 = 0x7ee8000048e0:[0x48e0/18656, Immutable Butterfly, (0/0, 0/0){}, CopyOnWriteArrayWithInt32, Unknown, Leaf] // 11: %ED:ArrayBuffer = 0x7ee80003ce90:[0x3ce90/249488, ArrayBuffer, (0/0, 0/0){}, NonArray, Unknown, Proto:0x7ee9790dd250, Leaf] // // // DFG ASSERTION FAILED: AI-clobberize disagreement; AI says NotClobbered while clobberize says (Direct:[Heap], Super:[World]) // /home/fuzzer/webkit/WebKit-c5e0671158732bcdf83d26d4a964a0d88b2ca02c/Source/JavaScriptCore/dfg/DFGCFAPhase.cpp(229) : void JSC::DFG::CFAPhase::performBlockCFA(BasicBlock *) // STDOUT: // ``` 2102812 1 webkit-bug-importer 2025-03-13 00:52:42 -0700 <rdar://problem/146930687> 2102998 2 ysuzuki 2025-03-13 11:19:14 -0700 ToT bug, fixing. 2103002 3 ysuzuki 2025-03-13 11:20:48 -0700 Pull request: https://github.com/WebKit/WebKit/pull/42413 2103051 4 ews-feeder 2025-03-13 13:29:07 -0700 Committed 292112@main (5ad89cecd558): <https://commits.webkit.org/292112@main> Reviewed commits have been landed. Closing PR #42413 and removing active labels.