Bug 130069

Summary: ASSERTION FAILED: node->op() == Phi || node->op() == SetArgument
Product: WebKit Reporter: Ryosuke Niwa <rniwa>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: fpizlo, ggaren, mhahnenberg
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 130106, 130115    
Attachments:
Description Flags
the patch
none
the patch
none
the patch ggaren: review+

Description Ryosuke Niwa 2014-03-10 22:43:48 PDT
Tools/Scripts/run-perf-tests PerformanceTests/DoYouEvenBench/Full.html --test-runner-count=4 --reset-results --debug

hits the following assertion

ASSERTION FAILED: node->op() == Phi || node->op() == SetArgument
/Volumes/Data/webkit/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp(262) : void JSC::DFG::DCEPhase::cleanVariables(VariablesVectorType &) [VariablesVectorType = JSC::Operands<JSC::DFG::Node *, JSC::DFG::NodePointerTraits>]
1   0x1067dc750 WTFCrash
2   0x1062728e1 void JSC::DFG::DCEPhase::cleanVariables<JSC::Operands<JSC::DFG::Node*, JSC::DFG::NodePointerTraits> >(JSC::Operands<JSC::DFG::Node*, JSC::DFG::NodePointerTraits>&)
3   0x1062722d0 JSC::DFG::DCEPhase::fixupBlock(JSC::DFG::BasicBlock*)
4   0x106271e2e JSC::DFG::DCEPhase::run()
5   0x106271005 bool JSC::DFG::runAndLog<JSC::DFG::DCEPhase>(JSC::DFG::DCEPhase&)
6   0x106270f8e bool JSC::DFG::runPhase<JSC::DFG::DCEPhase>(JSC::DFG::Graph&)
7   0x106270f48 JSC::DFG::performDCE(JSC::DFG::Graph&)
8   0x106326f40 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&)
9   0x106326674 JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*)
10  0x1063c9ac0 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*)
11  0x1063c8714 JSC::DFG::Worklist::threadFunction(void*)
12  0x10682bf70 WTF::threadEntryPoint(void*)
13  0x10682cbf8 WTF::wtfThreadEntryPoint(void*)
14  0x7fff8f8d4899 _pthread_body
15  0x7fff8f8d472a _pthread_struct_init
16  0x7fff8f8d8fc9 thread_start
Comment 1 Ryosuke Niwa 2014-03-10 22:44:56 PDT
I've added instrumentation suggested in https://bugs.webkit.org/show_bug.cgi?id=130066#c7
as
Index: Source/JavaScriptCore/dfg/DFGDCEPhase.cpp
===================================================================
--- Source/JavaScriptCore/dfg/DFGDCEPhase.cpp	(revision 165407)
+++ Source/JavaScriptCore/dfg/DFGDCEPhase.cpp	(working copy)
@@ -259,6 +259,11 @@
                 continue;
             if (node->op() == GetLocal) {
                 node = node->child1().node();
+                if (!(node->op() == Phi || node->op() == SetArgument)) {
+                    m_graph.dump();
+                    fputs("\n\n\n\n\n", stderr);
+                    dataLog("node = ", node, "\n");
+                }
                 ASSERT(node->op() == Phi || node->op() == SetArgument);
                 if (node->shouldGenerate()) {
                     variables[i] = node;

but Graph::dump itself crashes hitting another assertion:


DFG for adapterDidCommit#<no-hash>:[0x7fe40a014860->0x7fe4064996a0->0x113b19470, DFGFunctionCall, 192]:
  Fixpoint state: FixpointConverged; Form: ThreadedCPS; Unification state: GloballyUnified; Ref count state: EverythingIsLive

Block #0 (bc#0):  (OSR target)
  Predecessors:
  Dominated by: #0
  Dominates: #0 #1 #2 #6 #7 #8 #9 #10 #14 #15 #16
  vars before: arg1:(Top, TOP, TOP, TOP) arg0:(Top, TOP, TOP, TOP)
  var links: arg1:@1 arg0:@0
   0:           < 1:->	SetArgument(arg0(a), W:SideState, bc#0)  predicting Final
   1:           < 3:->	SetArgument(arg1(B~<Other>/FlushedJSValue), W:SideState, bc#0)  predicting Other
   2:           < 3:->	GetLocal(@0, JS|UseAsOther, Final, arg0(a), R:Variables(6), bc#1)  predicting Final
   3:           <!0:->	Phantom(Check:FinalObject:@2<Final>, MustGen|CanExit, Final, bc#1)
   4:  skipped  < 0:->	MovHint(@2<Final>, arg0, W:SideState, bc#1)
   5:           < 2:->	SetLocal(Cell:@2<Final>, arg0(C<Final>/FlushedCell), W:Variables(6), bc#4)  predicting Final
   6:           <!0:->	FunctionReentryWatchpoint(MustGen, R:Watchpoint_fire, bc#4)
   7:           < 2:->	WeakJSConstant(JS|UseAsOther, Otherobj, 0x1131b8930 (%DE:JSActivation), bc#4)
   8:  skipped  < 0:->	MovHint(@7<Object>, loc5, W:SideState, bc#4)
   9:           <!0:->	Phantom(MustGen|CanExit, bc#10)
  10:           <!0:->	Phantom(@7<Object>, MustGen, bc#10)
  11:           <!0:->	VariableWatchpoint(MustGen|CanExit, 0x7fe4062d6b80, R:Watchpoint_fire, W:SideState, bc#10)
  12:           < 1:->	WeakJSConstant(JS|UseAsOther, Function, 0x113048030 (%Ct:Function), bc#10)
  13:  skipped  < 0:->	MovHint(@12<Function>, loc0, W:SideState, bc#10)
  14:           <!0:->	Phantom(MustGen|CanExit, bc#18)
  15:  skipped  < 0:->	MovHint(@2<Final>, loc4, W:SideState, bc#18)
  16:           <!0:->	Phantom(MustGen|CanExit, bc#21)
  17:           < 1:->	JSConstant(JS|UseAsOther, Stringident, $0 = String (identifier): isError, ID: 5, bc#21)
  18:  skipped  < 0:->	MovHint(@17<StringIdent>, loc3, W:SideState, bc#21)
  19:           <!0:->	Phantom(MustGen|CanExit, bc#24)
  20:           < 1:->	JSConstant(JS|UseAsOther, Bool, $1 = False, bc#24)
  21:  skipped  < 0:->	MovHint(@20<Boolean>, loc2, W:SideState, bc#24)
  22:           <!0:->	Phantom(MustGen|CanExit, bc#27)
  23:           <!0:->	Call(@12<Function>, @7<Object>, @2<Final>, @17<StringIdent>, @20<Boolean>, JS|MustGen|VarArgs|Clobbers|PureInt|CanExit, Bool, R:World, W:World, bc#27)  predicting Bool
  24:  skipped  < 0:->	MovHint(@23<Boolean>, loc0, W:SideState, bc#27)
 364:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#36)
  25:           <!0:->	Phantom(MustGen|CanExit, bc#36)
  26:           < 1:->	GetLocal(@1, JS|UseAsOther, Other, arg1(B~<Other>/FlushedJSValue), R:Variables(7), bc#36)  predicting Other
  27:           <!0:->	Branch(Check:ObjectOrOther:@26<Other>, MustGen|CanExit, T:#1, F:#2, W:SideState, bc#36)
  vars after: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP) loc0:(Top, TOP, TOP, TOP) loc2:(Bool, False) loc3:(Stringident, TOP, TOP, [%Ch:string], String (identifier): isError, ID: 5) loc4:(Final, TOP, TOP, TOP) loc5:(Otherobj, TOP, TOP, [%DE:JSActivation], Cell: 0x1131b8930 (%DE:JSActivation), ID: 489)
  var links: arg1:@26<Other> arg0:@5

Block #1 (bc#39): 
  Predecessors: #0
  Dominated by: #0 #1
  Dominates: #1
  Phi Nodes: @449<2>->(@1), @470<2>->(@5)
  vars before: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP)
  var links: arg1:@449 arg0:@470
  28:           < 1:->	GetLocal(@449, JS|UseAsOther, Other, arg1(B~<Other>/FlushedJSValue), R:Variables(7), bc#39)  predicting Other
  29:           < 2:->	GetLocal(@470, JS|UseAsOther, Final, arg0(C<Final>/FlushedCell), R:Variables(6), bc#39)  predicting Final
  30:           <!0:->	ForceOSRExit(MustGen|CanExit, W:SideState, bc#39)
 489:           <!0:->	StoreBarrier(Check:Cell:@29<Final>, MustGen|CanExit, R:BarrierState, W:BarrierState, bc#39)
  31:           <!0:->	PutById(Check:Cell:@29<Final>, @28<Other>, MustGen|Clobbers|CanExit, id1{_data}, R:World, W:World, bc#39)
 510:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#48)
  32:           <!0:->	Jump(MustGen|CanExit, T:#6, W:SideState, bc#48)
  vars after: 
  var links: arg1:@28<Other> arg0:@29<Final>

Block #2 (bc#50): 
  Predecessors: #0
  Dominated by: #0 #2
  Dominates: #2
  Phi Nodes: @448<2>->(@5), @457<1>->(@1)
  vars before: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP)
  var links: arg1:@457 arg0:@448
  33:           < 4:->	WeakJSConstant(JS|UseAsOther, Otherobj, 0x11212e870 (%CR:Window), bc#50)
  34:  skipped  < 0:->	MovHint(@33<Object>, loc3, W:SideState, bc#50)
  35:  skipped  < 0:->	SetLocal(@33<Object>, loc3(L~<Object>/FlushedJSValue), W:Variables(-4), bc#56)
  36:           <!0:->	StructureTransitionWatchpoint(Cell:@33<Object>, MustGen|CanExit, %CR:Window, R:JSCell_structureID, bc#56)
  37:           <!0:->	Phantom(@33<Object>, MustGen, bc#56)
  38:           < 1:->	GetButterfly(Cell:@33<Object>, Storage|UseAsOther, Other, R:JSObject_butterfly, bc#56)
  39:           < 4:->	GetByOffset(@38<Other>, KnownCell:@33<Object>, JS|UseAsOther, Final, id2{Ember}, 152, R:NamedProperties(2), bc#56)  predicting Final
  40:  skipped  < 0:->	MovHint(@39<Final>, loc3, W:SideState, bc#56)
  41:  skipped  < 0:->	SetLocal(@39<Final>, loc3(M~<Final>/FlushedJSValue), W:Variables(-4), bc#64)
  42:           <!0:->	CheckStructure(Check:Cell:@39<Final>, MustGen|CanExit, [%BN:Object], R:JSCell_structureID, bc#64)
  43:           < 1:->	GetButterfly(Cell:@39<Final>, Storage|UseAsOther, Other, R:JSObject_butterfly, bc#64)
  44:           < 1:->	GetByOffset(@43<Other>, KnownCell:@39<Final>, JS|UseAsOther, Function, id3{mixin}, 218, R:NamedProperties(3), bc#64)  predicting Function
  45:  skipped  < 0:->	MovHint(@44<Function>, loc0, W:SideState, bc#64)
  46:  skipped  < 0:->	SetLocal(@44<Function>, loc0(N~<Function>/FlushedJSValue), W:Variables(-1), bc#73)
  47:           < 2:->	GetLocal(@448, JS|UseAsOther, Final, arg0(C<Final>/FlushedCell), R:Variables(6), bc#73)  predicting Final
  48:           <!1:->	GetById(Cell:@47<Final>, JS|MustGen|Clobbers|UseAsOther|CanExit, Final, id1{_data}, R:World, W:World, bc#73)  predicting Final
  49:  skipped  < 0:->	MovHint(@48<Final>, loc2, W:SideState, bc#73)
 508:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#82)
  50:           < 2:->	SetLocal(@48<Final>, loc2(P*<Final>/FlushedJSValue), W:Variables(-3), bc#82)  predicting Final
  51:           <!1:->	GetById(Cell:@47<Final>, JS|MustGen|Clobbers|UseAsOther|CanExit, Final, id4{_inFlightAttributes}, R:World, W:World, bc#82)  predicting Final
  52:  skipped  < 0:->	MovHint(@51<Final>, loc1, W:SideState, bc#82)
 509:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#91)
  53:           < 1:->	SetLocal(@51<Final>, loc1(Q*<Final>/FlushedJSValue), W:Variables(-2), bc#91)  predicting Final
  54:           <!0:->	CheckFunction(Check:Cell:@44<Function>, @39<Final>, MustGen|CanExit, function(0x113044430, mixin#ASSERTION FAILED: isSafeToComputeHash()
/Volumes/Data/webkit3/Source/JavaScriptCore/bytecode/CodeBlock.cpp(102) : JSC::CodeBlockHash JSC::CodeBlock::hash() const
1   0x1018e34b0 WTFCrash
2   0x101247a97 JSC::CodeBlock::hash() const
3   0x1014ef4fe JSC::FunctionExecutableDump::dump(WTF::PrintStream&) const
4   0x1013b683d void WTF::printInternal<JSC::FunctionExecutableDump>(WTF::PrintStream&, JSC::FunctionExecutableDump const&)
5   0x1013aab3d void WTF::PrintStream::print<JSC::FunctionExecutableDump>(JSC::FunctionExecutableDump const&)
6   0x1013a5d16 JSC::DFG::Graph::dump(WTF::PrintStream&, char const*, JSC::DFG::Node*, JSC::DumpContext*)
7   0x1013a80a4 JSC::DFG::Graph::dump(WTF::PrintStream&, JSC::DumpContext*)
8   0x1013795bb void JSC::DFG::DCEPhase::cleanVariables<JSC::Operands<JSC::DFG::Node*, JSC::DFG::NodePointerTraits> >(JSC::Operands<JSC::DFG::Node*, JSC::DFG::NodePointerTraits>&)
9   0x101378e40 JSC::DFG::DCEPhase::fixupBlock(JSC::DFG::BasicBlock*)
10  0x10137899e JSC::DFG::DCEPhase::run()
11  0x101377b75 bool JSC::DFG::runAndLog<JSC::DFG::DCEPhase>(JSC::DFG::DCEPhase&)
12  0x101377afe bool JSC::DFG::runPhase<JSC::DFG::DCEPhase>(JSC::DFG::Graph&)
13  0x101377ab8 JSC::DFG::performDCE(JSC::DFG::Graph&)
14  0x10142dca0 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&)
15  0x10142d3d4 JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*)
16  0x1014d0820 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*)
17  0x1014cf474 JSC::DFG::Worklist::threadFunction(void*)
18  0x101932cd0 WTF::threadEntryPoint(void*)
19  0x101933958 WTF::wtfThreadEntryPoint(void*)
20  0x7fff8f8d4899 _pthread_body
21  0x7fff8f8d472a _pthread_struct_init
22  0x7fff8f8d8fc9 thread_start
Comment 2 Mark Hahnenberg 2014-03-10 22:46:15 PDT
As Phil suggested, you can get around that ASSERT by setting the following environment variable:

JSC_alwaysComputeHash=true
Comment 3 Ryosuke Niwa 2014-03-10 22:49:55 PDT
(In reply to comment #2)
> As Phil suggested, you can get around that ASSERT by setting the following environment variable:
> 
> JSC_alwaysComputeHash=true

Thanks. Will do that.  Just saw what this assertion is about.
Comment 4 Mark Hahnenberg 2014-03-10 23:00:20 PDT
(In reply to comment #3)
> (In reply to comment #2)
> > As Phil suggested, you can get around that ASSERT by setting the following environment variable:
> > 
> > JSC_alwaysComputeHash=true
> 
> Thanks. Will do that.  Just saw what this assertion is about.

Just finished rebuilding (accidentally svn upped and had to rebuild the world :-S ). Here's the full dump:

node = @50

DFG for adapterDidCommit#EP3AeT:[0x7ff93cb416d0->0x7ff931f8ac40->0x124fdc470, DFGFunctionCall, 192]:
  Fixpoint state: FixpointConverged; Form: ThreadedCPS; Unification state: GloballyUnified; Ref count state: EverythingIsLive

Block #0 (bc#0):  (OSR target)
  Predecessors:
  Dominated by: #0
  Dominates: #0 #1 #2 #6 #7 #8 #9 #10 #14 #15 #16
  vars before: arg1:(Top, TOP, TOP, TOP) arg0:(Top, TOP, TOP, TOP)
  var links: arg1:@1 arg0:@0
   0:           < 1:->	SetArgument(arg0(a), W:SideState, bc#0)  predicting Final
   1:           < 3:->	SetArgument(arg1(B~<Other>/FlushedJSValue), W:SideState, bc#0)  predicting Other
   2:           < 3:->	GetLocal(@0, JS|UseAsOther, Final, arg0(a), R:Variables(6), bc#1)  predicting Final
   3:           <!0:->	Phantom(Check:FinalObject:@2<Final>, MustGen|CanExit, Final, bc#1)
   4:  skipped  < 0:->	MovHint(@2<Final>, arg0, W:SideState, bc#1)
   5:           < 2:->	SetLocal(Cell:@2<Final>, arg0(C<Final>/FlushedCell), W:Variables(6), bc#4)  predicting Final
   6:           <!0:->	FunctionReentryWatchpoint(MustGen, R:Watchpoint_fire, bc#4)
   7:           < 2:->	WeakJSConstant(JS|UseAsOther, Otherobj, 0x124ff87f0 (%EL:JSActivation), bc#4)
   8:  skipped  < 0:->	MovHint(@7<Object>, loc5, W:SideState, bc#4)
   9:           <!0:->	Phantom(MustGen|CanExit, bc#10)
  10:           <!0:->	Phantom(@7<Object>, MustGen, bc#10)
  11:           <!0:->	VariableWatchpoint(MustGen|CanExit, 0x7ff93384e3a0, R:Watchpoint_fire, W:SideState, bc#10)
  12:           < 1:->	WeakJSConstant(JS|UseAsOther, Function, 0x1250cddb0 (%CK:Function), bc#10)
  13:  skipped  < 0:->	MovHint(@12<Function>, loc0, W:SideState, bc#10)
  14:           <!0:->	Phantom(MustGen|CanExit, bc#18)
  15:  skipped  < 0:->	MovHint(@2<Final>, loc4, W:SideState, bc#18)
  16:           <!0:->	Phantom(MustGen|CanExit, bc#21)
  17:           < 1:->	JSConstant(JS|UseAsOther, Stringident, $0 = String (identifier): isError, ID: 5, bc#21)
  18:  skipped  < 0:->	MovHint(@17<StringIdent>, loc3, W:SideState, bc#21)
  19:           <!0:->	Phantom(MustGen|CanExit, bc#24)
  20:           < 1:->	JSConstant(JS|UseAsOther, Bool, $1 = False, bc#24)
  21:  skipped  < 0:->	MovHint(@20<Boolean>, loc2, W:SideState, bc#24)
  22:           <!0:->	Phantom(MustGen|CanExit, bc#27)
  23:           <!0:->	Call(@12<Function>, @7<Object>, @2<Final>, @17<StringIdent>, @20<Boolean>, JS|MustGen|VarArgs|Clobbers|PureInt|CanExit, Bool, R:World, W:World, bc#27)  predicting Bool
  24:  skipped  < 0:->	MovHint(@23<Boolean>, loc0, W:SideState, bc#27)
 364:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#36)
  25:           <!0:->	Phantom(MustGen|CanExit, bc#36)
  26:           < 1:->	GetLocal(@1, JS|UseAsOther, Other, arg1(B~<Other>/FlushedJSValue), R:Variables(7), bc#36)  predicting Other
  27:           <!0:->	Branch(Check:ObjectOrOther:@26<Other>, MustGen|CanExit, T:#1, F:#2, W:SideState, bc#36)
  vars after: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP) loc0:(Top, TOP, TOP, TOP) loc2:(Bool, False) loc3:(Stringident, TOP, TOP, [%Dw:string], String (identifier): isError, ID: 5) loc4:(Final, TOP, TOP, TOP) loc5:(Otherobj, TOP, TOP, [%EL:JSActivation], Cell: 0x124ff87f0 (%EL:JSActivation), ID: 1074)
  var links: arg1:@26<Other> arg0:@5

Block #1 (bc#39): 
  Predecessors: #0
  Dominated by: #0 #1
  Dominates: #1
  Phi Nodes: @449<2>->(@1), @470<2>->(@5)
  vars before: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP)
  var links: arg1:@449 arg0:@470
  28:           < 1:->	GetLocal(@449, JS|UseAsOther, Other, arg1(B~<Other>/FlushedJSValue), R:Variables(7), bc#39)  predicting Other
  29:           < 2:->	GetLocal(@470, JS|UseAsOther, Final, arg0(C<Final>/FlushedCell), R:Variables(6), bc#39)  predicting Final
  30:           <!0:->	ForceOSRExit(MustGen|CanExit, W:SideState, bc#39)
 489:           <!0:->	StoreBarrier(Check:Cell:@29<Final>, MustGen|CanExit, R:BarrierState, W:BarrierState, bc#39)
  31:           <!0:->	PutById(Check:Cell:@29<Final>, @28<Other>, MustGen|Clobbers|CanExit, id1{_data}, R:World, W:World, bc#39)
 510:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#48)
  32:           <!0:->	Jump(MustGen|CanExit, T:#6, W:SideState, bc#48)
  vars after: 
  var links: arg1:@28<Other> arg0:@29<Final>

Block #2 (bc#50): 
  Predecessors: #0
  Dominated by: #0 #2
  Dominates: #2
  Phi Nodes: @448<2>->(@5), @457<1>->(@1)
  vars before: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP)
  var links: arg1:@457 arg0:@448
  33:           < 4:->	WeakJSConstant(JS|UseAsOther, Otherobj, 0x11449d670 (%Eg:Window), bc#50)
  34:  skipped  < 0:->	MovHint(@33<Object>, loc3, W:SideState, bc#50)
  35:  skipped  < 0:->	SetLocal(@33<Object>, loc3(L~<Object>/FlushedJSValue), W:Variables(-4), bc#56)
  36:           <!0:->	StructureTransitionWatchpoint(Cell:@33<Object>, MustGen|CanExit, %Eg:Window, R:JSCell_structureID, bc#56)
  37:           <!0:->	Phantom(@33<Object>, MustGen, bc#56)
  38:           < 1:->	GetButterfly(Cell:@33<Object>, Storage|UseAsOther, Other, R:JSObject_butterfly, bc#56)
  39:           < 4:->	GetByOffset(@38<Other>, KnownCell:@33<Object>, JS|UseAsOther, Final, id2{Ember}, 141, R:NamedProperties(2), bc#56)  predicting Final
  40:  skipped  < 0:->	MovHint(@39<Final>, loc3, W:SideState, bc#56)
  41:  skipped  < 0:->	SetLocal(@39<Final>, loc3(M~<Final>/FlushedJSValue), W:Variables(-4), bc#64)
  42:           <!0:->	CheckStructure(Check:Cell:@39<Final>, MustGen|CanExit, [%Bm:Object], R:JSCell_structureID, bc#64)
  43:           < 1:->	GetButterfly(Cell:@39<Final>, Storage|UseAsOther, Other, R:JSObject_butterfly, bc#64)
  44:           < 1:->	GetByOffset(@43<Other>, KnownCell:@39<Final>, JS|UseAsOther, Function, id3{mixin}, 218, R:NamedProperties(3), bc#64)  predicting Function
  45:  skipped  < 0:->	MovHint(@44<Function>, loc0, W:SideState, bc#64)
  46:  skipped  < 0:->	SetLocal(@44<Function>, loc0(N~<Function>/FlushedJSValue), W:Variables(-1), bc#73)
  47:           < 2:->	GetLocal(@448, JS|UseAsOther, Final, arg0(C<Final>/FlushedCell), R:Variables(6), bc#73)  predicting Final
  48:           <!1:->	GetById(Cell:@47<Final>, JS|MustGen|Clobbers|UseAsOther|CanExit, Final, id1{_data}, R:World, W:World, bc#73)  predicting Final
  49:  skipped  < 0:->	MovHint(@48<Final>, loc2, W:SideState, bc#73)
 508:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#82)
  50:           < 2:->	SetLocal(@48<Final>, loc2(P*<Final>/FlushedJSValue), W:Variables(-3), bc#82)  predicting Final
  51:           <!1:->	GetById(Cell:@47<Final>, JS|MustGen|Clobbers|UseAsOther|CanExit, Final, id4{_inFlightAttributes}, R:World, W:World, bc#82)  predicting Final
  52:  skipped  < 0:->	MovHint(@51<Final>, loc1, W:SideState, bc#82)
 509:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#91)
  53:           < 1:->	SetLocal(@51<Final>, loc1(Q*<Final>/FlushedJSValue), W:Variables(-2), bc#91)  predicting Final
  54:           <!0:->	CheckFunction(Check:Cell:@44<Function>, @39<Final>, MustGen|CanExit, function(0x1250ca1b0, mixin#AnlAZn/<nogen>:[0x125083070]), bc#91)
  --> mixin#AnlAZn:<0x125083070, bc#91, Call, known callee: Cell: 0x1250ca1b0 (%CK:Function), ID: 930, numArgs+this = 3, stack < loc9>
    55:           < 2:->	JSConstant(JS|UseAsOther, Other, $3 = Undefined, bc#0)
    56:  skipped  < 0:->	MovHint(@55<Other>, loc10, W:SideState, bc#0)
    57:  skipped  < 0:->	SetLocal(@55<Other>, loc10(R*<Other>/FlushedJSValue), W:Variables(-11), bc#0)
    58:  skipped  < 0:->	MovHint(@55<Other>, loc11, W:SideState, bc#0)
    59:  skipped  < 0:->	SetLocal(@55<Other>, loc11(S*<Other>/FlushedJSValue), W:Variables(-12), bc#0)
    60:  skipped  < 0:->	MovHint(@55<Other>, loc12, W:SideState, bc#0)
    61:  skipped  < 0:->	SetLocal(@55<Other>, loc12(T~<Other>/FlushedJSValue), W:Variables(-13), bc#0)
    62:           < 5:->	JSConstant(JS|UseAsOther, Empty, $5 = <JSValue()>, bc#1)
    63:  skipped  < 0:->	MovHint(@62, loc11, W:SideState, bc#1)
    64:           <!0:->	Phantom(@55<Other>, MustGen, bc#3)
    65:           < 1:->	SetLocal(@62, loc11(U*/FlushedJSValue), W:Variables(-12), bc#3)  predicting Empty
    66:  skipped  < 0:->	MovHint(@62, loc10, W:SideState, bc#3)
    67:           <!0:->	Phantom(@55<Other>, MustGen, bc#5)
    68:           < 1:->	SetLocal(@62, loc10(V*/FlushedJSValue), W:Variables(-11), bc#5)  predicting Empty
    69:           <!0:->	FunctionReentryWatchpoint(MustGen, R:Watchpoint_fire, bc#6)
    70:           < 3:->	WeakJSConstant(JS|UseAsOther, Otherobj, 0x122b8f470 (%EL:JSActivation), bc#6)
    71:  skipped  < 0:->	MovHint(@70<Object>, loc13, W:SideState, bc#6)
    72:  skipped  < 0:->	SetLocal(@70<Object>, loc13(W~<Object>/FlushedJSValue), W:Variables(-14), bc#12)
    73:           <!0:->	Phantom(@70<Object>, MustGen, bc#12)
    74:           <!0:->	VariableWatchpoint(MustGen|CanExit, 0x7ff931db5ab0, R:Watchpoint_fire, W:SideState, bc#12)
    75:           < 3:->	WeakJSConstant(JS|UseAsOther, Function, 0x122bbb130 (%CC:Function), bc#12)
    76:  skipped  < 0:->	MovHint(@75<Function>, loc14, W:SideState, bc#12)
    77:  skipped  < 0:->	SetLocal(@75<Function>, loc14(X~<Function>/FlushedJSValue), W:Variables(-15), bc#20)
    78:           <!0:->	StructureTransitionWatchpoint(Cell:@75<Function>, MustGen|CanExit, %CC:Function, R:JSCell_structureID, bc#20)
    79:           < 1:->	WeakJSConstant(JS|UseAsOther, Otherobj, 0x1144cd810 (%BC:Function), bc#20)
    80:           <!0:->	StructureTransitionWatchpoint(Cell:@79<Object>, MustGen|CanExit, %BC:Function, R:JSCell_structureID, bc#20)
    81:           <!0:->	Phantom(@75<Function>, MustGen, bc#20)
    82:           < 1:->	WeakJSConstant(JS|UseAsOther, Function, 0x122bbe4f0 (%CC:Function), bc#20)
    83:  skipped  < 0:->	MovHint(@82<Function>, loc15, W:SideState, bc#20)
    84:  skipped  < 0:->	SetLocal(@82<Function>, loc15(Y~<Function>/FlushedJSValue), W:Variables(-16), bc#29)
    85:           <!0:->	Phantom(Cell:@82<Function>, MustGen, bc#29)
    88:  skipped  < 0:->	MovHint(@75<Function>, loc16, W:SideState, bc#33)
    89:  skipped  < 0:->	SetLocal(@75<Function>, loc16(AB~<Function>/FlushedJSValue), W:Variables(-17), bc#36)
    90:           <!0:->	Phantom(@62, MustGen, Empty, bc#36)
    91:           < 4:->	CreateArguments(@62, JS|UseAsOther, Arguments, R:GCState,BarrierState, W:GCState,BarrierState,Watchpoint_fire,SideState, bc#36)
    92:  skipped  < 0:->	MovHint(@91<Arguments>, loc11, W:SideState, bc#36)
    93:  skipped  < 0:->	MovHint(@91<Arguments>, loc10, W:SideState, bc#36)
   506:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#38)
    94:           <!0:->	Flush(@65, MustGen, loc11(U*/FlushedJSValue), W:SideState, bc#38)  predicting Empty
    95:           < 1:->	SetLocal(@91<Arguments>, loc11(CB*<Arguments>/FlushedJSValue), W:Variables(-12), bc#38)  predicting Arguments
    96:           <!0:->	Flush(@68, MustGen, loc10(V*/FlushedJSValue), W:SideState, bc#38)  predicting Empty
    97:           < 2:->	SetLocal(@91<Arguments>, loc10(EB*<Arguments>/FlushedJSValue), W:Variables(-11), bc#38)  predicting Arguments
    98:           <!0:->	Phantom(@91<Arguments>, MustGen, Arguments, bc#38)
    99:  skipped  < 0:->	MovHint(@91<Arguments>, loc19, W:SideState, bc#38)
   100:  skipped  < 0:->	SetLocal(@91<Arguments>, loc19(FB~<Arguments>/FlushedJSValue), W:Variables(-20), bc#41)
   101:           < 1:->	JSConstant(JS|UseAsOther, Int32, $4 = Int32: 1, bc#41)
   102:  skipped  < 0:->	MovHint(@101<Int32>, loc18, W:SideState, bc#41)
   103:  skipped  < 0:->	SetLocal(@101<Int32>, loc18(GB~<Int32>/FlushedJSValue), W:Variables(-19), bc#44)
   104:           <!1:->	Call(@75<Function>, @91<Arguments>, @101<Int32>, JS|MustGen|VarArgs|Clobbers|UseAsOther|CanExit, Array, R:World, W:World, bc#44)  predicting Array
   105:  skipped  < 0:->	MovHint(@104<Array>, loc12, W:SideState, bc#44)
   507:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#53)
   106:  skipped  < 0:->	SetLocal(@104<Array>, loc12(HB~<Array>/FlushedJSValue), W:Variables(-13), bc#53)
   131:           <!0:->	FunctionReentryWatchpoint(MustGen, R:Watchpoint_fire, bc#75)
   133:  skipped  < 0:->	MovHint(@70<Object>, loc17, W:SideState, bc#75)
   134:  skipped  < 0:->	SetLocal(@70<Object>, loc17(SB~<Object>/FlushedJSValue), W:Variables(-18), bc#81)
   135:           <!0:->	Phantom(@70<Object>, MustGen, bc#81)
   136:           <!0:->	VariableWatchpoint(MustGen|CanExit, 0x7ff931db7260, R:Watchpoint_fire, W:SideState, bc#81)
   137:           < 1:->	WeakJSConstant(JS|UseAsOther, Function, 0x1250ca270 (%CK:Function), bc#81)
   138:  skipped  < 0:->	MovHint(@137<Function>, loc13, W:SideState, bc#81)
   139:  skipped  < 0:->	SetLocal(@137<Function>, loc13(TB~<Function>/FlushedJSValue), W:Variables(-14), bc#89)
   140:           < 1:->	GetLocal(@50, JS|UseAsOther, Final, loc2(P*<Final>/FlushedJSValue), R:Variables(-3), bc#89)  predicting Final
   141:  skipped  < 0:->	MovHint(@140<Final>, loc16, W:SideState, bc#89)
   142:  skipped  < 0:->	SetLocal(@140<Final>, loc16(VB~<Final>/FlushedJSValue), W:Variables(-17), bc#92)
   143:  skipped  < 0:->	GetLocal(JS|UseAsOther, Array, loc12(HB~<Array>/FlushedJSValue), R:Variables(-13), bc#92)
   144:  skipped  < 0:->	MovHint(@104<Array>, loc15, W:SideState, bc#92)
   145:  skipped  < 0:->	SetLocal(@104<Array>, loc15(XB~<Array>/FlushedJSValue), W:Variables(-16), bc#95)
   146:           < 1:->	JSConstant(JS|UseAsOther, Bool, $1 = False, bc#95)
   147:  skipped  < 0:->	MovHint(@146<Boolean>, loc14, W:SideState, bc#95)
   148:  skipped  < 0:->	SetLocal(@146<Boolean>, loc14(YB~<Boolean>/FlushedJSValue), W:Variables(-15), bc#98)
   149:           <!0:->	Call(@137<Function>, @70<Object>, @140<Final>, @104<Array>, @146<Boolean>, JS|MustGen|VarArgs|Clobbers|PureInt|CanExit, Final, R:World, W:World, bc#98)  predicting Final
   150:  skipped  < 0:->	MovHint(@149<Final>, loc13, W:SideState, bc#98)
   505:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#107)
   151:  skipped  < 0:->	SetLocal(@149<Final>, loc13(ZB~<Final>/FlushedJSValue), W:Variables(-14), bc#107)
   152:           < 1:->	GetLocal(@97, JS|UseAsOther, Arguments, loc10(EB*<Arguments>/FlushedJSValue), R:Variables(-11), bc#107)  predicting Arguments
   154:           <!0:->	TearOffArguments(@152<Arguments>, @62, MustGen, W:Arguments_registers, bc#107)
   155:           <!0:->	Flush(@53, MustGen, loc1(Q*<Final>/FlushedJSValue), W:SideState, bc#110)  predicting Final
   156:           <!0:->	Flush(@50, MustGen, loc2(P*<Final>/FlushedJSValue), W:SideState, bc#110)  predicting Final
   157:           <!0:->	Flush(@97, MustGen, loc10(EB*<Arguments>/FlushedJSValue), W:SideState, bc#110)  predicting Arguments
   158:           <!0:->	Flush(@95, MustGen, loc11(CB*<Arguments>/FlushedJSValue), W:SideState, bc#110)  predicting Arguments
   159:  skipped  < 0:->	GetLocal(@50, JS|PureInt, Final, loc2(P*<Final>/FlushedJSValue), R:Variables(-3), bc#110)
   160:  skipped  < 0:->	MovHint(@159<Final>, loc0, W:SideState, bc#110)
   161:  skipped  < 0:->	SetLocal(@159<Final>, loc0(DC~<Final>/FlushedJSValue), W:Variables(-1), bc#110)
  <-- mixin#AnlAZn:<0x125083070, bc#91, Call, known callee: Cell: 0x1250ca1b0 (%CK:Function), ID: 930, numArgs+this = 3, stack < loc9>
 162:           <!0:->	Jump(MustGen, T:#6, W:SideState, bc#100)
  vars after: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP) loc0:(Top, TOP, TOP, TOP) loc1:(Top, TOP, TOP, TOP) loc2:(Top, TOP, TOP, TOP) loc3:(Final, TOP, TOP, [%Bm:Object]) loc10:(Top, TOP, TOP, TOP) loc11:(Top, TOP, TOP, TOP) loc12:(Top, TOP, TOP, TOP) loc13:(Top, TOP, TOP, TOP) loc14:(Bool, False) loc15:(Top, TOP, TOP, TOP) loc16:(Top, TOP, TOP, TOP) loc17:(Otherobj, TOP, TOP, [%EL:JSActivation], Cell: 0x122b8f470 (%EL:JSActivation), ID: 1074) loc18:(Int32, Int32: 1) loc19:(Arguments, TOP, TOP, TOP)
  var links: arg1:@457 arg0:@47<Final> loc0:@161 loc1:@53 loc2:@159<Final> loc10:@152<Arguments> loc11:@95

Block #6 (bc#100): 
  Predecessors: #1 #2
  Dominated by: #0 #6
  Dominates: #6 #7 #8 #9 #10 #14 #15 #16
  Phi Nodes: @469<3>->(@448, @470), @456<2>->(@457, @449)
  vars before: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP)
  var links: arg1:@456 arg0:@469
 163:           < 9:->	GetLocal(@469, JS|UseAsOther, Final, arg0(C<Final>/FlushedCell), R:Variables(6), bc#100)  predicting Final
 164:  skipped  < 0:->	MovHint(@163<Final>, loc0, W:SideState, bc#100)
 165:  skipped  < 0:->	SetLocal(@163<Final>, loc0(FC~<Final>/FlushedJSValue), W:Variables(-1), bc#103)
 166:           < 1:->	NewObject(JS|UseAsOther, Final, %BB:Object, R:GCState,BarrierState, W:GCState,BarrierState, bc#103)
 167:  skipped  < 0:->	MovHint(@166<Final>, loc1, W:SideState, bc#103)
 168:  skipped  < 0:->	SetLocal(@166<Final>, loc1(GC~<Final>/FlushedJSValue), W:Variables(-2), bc#107)
 490:           <!0:->	StoreBarrier(Cell:@163<Final>, MustGen, R:BarrierState, W:BarrierState, bc#107)
 169:           <!0:->	PutById(Cell:@163<Final>, @166<Final>, MustGen|Clobbers|CanExit, id4{_inFlightAttributes}, R:World, W:World, bc#107)
 500:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#116)
 170:  skipped  < 0:->	MovHint(@163<Final>, loc3, W:SideState, bc#116)
 171:  skipped  < 0:->	SetLocal(@163<Final>, loc3(HC~<Final>/FlushedJSValue), W:Variables(-4), bc#119)
 172:           <!1:->	GetById(Cell:@163<Final>, JS|MustGen|Clobbers|UseAsOther|CanExit, Function, id5{send}, R:World, W:World, bc#119)  predicting Function
 173:  skipped  < 0:->	MovHint(@172<Function>, loc0, W:SideState, bc#119)
 501:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#128)
 174:  skipped  < 0:->	SetLocal(@172<Function>, loc0(IC~<Function>/FlushedJSValue), W:Variables(-1), bc#128)
 175:           < 1:->	JSConstant(JS|UseAsOther, Stringident, $2 = String (identifier): didCommit, ID: 5, bc#128)
 176:  skipped  < 0:->	MovHint(@175<StringIdent>, loc2, W:SideState, bc#128)
 177:  skipped  < 0:->	SetLocal(@175<StringIdent>, loc2(JC~<StringIdent>/FlushedJSValue), W:Variables(-3), bc#131)
 178:           <!0:->	Call(@172<Function>, @163<Final>, @175<StringIdent>, JS|MustGen|VarArgs|Clobbers|PureInt|CanExit, Other, R:World, W:World, bc#131)  predicting Other
 179:  skipped  < 0:->	MovHint(@178<Other>, loc0, W:SideState, bc#131)
 502:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#140)
 180:  skipped  < 0:->	SetLocal(@178<Other>, loc0(KC~<Other>/FlushedJSValue), W:Variables(-1), bc#140)
 181:  skipped  < 0:->	MovHint(@163<Final>, loc1, W:SideState, bc#140)
 182:  skipped  < 0:->	SetLocal(@163<Final>, loc1(LC~<Final>/FlushedJSValue), W:Variables(-2), bc#143)
 183:           <!1:->	GetById(Cell:@163<Final>, JS|MustGen|Clobbers|UseAsOther|CanExit, Function, id6{updateRecordArraysLater}, R:World, W:World, bc#143)  predicting Function
 184:  skipped  < 0:->	MovHint(@183<Function>, loc0, W:SideState, bc#143)
 503:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#152)
 185:  skipped  < 0:->	SetLocal(@183<Function>, loc0(MC~<Function>/FlushedJSValue), W:Variables(-1), bc#152)
 186:           <!0:->	CheckFunction(Check:Cell:@183<Function>, @163<Final>, MustGen|CanExit, function(0x124f87b70, updateRecordArraysLater#ET1ozr/<nogen>:[0x124fdbf70]), bc#152)
  --> updateRecordArraysLater#ET1ozr:<0x124fdbf70, bc#152, Call, known callee: Cell: 0x124f87b70 (%CK:Function), ID: 930, numArgs+this = 1, stack < loc7>
   187:           <!0:->	Phantom(FinalObject:@163<Final>, MustGen, Final, bc#1)
   188:  skipped  < 0:->	MovHint(@163<Final>, loc1, W:SideState, bc#1)
   189:           < 1:->	SetLocal(Cell:@163<Final>, loc1(NC<Final>/FlushedCell), W:Variables(-2), bc#4)  predicting Final
   190:           <!1:->	GetById(Cell:@163<Final>, JS|MustGen|Clobbers|UseAsOther|CanExit, BoolOther, id11{_updatingRecordArraysLater}, R:World, W:World, bc#4)  predicting BoolOther
   191:  skipped  < 0:->	MovHint(@190<Misc>, loc8, W:SideState, bc#4)
   504:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#13)
   192:  skipped  < 0:->	SetLocal(@190<Misc>, loc8(OC~<Misc>/FlushedJSValue), W:Variables(-9), bc#13)
   193:           <!0:->	Branch(@190<Misc>, MustGen|CanExit, T:#7, F:#8, W:SideState, bc#13)
  vars after: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP) loc0:(Function, TOP, TOP, TOP, Cell: 0x124f87b70 (%CK:Function), ID: 930) loc1:(Final, TOP, TOP, TOP) loc2:(Stringident, TOP, TOP, [%Dw:string], String (identifier): didCommit, ID: 5) loc3:(Final, TOP, TOP, TOP) loc8:(Top, TOP, TOP, TOP)
  var links: arg1:@456 arg0:@163<Final> loc0:@185 loc1:@189 loc2:@177 loc3:@171 loc8:@192

Block #7 (bc#152 --> updateRecordArraysLater#ET1ozr:<0x124fdbf70> bc#16): 
  Predecessors: #6
  Dominated by: #0 #6 #7
  Dominates: #7
  Phi Nodes: @452<1>->(@456), @453<1>->(@469)
  vars before: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP)
  var links: arg1:@452 arg0:@453
   194:  skipped  < 0:->	JSConstant(JS|PureInt, Other, $3 = Undefined, bc#16)
   195:  skipped  < 0:->	MovHint(@194<Other>, loc0, W:SideState, bc#16)
   196:  skipped  < 0:->	SetLocal(@194<Other>, loc0(PC~<Other>/FlushedJSValue), W:Variables(-1), bc#16)
   197:           <!0:->	Jump(MustGen, T:#14, W:SideState, bc#16)
  vars after: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP) loc0:(Other, Undefined)
  var links: arg1:@452 arg0:@453 loc0:@196

Block #8 (bc#152 --> updateRecordArraysLater#ET1ozr:<0x124fdbf70> bc#18): 
  Predecessors: #6
  Dominated by: #0 #6 #8
  Dominates: #8 #9 #10
  Phi Nodes: @488<1>->(@189), @461<2>->(@456), @455<2>->(@469)
  vars before: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP) loc1:(Final, TOP, TOP, TOP)
  var links: arg1:@461 arg0:@455 loc1:@488
   198:           < 1:->	JSConstant(JS|UseAsOther, Bool, $6 = True, bc#18)
   199:           < 4:->	GetLocal(@488, JS|UseAsOther, Final, loc1(NC<Final>/FlushedCell), R:Variables(-2), bc#18)  predicting Final
   491:           <!0:->	StoreBarrier(Cell:@199<Final>, MustGen, R:BarrierState, W:BarrierState, bc#18)
   200:           <!0:->	PutById(Cell:@199<Final>, @198<Boolean>, MustGen|Clobbers|CanExit, id11{_updatingRecordArraysLater}, R:World, W:World, bc#18)
   498:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#27)
   201:           < 8:->	WeakJSConstant(JS|UseAsOther, Otherobj, 0x11449d670 (%Eg:Window), bc#27)
   202:  skipped  < 0:->	MovHint(@201<Object>, loc14, W:SideState, bc#27)
   203:  skipped  < 0:->	SetLocal(@201<Object>, loc14(RC~<Object>/FlushedJSValue), W:Variables(-15), bc#33)
   204:           <!0:->	StructureTransitionWatchpoint(Cell:@201<Object>, MustGen|CanExit, %Eg:Window, R:JSCell_structureID, bc#33)
   205:           <!0:->	Phantom(@201<Object>, MustGen, bc#33)
   206:           < 1:->	GetButterfly(Cell:@201<Object>, Storage|UseAsOther, Other, R:JSObject_butterfly, bc#33)
   207:           < 3:->	GetByOffset(@206<Other>, KnownCell:@201<Object>, JS|UseAsOther, Final, id2{Ember}, 141, R:NamedProperties(2), bc#33)  predicting Final
   208:  skipped  < 0:->	MovHint(@207<Final>, loc15, W:SideState, bc#33)
   209:  skipped  < 0:->	SetLocal(@207<Final>, loc15(SC~<Final>/FlushedJSValue), W:Variables(-16), bc#41)
   210:           <!0:->	CheckStructure(Check:Cell:@207<Final>, MustGen|CanExit, [%Bm:Object], R:JSCell_structureID, bc#41)
   211:           < 1:->	GetButterfly(Cell:@207<Final>, Storage|UseAsOther, Other, R:JSObject_butterfly, bc#41)
   212:           < 3:->	GetByOffset(@211<Other>, KnownCell:@207<Final>, JS|UseAsOther, Function, id12{run}, 211, R:NamedProperties(12), bc#41)  predicting Function
   213:  skipped  < 0:->	MovHint(@212<Function>, loc13, W:SideState, bc#41)
   214:  skipped  < 0:->	SetLocal(@212<Function>, loc13(TC~<Function>/FlushedJSValue), W:Variables(-14), bc#50)
   215:           <!0:->	CheckStructure(Check:Cell:@212<Function>, MustGen|CanExit, [%AW:Function], R:JSCell_structureID, bc#50)
   216:           <!0:->	Phantom(@212<Function>, MustGen, bc#50)
   217:           < 1:->	WeakJSConstant(JS|UseAsOther, Function, 0x1250caef0 (%CK:Function), bc#50)
   218:  skipped  < 0:->	MovHint(@217<Function>, loc8, W:SideState, bc#50)
   219:  skipped  < 0:->	SetLocal(@217<Function>, loc8(UC~<Function>/FlushedJSValue), W:Variables(-9), bc#59)
   220:           < 1:->	JSConstant(JS|UseAsOther, Stringident, $7 = String (identifier): actions, ID: 5, bc#59)
   221:  skipped  < 0:->	MovHint(@220<StringIdent>, loc12, W:SideState, bc#59)
   222:           < 2:->	SetLocal(@220<StringIdent>, loc12(VC*<StringIdent>/FlushedJSValue), W:Variables(-13), bc#62)  predicting Stringident
   223:  skipped  < 0:->	MovHint(@199<Final>, loc11, W:SideState, bc#62)
   224:           < 2:->	SetLocal(@199<Final>, loc11(WC*<Final>/FlushedJSValue), W:Variables(-12), bc#65)  predicting Final
   225:           <!1:->	GetById(Cell:@199<Final>, JS|MustGen|Clobbers|UseAsOther|CanExit, Function, id14{updateRecordArrays}, R:World, W:World, bc#65)  predicting Function
   226:  skipped  < 0:->	MovHint(@225<Function>, loc10, W:SideState, bc#65)
   499:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#74)
   227:           < 2:->	SetLocal(@225<Function>, loc10(XC*<Function>/FlushedJSValue), W:Variables(-11), bc#74)  predicting Function
   228:           <!0:->	Phantom(@217<Function>, @212<Function>, MustGen, bc#74)
    --> schedule#DonjJQ:<0x125088970, bc#74, Call, known callee: Cell: 0x1250caef0 (%CK:Function), ID: 930, numArgs+this = 4, stack < loc19>
     229:           < 2:->	JSConstant(JS|UseAsOther, Other, $3 = Undefined, bc#0)
     230:  skipped  < 0:->	MovHint(@229<Other>, loc20, W:SideState, bc#0)
     231:  skipped  < 0:->	SetLocal(@229<Other>, loc20(YC*<Other>/FlushedJSValue), W:Variables(-21), bc#0)
     232:  skipped  < 0:->	MovHint(@229<Other>, loc21, W:SideState, bc#0)
     233:  skipped  < 0:->	SetLocal(@229<Other>, loc21(ZC*<Other>/FlushedJSValue), W:Variables(-22), bc#0)
     234:           < 2:->	JSConstant(JS|UseAsOther, Empty, $5 = <JSValue()>, bc#1)
     235:  skipped  < 0:->	MovHint(@234, loc21, W:SideState, bc#1)
     236:           <!0:->	Phantom(@229<Other>, MustGen, bc#3)
     237:           < 2:->	SetLocal(@234, loc21(AD*/FlushedJSValue), W:Variables(-22), bc#3)  predicting Empty
     238:  skipped  < 0:->	MovHint(@234, loc20, W:SideState, bc#3)
     239:           <!0:->	Phantom(@229<Other>, MustGen, bc#5)
     240:           < 2:->	SetLocal(@234, loc20(BD*/FlushedJSValue), W:Variables(-21), bc#5)  predicting Empty
     241:           <!0:->	FunctionReentryWatchpoint(MustGen, R:Watchpoint_fire, bc#6)
     242:           < 2:->	WeakJSConstant(JS|UseAsOther, Otherobj, 0x1231fd330 (%EL:JSActivation), bc#6)
     243:  skipped  < 0:->	MovHint(@242<Object>, loc23, W:SideState, bc#6)
     244:  skipped  < 0:->	SetLocal(@242<Object>, loc23(CD~<Object>/FlushedJSValue), W:Variables(-24), bc#12)
     245:           <!0:->	Phantom(@242<Object>, MustGen, bc#12)
     246:           <!0:->	VariableWatchpoint(MustGen|CanExit, 0x7ff931daf850, R:Watchpoint_fire, W:SideState, bc#12)
     247:           < 1:->	WeakJSConstant(JS|UseAsOther, Function, 0x1250cb830 (%CK:Function), bc#12)
     248:  skipped  < 0:->	MovHint(@247<Function>, loc22, W:SideState, bc#12)
     249:  skipped  < 0:->	SetLocal(@247<Function>, loc22(DD~<Function>/FlushedJSValue), W:Variables(-23), bc#20)
     250:           <!0:->	Phantom(@247<Function>, @242<Object>, MustGen, bc#20)
      --> checkAutoRun#Di3nk8:<0x125089070, bc#20, Call, known callee: Cell: 0x1250cb830 (%CK:Function), ID: 930, numArgs+this = 1, stack < loc29>
       251:  skipped  < 0:->	MovHint(@201<Object>, loc30, W:SideState, bc#1)
       252:  skipped  < 0:->	SetLocal(@201<Object>, loc30(ED~<Object>/FlushedJSValue), W:Variables(-31), bc#7)
       253:           <!0:->	StructureTransitionWatchpoint(Cell:@201<Object>, MustGen|CanExit, %Eg:Window, R:JSCell_structureID, bc#7)
       254:           <!0:->	Phantom(@201<Object>, MustGen, bc#7)
       255:           < 1:->	GetButterfly(Cell:@201<Object>, Storage|UseAsOther, Other, R:JSObject_butterfly, bc#7)
       256:           < 3:->	GetByOffset(@255<Other>, KnownCell:@201<Object>, JS|UseAsOther, Final, id2{Ember}, 141, R:NamedProperties(2), bc#7)  predicting Final
       257:  skipped  < 0:->	MovHint(@256<Final>, loc31, W:SideState, bc#7)
       258:  skipped  < 0:->	SetLocal(@256<Final>, loc31(FD~<Final>/FlushedJSValue), W:Variables(-32), bc#15)
       259:           <!0:->	CheckStructure(Check:Cell:@256<Final>, MustGen|CanExit, [%Bm:Object], R:JSCell_structureID, bc#15)
       260:           < 1:->	GetButterfly(Cell:@256<Final>, Storage|UseAsOther, Other, R:JSObject_butterfly, bc#15)
       261:           < 3:->	GetByOffset(@260<Other>, KnownCell:@256<Final>, JS|UseAsOther, Function, id12{run}, 211, R:NamedProperties(12), bc#15)  predicting Function
       262:  skipped  < 0:->	MovHint(@261<Function>, loc30, W:SideState, bc#15)
       263:  skipped  < 0:->	SetLocal(@261<Function>, loc30(GD~<Function>/FlushedJSValue), W:Variables(-31), bc#24)
       264:           <!0:->	CheckStructure(Check:Cell:@261<Function>, MustGen|CanExit, [%AW:Function], R:JSCell_structureID, bc#24)
       265:           < 1:->	GetButterfly(Cell:@261<Function>, Storage|UseAsOther, Other, R:JSObject_butterfly, bc#24)
       266:           < 1:->	GetByOffset(@265<Other>, KnownCell:@261<Function>, JS|UseAsOther, Final, id18{currentRunLoop}, 102, R:NamedProperties(18), bc#24)  predicting Final
       267:  skipped  < 0:->	MovHint(@266<Final>, loc30, W:SideState, bc#24)
       268:  skipped  < 0:->	SetLocal(@266<Final>, loc30(HD~<Final>/FlushedJSValue), W:Variables(-31), bc#33)
       269:           <!0:->	Branch(Check:ObjectOrOther:@266<Final>, MustGen|CanExit, T:#10, F:#9, W:SideState, bc#33)
  vars after: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP) loc1:(Final, TOP, TOP, TOP) loc8:(Function, TOP, TOP, TOP, Cell: 0x1250caef0 (%CK:Function), ID: 930) loc10:(Top, TOP, TOP, TOP) loc11:(Final, TOP, TOP, TOP) loc12:(Stringident, TOP, TOP, [%Dw:string], String (identifier): actions, ID: 5) loc13:(Function, TOP, TOP, [%AW:Function]) loc14:(Otherobj, NonArray, [%Eg:Window], [%Eg:Window], Cell: 0x11449d670 (%Eg:Window), ID: 11481) loc15:(Final, TOP, TOP, [%Bm:Object]) loc20:(Empty) loc21:(Empty) loc22:(Function, TOP, TOP, TOP, Cell: 0x1250cb830 (%CK:Function), ID: 930) loc23:(Otherobj, TOP, TOP, [%EL:JSActivation], Cell: 0x1231fd330 (%EL:JSActivation), ID: 1074) loc30:(ObjectOther, TOP, TOP, TOP) loc31:(Final, NonArray, [%Bm:Object], [%Bm:Object])
  var links: arg1:@461 arg0:@455 loc1:@199<Final> loc8:@219 loc10:@227 loc11:@224 loc12:@222 loc13:@214 loc14:@203 loc15:@209 loc20:@240 loc21:@237 loc22:@249 loc23:@244 loc30:@268 loc31:@258

Block #9 (bc#152 --> updateRecordArraysLater#ET1ozr:<0x124fdbf70> bc#74 --> schedule#DonjJQ:<0x125088970> bc#20 --> checkAutoRun#Di3nk8:<0x125089070> bc#36): 
  Predecessors: #8
  Dominated by: #0 #6 #8 #9
  Dominates: #9
  Phi Nodes: @475<1>->(@237), @444<1>->(@240), @481<1>->(@227), @466<1>->(@224), @450<1>->(@222), @474<1>->(@461), @454<1>->(@455)
  vars before: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP) loc10:(Top, TOP, TOP, TOP) loc11:(Final, TOP, TOP, TOP) loc12:(Stringident, TOP, TOP, [%Dw:string], String (identifier): actions, ID: 5) loc20:(Empty) loc21:(Empty)
  var links: arg1:@474 arg0:@454 loc10:@481 loc11:@466 loc12:@450 loc20:@444 loc21:@475
       270:           < 8:->	WeakJSConstant(JS|UseAsOther, Otherobj, 0x11449d670 (%Eg:Window), bc#36)
       271:  skipped  < 0:->	MovHint(@270<Object>, loc33, W:SideState, bc#36)
       272:  skipped  < 0:->	SetLocal(@270<Object>, loc33(ID~<Object>/FlushedJSValue), W:Variables(-34), bc#42)
       273:           <!0:->	ForceOSRExit(MustGen|CanExit, W:SideState, bc#42)
       274:           <!0:->	CheckStructure(Check:Cell:@270<Object>, MustGen|CanExit, [%C7:Window], R:JSCell_structureID, bc#42)
       275:           <!0:->	Phantom(@270<Object>, MustGen|CanExit, bc#42)
       276:           < 1:->	GetButterfly(Check:Cell:@270<Object>, Storage|UseAsOther|CanExit, Other, R:JSObject_butterfly, bc#42)
       277:           < 2:->	GetByOffset(@276<Other>, Check:KnownCell:@270<Object>, JS|UseAsOther|CanExit, id2{Ember}, 141, R:NamedProperties(2), bc#42)  predicting None
       278:  skipped  < 0:->	MovHint(@277, loc33, W:SideState, bc#42)
       279:  skipped  < 0:->	SetLocal(@277, CanExit, loc33(JD~/FlushedJSValue), W:Variables(-34), bc#50)
       280:           <!0:->	ForceOSRExit(MustGen|CanExit, W:SideState, bc#50)
       281:           <!1:->	GetById(@277, JS|MustGen|Clobbers|UseAsOther|CanExit, id19{assert}, R:World, W:World, bc#50)  predicting None
       282:  skipped  < 0:->	MovHint(@281, loc30, W:SideState, bc#50)
       495:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#59)
       283:  skipped  < 0:->	SetLocal(@281, CanExit, loc30(KD~/FlushedJSValue), W:Variables(-31), bc#59)
       284:           < 1:->	JSConstant(JS|UseAsOther, Stringident, $8 = String (identifier): You have turned on testing mode, which disabled the run-loop's autorun. You will need to wrap any code with asynchronous side-effects in an Ember.run, ID: 5, bc#59)
       285:  skipped  < 0:->	MovHint(@284<StringIdent>, loc32, W:SideState, bc#59)
       286:  skipped  < 0:->	SetLocal(@284<StringIdent>, CanExit, loc32(LD~<StringIdent>/FlushedJSValue), W:Variables(-33), bc#62)
       287:  skipped  < 0:->	MovHint(@270<Object>, loc34, W:SideState, bc#62)
       288:  skipped  < 0:->	SetLocal(@270<Object>, CanExit, loc34(MD~<Object>/FlushedJSValue), W:Variables(-35), bc#68)
       289:           <!0:->	ForceOSRExit(MustGen|CanExit, W:SideState, bc#68)
       290:           <!0:->	CheckStructure(Check:Cell:@270<Object>, MustGen|CanExit, [%C7:Window], R:JSCell_structureID, bc#68)
       291:           <!0:->	Phantom(@270<Object>, MustGen|CanExit, bc#68)
       292:           < 1:->	GetButterfly(Check:Cell:@270<Object>, Storage|UseAsOther|CanExit, Other, R:JSObject_butterfly, bc#68)
       293:           < 1:->	GetByOffset(@292<Other>, Check:KnownCell:@270<Object>, JS|UseAsOther|CanExit, id2{Ember}, 141, R:NamedProperties(2), bc#68)  predicting None
       294:  skipped  < 0:->	MovHint(@293, loc35, W:SideState, bc#68)
       295:  skipped  < 0:->	SetLocal(@293, CanExit, loc35(ND~/FlushedJSValue), W:Variables(-36), bc#76)
       296:           <!0:->	ForceOSRExit(MustGen|CanExit, W:SideState, bc#76)
       297:           <!1:->	GetById(@293, JS|MustGen|Clobbers|UseAsOther|CanExit, id20{testing}, R:World, W:World, bc#76)  predicting None
       298:  skipped  < 0:->	MovHint(@297, loc34, W:SideState, bc#76)
       496:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#85)
       299:  skipped  < 0:->	SetLocal(@297, CanExit, loc34(OD~/FlushedJSValue), W:Variables(-35), bc#85)
       300:           < 1:->	LogicalNot(@297, Boolean|UseAsOther|CanExit, Bool, bc#85)
       301:  skipped  < 0:->	MovHint(@300<Boolean>, loc31, W:SideState, bc#85)
       302:  skipped  < 0:->	SetLocal(@300<Boolean>, CanExit, loc31(PD~<Boolean>/FlushedJSValue), W:Variables(-32), bc#88)
       303:           <!0:->	ForceOSRExit(MustGen|CanExit, W:SideState, bc#88)
       304:           <!0:->	Call(@281, @277, @284<StringIdent>, @300<Boolean>, JS|MustGen|VarArgs|Clobbers|PureInt|CanExit, R:World, W:World, bc#88)  predicting None
       305:  skipped  < 0:->	MovHint(@304, loc30, W:SideState, bc#88)
       497:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#97)
       306:  skipped  < 0:->	SetLocal(@304, CanExit, loc30(QD~/FlushedJSValue), W:Variables(-31), bc#97)
       307:           <!0:->	Jump(MustGen|CanExit, T:#10, W:SideState, bc#97)
  vars after: 
  var links: arg1:@474 arg0:@454 loc10:@481 loc11:@466 loc12:@450 loc20:@444 loc21:@475 loc30:@306 loc31:@302 loc32:@286 loc33:@279 loc34:@299 loc35:@295

Block #10 (bc#152 --> updateRecordArraysLater#ET1ozr:<0x124fdbf70> bc#74 --> schedule#DonjJQ:<0x125088970> bc#20 --> checkAutoRun#Di3nk8:<0x125089070> bc#97): 
  Predecessors: #8 #9
  Dominated by: #0 #6 #8 #10
  Dominates: #10
  Phi Nodes: @476<2>->(@450, @222), @484<2>->(@466, @224), @473<2>->(@481, @227), @463<2>->(@444, @240), @471<1>->(@475, @237), @451<1>->(@474, @461), @459<1>->(@454, @455)
  vars before: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP) loc10:(Top, TOP, TOP, TOP) loc11:(Final, TOP, TOP, TOP) loc12:(Stringident, TOP, TOP, [%Dw:string], String (identifier): actions, ID: 5) loc20:(Empty) loc21:(Empty)
  var links: arg1:@451 arg0:@459 loc10:@473 loc11:@484 loc12:@365 loc20:@463 loc21:@401
       308:  skipped  < 0:->	JSConstant(JS|PureInt, Other, $3 = Undefined, bc#97)
       309:  skipped  < 0:->	MovHint(@308<Other>, loc22, W:SideState, bc#97)
       310:  skipped  < 0:->	SetLocal(@308<Other>, loc22(RD~<Other>/FlushedJSValue), W:Variables(-23), bc#97)
      <-- checkAutoRun#Di3nk8:<0x125089070, bc#20, Call, known callee: Cell: 0x1250cb830 (%CK:Function), ID: 930, numArgs+this = 1, stack < loc29>
     311:           <!0:->	FunctionReentryWatchpoint(MustGen, R:Watchpoint_fire, bc#29)
     312:           < 2:->	WeakJSConstant(JS|UseAsOther, Otherobj, 0x1231fd330 (%EL:JSActivation), bc#29)
     313:  skipped  < 0:->	MovHint(@312<Object>, loc22, W:SideState, bc#29)
     314:  skipped  < 0:->	SetLocal(@312<Object>, loc22(SD~<Object>/FlushedJSValue), W:Variables(-23), bc#35)
     315:           <!0:->	Phantom(@312<Object>, MustGen, bc#35)
     316:           <!0:->	VariableWatchpoint(MustGen|CanExit, 0x7ff931daff00, R:Watchpoint_fire, W:SideState, bc#35)
     317:           < 3:->	WeakJSConstant(JS|UseAsOther, Final, 0x1231fd070 (%EH:Object), bc#35)
     318:  skipped  < 0:->	MovHint(@317<Final>, loc23, W:SideState, bc#35)
     319:  skipped  < 0:->	SetLocal(@317<Final>, loc23(TD~<Final>/FlushedJSValue), W:Variables(-24), bc#43)
     320:           <!0:->	StructureTransitionWatchpoint(Cell:@317<Final>, MustGen|CanExit, %EH:Object, R:JSCell_structureID, bc#43)
     321:           < 1:->	WeakJSConstant(JS|UseAsOther, Final, 0x124f7db70 (%EF:Object), bc#43)
     322:           <!0:->	StructureTransitionWatchpoint(Cell:@321<Final>, MustGen|CanExit, %EF:Object, R:JSCell_structureID, bc#43)
     323:           <!0:->	Phantom(@317<Final>, MustGen, bc#43)
     324:           < 3:->	WeakJSConstant(JS|UseAsOther, Function, 0x1250cb230 (%CK:Function), bc#43)
     325:  skipped  < 0:->	MovHint(@324<Function>, loc22, W:SideState, bc#43)
     326:  skipped  < 0:->	SetLocal(@324<Function>, loc22(UD~<Function>/FlushedJSValue), W:Variables(-23), bc#52)
     327:           <!0:->	CheckStructure(Cell:@324<Function>, MustGen|CanExit, [%CK:Function], R:JSCell_structureID, bc#52)
     328:           < 1:->	WeakJSConstant(JS|UseAsOther, Otherobj, 0x1144cd810 (%BC:Function), bc#52)
     329:           <!0:->	StructureTransitionWatchpoint(Cell:@328<Object>, MustGen|CanExit, %BC:Function, R:JSCell_structureID, bc#52)
     330:           <!0:->	Phantom(@324<Function>, MustGen, bc#52)
     331:           < 1:->	WeakJSConstant(JS|UseAsOther, Function, 0x122bbe530 (%CC:Function), bc#52)
     332:  skipped  < 0:->	MovHint(@331<Function>, loc24, W:SideState, bc#52)
     333:  skipped  < 0:->	SetLocal(@331<Function>, loc24(VD~<Function>/FlushedJSValue), W:Variables(-25), bc#61)
     334:           <!0:->	Phantom(Cell:@331<Function>, MustGen, bc#61)
     337:  skipped  < 0:->	MovHint(@324<Function>, loc25, W:SideState, bc#65)
     338:  skipped  < 0:->	SetLocal(@324<Function>, loc25(XD~<Function>/FlushedJSValue), W:Variables(-26), bc#68)
     339:           <!0:->	FunctionReentryWatchpoint(MustGen, R:Watchpoint_fire, bc#68)
     341:  skipped  < 0:->	MovHint(@312<Object>, loc26, W:SideState, bc#68)
     342:  skipped  < 0:->	SetLocal(@312<Object>, loc26(YD~<Object>/FlushedJSValue), W:Variables(-27), bc#74)
     343:           <!0:->	Phantom(@312<Object>, MustGen, bc#74)
     344:           <!0:->	VariableWatchpoint(MustGen|CanExit, 0x7ff931daff00, R:Watchpoint_fire, W:SideState, bc#74)
     346:  skipped  < 0:->	MovHint(@317<Final>, loc27, W:SideState, bc#74)
     347:  skipped  < 0:->	SetLocal(@317<Final>, loc27(ZD~<Final>/FlushedJSValue), W:Variables(-28), bc#82)
     349:  skipped  < 0:->	MovHint(@317<Final>, loc31, W:SideState, bc#82)
     350:  skipped  < 0:->	SetLocal(@317<Final>, loc31(AE~<Final>/FlushedJSValue), W:Variables(-32), bc#82)
     365:           <!0:->	PhantomLocal(@476, MustGen, loc12(VC*<StringIdent>/FlushedJSValue), W:SideState, bc#82)  predicting Stringident
     351:           < 1:->	JSConstant(JS|UseAsOther, Stringident, $7 = String (identifier): actions, ID: 5, bc#82)
     352:  skipped  < 0:->	MovHint(@351<StringIdent>, loc30, W:SideState, bc#82)
     353:  skipped  < 0:->	SetLocal(@351<StringIdent>, loc30(CE~<StringIdent>/FlushedJSValue), W:Variables(-31), bc#82)
     354:           < 1:->	GetLocal(@484, JS|UseAsOther, Final, loc11(WC*<Final>/FlushedJSValue), R:Variables(-12), bc#82)  predicting Final
     355:  skipped  < 0:->	MovHint(@354<Final>, loc29, W:SideState, bc#82)
     356:  skipped  < 0:->	SetLocal(@354<Final>, loc29(EE~<Final>/FlushedJSValue), W:Variables(-30), bc#82)
     357:           < 1:->	GetLocal(@473, JS|UseAsOther, Function, loc10(XC*<Function>/FlushedJSValue), R:Variables(-11), bc#82)  predicting Function
     358:  skipped  < 0:->	MovHint(@357<Function>, loc28, W:SideState, bc#82)
     359:  skipped  < 0:->	SetLocal(@357<Function>, loc28(GE~<Function>/FlushedJSValue), W:Variables(-29), bc#82)
     360:           <!0:->	Call(@324<Function>, @317<Final>, @351<StringIdent>, @354<Final>, @357<Function>, JS|MustGen|VarArgs|Clobbers|PureInt|CanExit, Final, R:World, W:World, bc#82)  predicting Final
     361:  skipped  < 0:->	MovHint(@360<Final>, loc23, W:SideState, bc#82)
     494:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#91)
     362:  skipped  < 0:->	SetLocal(@360<Final>, loc23(HE~<Final>/FlushedJSValue), W:Variables(-24), bc#91)
     394:           < 1:->	GetLocal(@463, JS|UseAsOther, Empty, loc20(BD*/FlushedJSValue), R:Variables(-21), bc#124)  predicting Empty
     395:  skipped  < 0:->	JSConstant(JS|UseAsOther, Empty, $5 = <JSValue()>, bc#124)
     396:           <!0:->	Phantom(@394, MustGen, bc#124)
     397:           <!0:->	Flush(@473, MustGen, loc10(XC*<Function>/FlushedJSValue), W:SideState, bc#127)  predicting Function
     398:           <!0:->	Flush(@484, MustGen, loc11(WC*<Final>/FlushedJSValue), W:SideState, bc#127)  predicting Final
     399:           <!0:->	Flush(@476, MustGen, loc12(VC*<StringIdent>/FlushedJSValue), W:SideState, bc#127)  predicting Stringident
     400:           <!0:->	Flush(@463, MustGen, loc20(BD*/FlushedJSValue), W:SideState, bc#127)  predicting Empty
     401:           <!0:->	Flush(@471, MustGen, loc21(AD*/FlushedJSValue), W:SideState, bc#127)  predicting Empty
     403:  skipped  < 0:->	MovHint(@308<Other>, loc8, W:SideState, bc#127)
     404:  skipped  < 0:->	SetLocal(@308<Other>, loc8(YE~<Other>/FlushedJSValue), W:Variables(-9), bc#127)
    <-- schedule#DonjJQ:<0x125088970, bc#74, Call, known callee: Cell: 0x1250caef0 (%CK:Function), ID: 930, numArgs+this = 4, stack < loc19>
   405:  skipped  < 0:->	MovHint(@308<Other>, loc0, W:SideState, bc#83)
   406:  skipped  < 0:->	SetLocal(@308<Other>, loc0(ZE~<Other>/FlushedJSValue), W:Variables(-1), bc#83)
   407:           <!0:->	Jump(MustGen, T:#14, W:SideState, bc#83)
  vars after: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP) loc0:(Other, Undefined) loc8:(Other, Undefined) loc10:(Top, TOP, TOP, TOP) loc11:(Top, TOP, TOP, TOP) loc12:(Top, TOP, TOP, TOP) loc20:(TopEmpty, TOP, TOP, TOP) loc21:(TopEmpty, TOP, TOP, TOP) loc22:(Function, TOP, TOP, TOP, Cell: 0x1250cb230 (%CK:Function), ID: 930) loc23:(Top, TOP, TOP, TOP) loc24:(Function, TOP, TOP, [%CC:Function], Cell: 0x122bbe530 (%CC:Function), ID: 957) loc25:(Function, TOP, TOP, TOP, Cell: 0x1250cb230 (%CK:Function), ID: 930) loc26:(Otherobj, TOP, TOP, [%EL:JSActivation], Cell: 0x1231fd330 (%EL:JSActivation), ID: 1074) loc27:(Final, TOP, TOP, [%EH:Object], Cell: 0x1231fd070 (%EH:Object), ID: 8382) loc28:(Top, TOP, TOP, TOP) loc29:(Final, TOP, TOP, TOP) loc30:(Stringident, TOP, TOP, [%Dw:string], String (identifier): actions, ID: 5) loc31:(Final, TOP, TOP, [%EH:Object], Cell: 0x1231fd070 (%EH:Object), ID: 8382)
  var links: arg1:@451 arg0:@459 loc0:@406 loc8:@404 loc10:@357<Function> loc11:@354<Final> loc12:@365 loc20:@394 loc21:@401 loc22:@326 loc23:@362 loc24:@333 loc25:@338 loc26:@342 loc27:@347 loc28:@359 loc29:@356 loc30:@353 loc31:@350

Block #14 (bc#161): 
  Predecessors: #7 #10
  Dominated by: #0 #6 #14
  Dominates: #14 #15 #16
  Phi Nodes: @443<3>->(@451, @452), @477<1>->(@459, @453)
  vars before: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP)
  var links: arg1:@443 arg0:@477
  <-- updateRecordArraysLater#ET1ozr:<0x124fdbf70, bc#152, Call, known callee: Cell: 0x124f87b70 (%CK:Function), ID: 930, numArgs+this = 1, stack < loc7>
 408:           < 1:->	GetLocal(@443, JS|UseAsOther, Other, arg1(B~<Other>/FlushedJSValue), R:Variables(7), bc#161)  predicting Other
 409:           <!0:->	Branch(ObjectOrOther:@408<Other>, MustGen|CanExit, T:#16, F:#15, W:SideState, bc#161)
  vars after: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP)
  var links: arg1:@408<Other> arg0:@477

Block #15 (bc#164): 
  Predecessors: #14
  Dominated by: #0 #6 #14 #15
  Dominates: #15
  Phi Nodes: @445<1>->(@443)
  vars before: arg1:(ObjectOther, TOP, TOP, TOP)
  var links: arg1:@410
 410:           <!0:->	Flush(@445, MustGen, arg1(B~<Other>/FlushedJSValue), W:SideState, bc#164)  predicting Other
 411:           < 1:->	JSConstant(JS|UseAsOther, Other, $3 = Undefined, bc#164)
 412:           <!0:->	Return(@411<Other>, MustGen, W:SideState, bc#164)
  vars after: 
  var links: arg1:@410

Block #16 (bc#166): 
  Predecessors: #14
  Dominated by: #0 #6 #14 #16
  Dominates: #16
  Phi Nodes: @446<1>->(@477), @447<1>->(@443)
  vars before: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP)
  var links: arg1:@427 arg0:@446
 413:           < 2:->	GetLocal(@446, JS|UseAsOther, Final, arg0(C<Final>/FlushedCell), R:Variables(6), bc#166)  predicting Final
 414:  skipped  < 0:->	MovHint(@413<Final>, loc3, W:SideState, bc#166)
 415:  skipped  < 0:->	SetLocal(@413<Final>, loc3(DF~<Final>/FlushedJSValue), W:Variables(-4), bc#169)
 416:           <!0:->	ForceOSRExit(MustGen|CanExit, W:SideState, bc#169)
 417:           <!1:->	GetById(Check:Cell:@413<Final>, JS|MustGen|Clobbers|UseAsOther|CanExit, id7{suspendRelationshipObservers}, R:World, W:World, bc#169)  predicting None
 418:  skipped  < 0:->	MovHint(@417, loc0, W:SideState, bc#169)
 492:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#178)
 419:  skipped  < 0:->	SetLocal(@417, CanExit, loc0(EF~/FlushedJSValue), W:Variables(-1), bc#178)
 420:           < 1:->	NewFunctionExpression(JS|UseAsOther|CanExit, Function, #<nogen>/<nogen>:[0x122b9d570], R:GCState,BarrierState, W:GCState,BarrierState, bc#178)
 421:  skipped  < 0:->	MovHint(@420<Function>, loc2, W:SideState, bc#178)
 422:  skipped  < 0:->	SetLocal(@420<Function>, CanExit, loc2(FF~<Function>/FlushedJSValue), W:Variables(-3), bc#181)
 423:           <!0:->	ForceOSRExit(MustGen|CanExit, W:SideState, bc#181)
 424:           <!0:->	Call(@417, @413<Final>, @420<Function>, JS|MustGen|VarArgs|Clobbers|PureInt|CanExit, R:World, W:World, bc#181)  predicting None
 425:  skipped  < 0:->	MovHint(@424, loc0, W:SideState, bc#181)
 493:           <!0:->	InvalidationPoint(MustGen|CanExit, W:SideState, bc#190)
 426:  skipped  < 0:->	SetLocal(@424, CanExit, loc0(GF~/FlushedJSValue), W:Variables(-1), bc#190)
 427:           <!0:->	Flush(@447, MustGen, arg1(B~<Other>/FlushedJSValue), W:SideState, bc#190)  predicting Other
 428:           < 1:->	JSConstant(JS|UseAsOther, Other, $3 = Undefined, bc#190)
 429:           <!0:->	Return(@428<Other>, MustGen|CanExit, W:SideState, bc#190)
  vars after: 
  var links: arg1:@427 arg0:@413<Final> loc0:@426 loc2:@422 loc3:@415

Structures:
    %AW:Function     = 0x12506d4f0:[Function, {join:100=>0x1250cafb0, backburner:101, currentRunLoop:102, queues:103, begin:104=>0x1250caf70, end:105=>0x1250caf30, schedule:106=>0x1250caef0, hasScheduledTimers:107=>0x1250caeb0, cancelTimers:108=>0x1250cae70, sync:109=>0x1250cae30, later:110=>0x1250cadf0, once:111=>0x1250cadb0, scheduleOnce:112=>0x1250cad70, next:113=>0x1250cad30, cancel:114=>0x1250cacf0, debounce:115=>0x1250cacb0, throttle:116=>0x1250cac70}, NonArray, Proto:0x1144cd810]
    %BB:Object       = 0x122ba9c70:[Object, {}, NonArray, Proto:0x1140eee20]
    %BC:Function     = 0x124f9f670:[Function, {name:100, length:101, toString:102=>0x122bbe570, apply:103=>0x122bbe530, call:104=>0x122bbe4f0, bind:105=>0x122bbe4b0, constructor:106=>0x1144cd770, property:107=>0x1250c47b0, observes:108=>0x1250c4770, observesImmediately:109=>0x1250c4730, observesBefore:110=>0x1250c46f0, on:111=>0x1250c46b0}, NonArray, Proto:0x1140eee20]
    %Bm:Object       = 0x1253e93f0:[Object, {ENV:0, assert:1=>0x1250cf8b0, warn:100=>0x1250cf870, debug:101=>0x1250cf830, deprecate:102=>0x1250cf7f0, deprecateFunc:103=>0x1250cf7b0, imports:104, exports:105, lookup:106, isNamespace:107, toString:108=>0x1250cf630, VERSION:109, config:110, FEATURES:111, EXTEND_PROTOTYPES:112, LOG_STACKTRACE_ON_DEPRECATION:113, SHIM_ES5:114, LOG_VERSION:115, K:116=>0x1250cf5b0, uuid:117, merge:118=>0x1250cf570, isNone:119=>0x1250cf530, none:120=>0x1250cf4f0, isEmpty:121=>0x1250cf4b0, empty:122=>0x1250cf470, platform:123, create:124=>0x1250cf3f0, ArrayPolyfills:125, Error:126=>0x1250cf130, onerror:127, handleErrors:128=>0x1250cf0f0, GUID_PREFIX:129, GUID_KEY:130, generateGuid:131=>0x1250ceff0, guidFor:132=>0x1250cefb0, META_KEY:133, EMPTY_META:134, meta:135=>0x1250cef70, getMeta:136=>0x1250cef30, setMeta:137=>0x1250ceef0, metaPath:138=>0x1250ceeb0, wrap:139=>0x1250cee70, isArray:140=>0x1250cee30, makeArray:141=>0x1250cedf0, canInvoke:142=>0x1250cf030, tryInvoke:143=>0x1250cedb0, tryFinally:144=>0x1250ced30, tryCatchFinally:145=>0x1250cecf0, typeOf:146=>0x1250cec70, Instrumentation:147, instrument:148=>0x1250ceb30, subscribe:149=>0x1250ceaf0, EnumerableUtils:150, normalizeTuple:151=>0x1250ce730, _getPath:152=>0x1250ce6f0, getWithDefault:153=>0x1250ce6b0, get:154=>0x1250ce770, on:155=>0x1250ce570, addListener:156=>0x1250ce530, removeListener:157=>0x1250ce5b0, _suspendListener:158=>0x1250ce4f0, _suspendListeners:159=>0x1250ce4b0, sendEvent:160=>0x1250ce470, hasListeners:161=>0x1250ce430, watchedEvents:162=>0x1250ce3f0, listenersFor:163=>0x1250ce3b0, listenersDiff:164=>0x1250ce370, listenersUnion:165=>0x1250ce330, _ObserverSet:166=>0x1250ce2b0, propertyWillChange:167=>0x1250ce170, propertyDidChange:168=>0x1250ce130, overrideChains:169=>0x1250cdeb0, beginPropertyChanges:170=>0x1250cdfb0, endPropertyChanges:171=>0x1250cdf70, changeProperties:172=>0x1250cde70, set:173=>0x1250cddb0, trySet:174=>0x1250cdd70, OrderedSet:175=>0x1250cdc70, Map:176=>0x1250cd9f0, MapWithDefault:177=>0x1250cd7f0, Logger:178, Descriptor:179=>0x1250cd4b0, MANDATORY_SETTER_FUNCTION:180=>0x1250cd470, DEFAULT_GETTER_FUNCTION:181=>0x1250cd430, defineProperty:182=>0x1250cd3f0, getProperties:183=>0x1250cd370, setProperties:184=>0x1250cd2f0, watchKey:185=>0x1250cd270, unwatchKey:186=>0x1250cd230, flushPendingChains:187=>0x1250cd0f0, removeChainWatcher:188=>0x1250cd0b0, _ChainNode:189=>0x1250cd070, finishChains:190=>0x1250ccd70, watchPath:191=>0x1250ccc70, unwatchPath:192=>0x1250ccc30, watch:193=>0x1250ccb70, isWatching:194=>0x1250ccb30, unwatch:195=>0x1250ccaf0, rewatch:196=>0x1250ccab0, destroy:197=>0x1250cca70, ComputedProperty:198=>0x1250cc8f0, computed:199=>0x1250cc5f0, cacheFor:200=>0x1250cc5b0, addObserver:201=>0x1250cbbf0, observersFor:202=>0x1250cbbb0, removeObserver:203=>0x1250cbb70, addBeforeObserver:204=>0x1250cbb30, _suspendBeforeObserver:205=>0x1250cbaf0, _suspendObserver:206=>0x1250cbab0, _suspendBeforeObservers:207=>0x1250cba70, _suspendObservers:208=>0x1250cba30, beforeObserversFor:209=>0x1250cb9f0, removeBeforeObserver:210=>0x1250cb9b0, run:211=>0x1250caff0, LOG_BINDINGS:212, isGlobalPath:213=>0x1250cabb0, Binding:214=>0x1250cab70, bind:215=>0x1250ca770, oneWay:216=>0x1250ca730, IS_BINDING:217, mixin:218=>0x1250ca1b0, Mixin:219=>0x1250ca170, anyUnprocessedMixins:220, required:221=>0x1250c9eb0, alias:222=>0x1250c9e30, aliasMethod:223=>0x1250c9df0, observer:224=>0x1250c9db0, immediateObserver:225=>0x1250c9d70, beforeObserver:226=>0x1250c9d30, libraries:227, MODEL_FACTORY_INJECTIONS:228, compare:229=>0x1250c9430, copy:230=>0x1250c93f0, inspect:231=>0x1250c93b0, isEqual:232=>0x1250c9370, ORDER_DEFINITION:233, keys:234=>0x1250c9330, STRINGS:235, String:236, Observable:237, CoreObject:238=>0x1250c87f0, Object:239=>0x1250c81f0, Namespace:240=>0x1250c7d30, NAME_KEY:241, ObjectProxy:242=>0x1250c78f0, Enumerable:243, Array:244, ReduceComputedProperty:245=>0x1250c66f0, reduceComputed:246=>0x1250c5f70, ArrayComputedProperty:247=>0x1250c5ef0, arrayComputed:248=>0x1250c5df0, RSVP:249, Comparable:250, Copyable:251, Freezable:252, FROZEN_ERROR:253, MutableEnumerable:254, MutableArray:255, TargetActionSupport:256, Evented:257, DeferredMixin:258, ActionHandler:259, PromiseProxyMixin:260, TrackedArray:261=>0x1250c35f0, SubArray:262=>0x1250c3330, Container:263=>0x1250c3130, Application:264, ArrayProxy:265=>0x1250c1eb0, EachProxy:266=>0x1250c1730, NativeArray:267, A:268, Set:269=>0x124f0fef0, Deferred:270=>0x124f0fcf0, onLoad:271=>0x124f0fab0, runLoadHooks:272=>0x124f0fa70, ControllerMixin:273, Controller:274=>0x124f0f8b0, SortableMixin:275, ArrayController:276=>0x124f0f130, ObjectController:277=>0x124f0ef30, $:278=>0x122bbb030, ViewUtils:279, RenderBuffer:280=>0x124f0e870, _RenderBuffer:281=>0x124f0e830, EventDispatcher:282=>0x124f0e1f0, TEMPLATES:283, CoreView:284=>0x124f0db70, _ViewCollection:285=>0x124f0d9b0, View:286=>0x124f0c7b0, ContainerView:287=>0x124f0af30, CollectionView:288=>0x124f0aa30, Component:289=>0x124f0a6b0, ViewTargetActionSupport:290, Handlebars:291, _Metamorph:292, _MetamorphView:293=>0x124f092b0, _SimpleMetamorphView:294=>0x124f090f0, _SimpleHandlebarsView:295=>0x124f08ef0, _HandlebarsBoundView:296=>0x124f08bf0, Checkbox:297=>0x124f078b0, TextSupport:298, TextField:299=>0x124f073f0, Button:300=>0x124f06ef0, TextArea:301=>0x124f06c70, SelectOption:302=>0x124f06930, SelectOptgroup:303=>0x124f06770, Select:304=>0x124f061b0, ComponentLookup:305=>0x124f05eb0, RouterDSL:306=>0x124f05a30, controllerFor:307=>0x124f05830, generateControllerFactory:308=>0x124f057f0, generateController:309=>0x124f057b0, Router:310=>0x124f036f0, Route:311=>0x124f02c30, LinkView:312=>0x124f02430, Location:313, NoneLocation:314=>0x124f01770, HashLocation:315=>0x124f013b0, HistoryLocation:316=>0x124f00ef0, DAG:317=>0x124f00c30, DefaultResolver:318=>0x124f00730, DataAdapter:319=>0x124f8f1b0, Test:320, StateManager:321, State:322, Date:323, Inflector:324=>0x124f847b0, __ember1394517308446_name:325, BOOTED:326}, NonArray, Proto:0x1140eee20]
    %C7:Window       = 0x12538a870:[Window, {Object:100=>0x1144cd790, Function:101=>0x1144cd770, Array:102=>0x1144cd750, RegExp:103=>0x122aef970, EvalError:104=>0x1144cd610, RangeError:105=>0x1144cd5f0, ReferenceError:106=>0x1144cd5d0, SyntaxError:107=>0x1144cd5b0, TypeError:108=>0x1144cd590, URIError:109=>0x1144cd570, Promise:110=>0x1144cd550, Set:111=>0x1144cd730, Map:112=>0x1144cd710, Date:113=>0x1144cd6f0, String:114=>0x1144cd6d0, Boolean:115=>0x1144cd6b0, Number:116=>0x1144cd690, Error:117=>0x1144cd670, ArrayBuffer:118=>0x1144cd650, WeakMap:119=>0x1144cd630, ArrayIterator:120, ArgumentsIterator:121, MapIterator:122, SetIterator:123, eval:124=>0x122bbcb30, JSON:125, Math:126, DataView:127=>0x1144cd410, Float64Array:128=>0x1144cd430, Float32Array:129=>0x1144cd450, Uint32Array:130=>0x1144cd470, Int32Array:131=>0x1144cd4f0, Uint16Array:132=>0x1144cd490, Int16Array:133=>0x1144cd510, Uint8ClampedArray:134=>0x1144cd4b0, Uint8Array:135=>0x1144cd4d0, Int8Array:136=>0x1144cd530, console:137, doNotTrack:138, $:139=>0x122bbb030, jQuery:140=>0x122bbb030, Ember:141, Em:142, MetamorphENV:143, DS:144, Todos:145, parseFloat:146=>0x1253ce7f0}, NonArray, Proto:0x1140eee30]
    %CC:Function     = 0x122b5aaf0:[Function, {name:100, length:101}, NonArray, Proto:0x1144cd810]
    %CK:Function     = 0x122b5acf0:[Function, {}, NonArray, Proto:0x1144cd810]
    %Dw:string       = 0x1140afd70:[string, {}, NonArray]
    %EF:Object       = 0x12506e370:[Object, {queueNames:0, options:1, currentInstance:2, instanceStack:3, begin:4=>0x1250cb2f0, end:5=>0x1250cb2b0, run:6=>0x1250cb270, defer:7=>0x1250cb230, deferOnce:8=>0x1250cb1f0, setTimeout:9=>0x1250cb1b0, throttle:10=>0x1250cb170, debounce:11=>0x1250cb130, cancelTimers:12=>0x1250cb0f0, hasTimers:13=>0x1250cb0b0, cancel:14=>0x1250cb070, _cancelItem:15=>0x1250cb030, schedule:16=>0x1250cb230, scheduleOnce:17=>0x1250cb1f0, later:18=>0x1250cb1b0}, NonArray, Proto:0x1140eee20]
    %EH:Object       = 0x125387270:[Object, {queueNames:0, options:1, instanceStack:2, currentInstance:3}, NonArray, Proto:0x124f7db70]
    %EL:JSActivation = 0x122b57370:[JSActivation, {}, NonArray]
    %Eg:Window       = 0x1261e1270:[Window, {Object:100=>0x1144cd790, Function:101=>0x1144cd770, Array:102=>0x1144cd750, RegExp:103=>0x122aef970, EvalError:104=>0x1144cd610, RangeError:105=>0x1144cd5f0, ReferenceError:106=>0x1144cd5d0, SyntaxError:107=>0x1144cd5b0, TypeError:108=>0x1144cd590, URIError:109=>0x1144cd570, Promise:110=>0x1144cd550, Set:111=>0x1144cd730, Map:112=>0x1144cd710, Date:113=>0x1144cd6f0, String:114=>0x1144cd6d0, Boolean:115=>0x1144cd6b0, Number:116=>0x1144cd690, Error:117=>0x1144cd670, ArrayBuffer:118=>0x1144cd650, WeakMap:119=>0x1144cd630, ArrayIterator:120, ArgumentsIterator:121, MapIterator:122, SetIterator:123, eval:124=>0x122bbcb30, JSON:125, Math:126, DataView:127=>0x1144cd410, Float64Array:128=>0x1144cd430, Float32Array:129=>0x1144cd450, Uint32Array:130=>0x1144cd470, Int32Array:131=>0x1144cd4f0, Uint16Array:132=>0x1144cd490, Int16Array:133=>0x1144cd510, Uint8ClampedArray:134=>0x1144cd4b0, Uint8Array:135=>0x1144cd4d0, Int8Array:136=>0x1144cd530, console:137, doNotTrack:138, $:139=>0x122bbb030, jQuery:140=>0x122bbb030, Ember:141, Em:142, MetamorphENV:143, DS:144, Todos:145, parseFloat:146=>0x1253ce7f0, parseInt:147=>0x1253ccbf0, jQuery210069062883779406550.007350960746407509:148, isNaN:149=>0x1253c14f0}, NonArray, Proto:0x1140eee30]

ASSERTION FAILED: node->op() == Phi || node->op() == SetArgument
/Volumes/Data/WebKit-svn-01/OpenSource/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp(266) : void JSC::DFG::DCEPhase::cleanVariables(VariablesVectorType &) [VariablesVectorType = JSC::Operands<JSC::DFG::Node *, JSC::DFG::NodePointerTraits>]
1   0x117eca8a0 WTFCrash
2   0x1179604fe void JSC::DFG::DCEPhase::cleanVariables<JSC::Operands<JSC::DFG::Node*, JSC::DFG::NodePointerTraits> >(JSC::Operands<JSC::DFG::Node*, JSC::DFG::NodePointerTraits>&)
3   0x11795fd40 JSC::DFG::DCEPhase::fixupBlock(JSC::DFG::BasicBlock*)
4   0x11795f89e JSC::DFG::DCEPhase::run()
5   0x11795ea75 bool JSC::DFG::runAndLog<JSC::DFG::DCEPhase>(JSC::DFG::DCEPhase&)
6   0x11795e9fe bool JSC::DFG::runPhase<JSC::DFG::DCEPhase>(JSC::DFG::Graph&)
7   0x11795e9b8 JSC::DFG::performDCE(JSC::DFG::Graph&)
8   0x117a14b60 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&)
9   0x117a14294 JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*)
10  0x117ab76e0 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*)
11  0x117ab6334 JSC::DFG::Worklist::threadFunction(void*)
12  0x117f1a0c0 WTF::threadEntryPoint(void*)
13  0x117f1ad48 WTF::wtfThreadEntryPoint(void*)
14  0x7fff8c43b899 _pthread_body
15  0x7fff8c43b72a _pthread_struct_init
16  0x7fff8c43ffc9 thread_start
^C[31] $ LEAK: 1 WebPage
LEAK: 1 WebFrame
LEAK: 35692 WebCoreNode
LEAK: 15 CachedResource
Comment 5 Filip Pizlo 2014-03-10 23:01:29 PDT
Thanks guys!  I'm looking at this now...
Comment 6 Filip Pizlo 2014-03-10 23:09:35 PDT
I believe that the key issue is that the GetLocal corresponds to a captured variable.
Comment 7 Filip Pizlo 2014-03-10 23:51:27 PDT
Created attachment 226394 [details]
the patch
Comment 8 Geoffrey Garen 2014-03-11 09:42:07 PDT
Comment on attachment 226394 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=226394&action=review

r=me

> Source/JavaScriptCore/dfg/DFGDCEPhase.cpp:264
> +                    // but we shouldn't bother.

Not sure what you meant by "we shouldn't bother".
Comment 9 Ryosuke Niwa 2014-03-11 19:06:17 PDT
Comment on attachment 226394 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=226394&action=review

> Source/JavaScriptCore/dfg/DFGDCEPhase.cpp:265
> +                    m_graph.dethread();

So Graph::dethread sets m_form to LoadStore. This results in an assertion failure inside fixupBlock for subsequent blocks
because we're assuming that m_grpah.m_form is either SSA or ThreadedCPS in that function.

We probably need to break out of the loop inside run() that iterates over code blocks when we're dethreading.
Comment 10 Filip Pizlo 2014-03-11 19:07:20 PDT
(In reply to comment #9)
> (From update of attachment 226394 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=226394&action=review
> 
> > Source/JavaScriptCore/dfg/DFGDCEPhase.cpp:265
> > +                    m_graph.dethread();
> 
> So Graph::dethread sets m_form to LoadStore. This results in an assertion failure inside fixupBlock for subsequent blocks
> because we're assuming that m_grpah.m_form is either SSA or ThreadedCPS in that function.
> 
> We probably need to break out of the loop inside run() that iterates over code blocks when we're dethreading.

No, we just need to add a "case LoadStore:" in fixupBlock.  That case can fall through to ThreadedCPS.
Comment 11 Filip Pizlo 2014-03-11 21:26:59 PDT
Comment on attachment 226394 [details]
the patch

This is the wrong approach.  Better patch coming shortly...
Comment 12 Filip Pizlo 2014-03-11 21:47:25 PDT
Created attachment 226471 [details]
the patch
Comment 13 Ryosuke Niwa 2014-03-11 21:52:46 PDT
Comment on attachment 226471 [details]
the patch

Looks like this patch is missing a change log entry.
Comment 14 Filip Pizlo 2014-03-11 21:56:01 PDT
Created attachment 226472 [details]
the patch
Comment 15 Geoffrey Garen 2014-03-12 09:41:16 PDT
Comment on attachment 226472 [details]
the patch

r=me
Comment 16 Filip Pizlo 2014-03-12 18:51:25 PDT
Landed in http://trac.webkit.org/changeset/165522