Bug 148239
| Summary: | Rare failure in regress/script-tests/sink-huge-activation.js.ftl-eager | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Filip Pizlo <fpizlo> |
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> |
| Status: | NEW | ||
| Severity: | Normal | CC: | basile_clement |
| Priority: | P2 | ||
| Version: | Other | ||
| Hardware: | All | ||
| OS: | All | ||
Filip Pizlo
Here's the text of the failure. I wasn't able to reproduce it. It was a debug build.
At @53: validation failed: !edge->isPhantomAllocation() (/Volumes/Data/tertiary/OpenSource/Source/JavaScriptCore/dfg/DFGValidate.cpp:562).
At time of failure:
DFG for foo#<no-hash>:[0x1046dab90->0x1046da250->0x104487b00, DFGFunctionCall, 205 (NeverInline)]:
Fixpoint state: FixpointConverged; Form: SSA; Unification state: GloballyUnified; Ref count state: ExactRefCount
Argument formats: FlushedJSValue, FlushedBoolean
Block #0 (<none>): (OSR target)
Execution count: 1.000000
Predecessors:
Successors: #1 (ForwardEdge) #2 (ForwardEdge)
Dominated by: #0
Dominates: #0 #1 #2
Dominance Frontier:
Iterated Dominance Frontier:
Pre/Post Numbering: 0/2
States: StructuresAreWatched
Availability: {locals = arg1:arg1:FlushedBoolean/Unavailable arg0:this:FlushedJSValue/Unavailable; heap = }
Live:
Values:
118:< 2:-> JSConstant(JS|PureInt, Othercell, Strong:Cell: 0x10446c790 (%CC:SymbolTable), ID: 19)
119:< 20:-> JSConstant(JS|PureInt, Other, Undefined)
49:< 2:-> JSConstant(JS|UseAsOther, Function, Weak:Cell: 0x104458ca0 (%CG:Function), ID: 39)
12:< 5:-> JSConstant(JS|UseAsOther, Otherobj, Weak:Cell: 0x104443800 (%Ak:global), ID: 413)
22:< 42:-> JSConstant(JS|UseAsOther, Boolint32, Int32: 0)
101:< 1:-> GetStack(JS|PureInt, Bool, arg1, machine:arg1, FlushedBoolean, R:Stack(6), bc#0)
102:<!0:-> KillStack(MustGen, loc0, W:SideState, bc#0)
3:<!0:-> ZombieHint(MustGen, loc0, W:SideState, bc#0)
103:<!0:-> KillStack(MustGen, loc1, W:SideState, bc#0)
5:<!0:-> ZombieHint(MustGen, loc1, W:SideState, bc#0)
104:<!0:-> KillStack(MustGen, loc2, W:SideState, bc#0)
7:<!0:-> ZombieHint(MustGen, loc2, W:SideState, bc#0)
105:<!0:-> KillStack(MustGen, loc3, W:SideState, bc#0)
9:<!0:-> ZombieHint(MustGen, loc3, W:SideState, bc#0)
106:<!0:-> KillStack(MustGen, loc0, W:SideState, bc#1)
13:<!0:-> MovHint(@12, MustGen, loc0, W:SideState, bc#1)
107:<!0:-> KillStack(MustGen, loc1, W:SideState, bc#3)
15:<!0:-> ZombieHint(MustGen, loc1, W:SideState, bc#3)
17:<!45:-> PhantomCreateActivation(JS|MustGen|UseAsOther, Otherobj, R:HeapObjectCount, W:HeapObjectCount, bc#6)
120:<!0:-> PutHint(@17, @118, MustGen, ActivationSymbolTablePLoc(0), W:SideState, bc#6)
121:<!0:-> PutHint(@17, @12, MustGen, ActivationScopePLoc(0), W:SideState, bc#6)
122:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(0), W:SideState, bc#6)
123:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(1), W:SideState, bc#6)
124:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(2), W:SideState, bc#6)
125:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(3), W:SideState, bc#6)
126:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(4), W:SideState, bc#6)
127:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(5), W:SideState, bc#6)
128:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(6), W:SideState, bc#6)
129:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(7), W:SideState, bc#6)
130:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(8), W:SideState, bc#6)
131:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(9), W:SideState, bc#6)
132:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(10), W:SideState, bc#6)
133:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(11), W:SideState, bc#6)
134:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(12), W:SideState, bc#6)
135:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(13), W:SideState, bc#6)
136:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(14), W:SideState, bc#6)
137:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(15), W:SideState, bc#6)
138:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(16), W:SideState, bc#6)
139:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(17), W:SideState, bc#6)
140:<!0:-> PutHint(@17, @119, MustGen, ClosureVarPLoc(18), W:SideState, bc#6)
141:<!0:-> PutHint(@17, Kill:@119, MustGen, ClosureVarPLoc(19), W:SideState, bc#6)
108:<!0:-> KillStack(MustGen, loc2, W:SideState, bc#6)
18:<!0:-> MovHint(@17, MustGen, loc2, W:SideState, bc#6)
109:<!0:-> KillStack(MustGen, loc0, W:SideState, bc#11)
20:<!0:-> MovHint(@17, MustGen, loc0, W:SideState, bc#11)
142:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(16), W:SideState, bc#14)
143:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(15), W:SideState, bc#21)
144:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(10), W:SideState, bc#28)
145:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(14), W:SideState, bc#35)
146:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(9), W:SideState, bc#42)
147:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(3), W:SideState, bc#49)
148:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(13), W:SideState, bc#56)
149:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(8), W:SideState, bc#63)
150:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(2), W:SideState, bc#70)
151:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(7), W:SideState, bc#77)
152:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(18), W:SideState, bc#84)
153:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(5), W:SideState, bc#91)
154:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(0), W:SideState, bc#98)
155:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(6), W:SideState, bc#105)
156:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(4), W:SideState, bc#112)
157:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(11), W:SideState, bc#119)
158:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(19), W:SideState, bc#126)
159:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(12), W:SideState, bc#133)
160:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(17), W:SideState, bc#140)
161:<!0:-> PutHint(@17, @22, MustGen, ClosureVarPLoc(1), W:SideState, bc#147)
44:<!0:-> Branch(Boolean:Kill:@101, MustGen, T:#1/w:1.000000, F:#2/w:1.000000, W:SideState, bc#154)
States: TakeBoth, StructuresAreWatched
Availability: {locals = arg1:arg1:FlushedBoolean/@101 arg0:this:FlushedJSValue/Unavailable loc0:ConflictingFlush/@17 loc2:ConflictingFlush/@17; heap = ActivationScopePLoc(@17, 0)=>ConflictingFlush/@12, ClosureVarPLoc(@17, 0)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 1)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 2)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 3)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 4)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 5)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 6)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 7)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 8)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 9)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 10)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 11)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 12)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 13)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 14)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 15)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 16)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 17)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 18)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 19)=>ConflictingFlush/@22, ActivationSymbolTablePLoc(@17, 0)=>ConflictingFlush/@118}
Live: @12, @17, @22, @49, @118
Values: @12=>(Otherobj, TOP, TOP, Cell: 0x104443800 (%Ak:global), ID: 413), @17=>(None), @22=>(Boolint32, Int32: 0), @49=>(Function, TOP, TOP, Cell: 0x104458ca0 (%CG:Function), ID: 39), @118=>(Othercell, NonArray, [%CC:SymbolTable], Cell: 0x10446c790 (%CC:SymbolTable), ID: 19)
Block #1 (bc#157):
Execution count: 1.000000
Predecessors: #0
Successors:
Dominated by: #0 #1
Dominates: #1
Dominance Frontier:
Iterated Dominance Frontier:
Pre/Post Numbering: 2/1
States: StructuresAreWatched
Availability: {locals = arg1:arg1:FlushedBoolean/@101 arg0:this:FlushedJSValue/Unavailable loc0:ConflictingFlush/@17 loc1:DeadFlush/Undecided loc2:ConflictingFlush/@17 loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided; heap = ActivationScopePLoc(@17, 0)=>ConflictingFlush/@12, ClosureVarPLoc(@17, 0)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 1)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 2)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 3)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 4)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 5)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 6)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 7)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 8)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 9)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 10)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 11)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 12)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 13)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 14)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 15)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 16)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 17)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 18)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 19)=>ConflictingFlush/@22, ActivationSymbolTablePLoc(@17, 0)=>ConflictingFlush/@118}
Live: @12, @17, @22, @49, @118
Values: @12=>(Otherobj, TOP, TOP, Cell: 0x104443800 (%Ak:global), ID: 413), @17=>(None), @22=>(Boolint32, Int32: 0), @49=>(Function, TOP, TOP, Cell: 0x104458ca0 (%CG:Function), ID: 39), @118=>(Othercell, NonArray, [%CC:SymbolTable], Cell: 0x10446c790 (%CC:SymbolTable), ID: 19)
110:<!0:-> KillStack(MustGen, loc6, W:SideState, bc#157)
46:<!0:-> MovHint(@12, MustGen, loc6, W:SideState, bc#157)
111:<!0:-> KillStack(MustGen, loc4, W:SideState, bc#164)
50:<!0:-> MovHint(@49, MustGen, loc4, W:SideState, bc#164)
53:< 2:-> NewFunction(Cell:Kill:@17, JS|UseAsOther, Function, <0x104487900, FunctionExecutable>, #<nogen>/<nogen>:[0x104487900], R:HeapObjectCount, W:HeapObjectCount, bc#172)
112:<!0:-> KillStack(MustGen, loc5, W:SideState, bc#172)
54:<!0:-> MovHint(@53, MustGen, loc5, W:SideState, bc#172)
98:<!0:-> InvalidationPoint(MustGen,PASS: regress/script-tests/sink-huge-activation.js.ftl-no-cjit-validate
116:< 2:-> MaterializeCreateActivation(KnownCell:Kill:@118, KnownCell:@12, Kill:@22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, JS|VarArgs|PureInt, Otherobj, <0x10446c790, SymbolTable>, [id0, id1, id2, id3, id4, id5, id6, id7, id8, id9, id10, id11, id12, id13, id14, id15, id16, id17, id18, id19], R:HeapObjectCount, W:HeapObjectCount, bc#6, exit: bc#176)
162:<!0:-> MovHint(@116, MustGen, loc2, W:SideState, bc#176)
163:<!0:-> ZombieHint(MustGen, loc0, W:SideState, bc#176)
56:<!0:-> Call(Kill:@49, Kill:@12, Kill:@53, JS|MustGen|VarArgs|PureInt, Other, R:World, W:Heap, bc#176) predicting Other
113:<!0:-> KillStack(MustGen, loc4, W:SideState, bc#176)
57:<!0:-> ZombieHint(MustGen, loc4, W:SideState, bc#176)
99:<!0:-> InvalidationPoint(MustGen, W:SideState, bc#176, exit: bc#185)
61:< 2:-> GetClosureVar(KnownCell:Kill:@116, JS|UseAsOther, Boolint32, scope12, R:ScopeProperties(12), bc#185) predicting Boolint32
114:<!0:-> KillStack(MustGen, loc4, W:SideState, bc#185)
62:<!0:-> MovHint(@61, MustGen, loc4, W:SideState, bc#185)
64:<!0:-> Return(Kill:@61, MustGen, W:SideState, bc#193)
States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated
Availability: {locals = arg1:arg1:FlushedBoolean/@101 arg0:this:FlushedJSValue/Unavailable loc1:DeadFlush/Undecided loc2:ConflictingFlush/@116 loc3:DeadFlush/Undecided loc4:ConflictingFlush/@61 loc5:ConflictingFlush/@53 loc6:ConflictingFlush/@12 loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided; heap = ActivationScopePLoc(@17, 0)=>ConflictingFlush/@12, ClosureVarPLoc(@17, 0)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 1)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 2)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 3)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 4)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 5)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 6)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 7)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 8)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 9)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 10)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 11)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 12)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 13)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 14)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 15)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 16)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 17)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 18)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 19)=>ConflictingFlush/@22, ActivationSymbolTablePLoc(@17, 0)=>ConflictingFlush/@118}
Live:
Values:
Block #2 (bc#195):
Execution count: 1.000000
Predecessors: #0
Successors:
Dominated by: #0 #2
Dominates: #2
Dominance Frontier:
Iterated Dominance Frontier:
Pre/Post Numbering: 1/0
States: StructuresAreWatched
Availability: {locals = arg1:arg1:FlushedBoolean/@101 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:ConflictingFlush/@17 loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided; heap = ActivationScopePLoc(@17, 0)=>ConflictingFlush/@12, ClosureVarPLoc(@17, 0)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 1)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 2)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 3)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 4)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 5)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 6)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 7)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 8)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 9)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 10)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 11)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 12)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 13)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 14)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 15)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 16)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 17)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 18)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 19)=>ConflictingFlush/@22, ActivationSymbolTablePLoc(@17, 0)=>ConflictingFlush/@118}
Live: @22
Values: @22=>(Boolint32, Int32: 0)
115:<!0:-> KillStack(MustGen, loc4, W:SideState, bc#195)
69:<!0:-> MovHint(@22, MustGen, loc4, W:SideState, bc#195)
71:<!0:-> Return(Kill:@22, MustGen, W:SideState, bc#203)
States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated
Availability: {locals = arg1:arg1:FlushedBoolean/@101 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:ConflictingFlush/@17 loc3:DeadFlush/Undecided loc4:ConflictingFlush/@22 loc5:DeadFlush/Undecided loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided; heap = ActivationScopePLoc(@17, 0)=>ConflictingFlush/@12, ClosureVarPLoc(@17, 0)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 1)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 2)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 3)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 4)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 5)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 6)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 7)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 8)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 9)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 10)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 11)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 12)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 13)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 14)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 15)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 16)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 17)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 18)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 19)=>ConflictingFlush/@22, ActivationSymbolTablePLoc(@17, 0)=>ConflictingFlush/@118}
Live:
Values:
GC Values:
Strong:Cell: 0x104487900 (%EE:FunctionExecutable), ID: 16
Weak:Cell: 0x104458ca0 (%CG:Function), ID: 39
Strong:Cell: 0x10446c790 (%CC:SymbolTable), ID: 19
Weak:Cell: 0x104443800 (%Ak:global), ID: 413
Weak:Cell: 0x104458c70 (%CG:Function), ID: 39
Desired watchpoints:
Watchpoint sets: 0x1047c2000
Inline watchpoint sets: 0x10442be98, 0x10442bd48, 0x10442bfe8, 0x10442b958, 0x10442b808, 0x1044290a8
Inferred values: 0x10447e460
Buffer views:
Object property conditions:
Structures:
%Ak:global = 0x10446c8e0:[global, {parseInt:100, Object:101, Function:102, Array:103, RegExp:104, EvalError:105, RangeError:106, ReferenceError:107, SyntaxError:108, TypeError:109, URIError:110, Set:111, Map:112, Date:113, String:114, Symbol:115, Boolean:116, Number:117, Error:118, Promise:119, ArrayBuffer:120, WeakMap:121, WeakSet:122, eval:123, Intl:124, JSON:125, Math:126, Reflect:127, DataView:128, Float64Array:129, Float32Array:130, Uint32Array:131, Int32Array:132, Uint16Array:133, Int16Array:134, Uint8ClampedArray:135, Uint8Array:136, Int8Array:137, console:138, debug:139, describe:140, describeArray:141, print:142, quit:143, gc:144, fullGC:145, edenGC:146, gcHeapSize:147, deleteAllCompiledCode:148, addressOf:149, dumpCallFrame:150, version:151, run:152, load:153, readFile:154, checkSyntax:155, jscStack:156, readline:157, preciseTime:158, neverInlineFunction:159, noInline:160, numberOfDFGCompiles:161, optimizeNextInvocation:162, reoptimizationRetryCount:163, transferArrayBuffer:164, Root:165, Element:166, getElement:167, setElementRoot:168, DFGTrue:169, OSRExit:170, isFinalTier:171, predictInt32:172, isInt32:173, fiatInt52:174, effectful42:175, makeMasquerader:176, hasCustomProperties:177, createProxy:178, createRuntimeArray:179, createImpureGetter:180, setImpureGetterDelegate:181, dumpTypesForAllVariables:182, findTypeForExpression:183, returnTypeFor:184, dumpBasicBlockExecutionRanges:185, hasBasicBlockExecuted:186, enableExceptionFuzz:187, arguments:188}, NonArray, Proto:0x104457ff0]
%CC:SymbolTable = 0x10442b7b0:[SymbolTable, {}, NonArray]
%CG:Function = 0x10442ae80:[Function, {}, NonArray, Proto:0x104439e20]
%EE:FunctionExecutable = 0x10442b900:[FunctionExecutable, {}, NonArray]
ASSERTION FAILED: !edge->isPhantomAllocation()
/Volumes/Data/tertiary/OpenSource/Source/JavaScriptCore/dfg/DFGValidate.cpp(562) : auto JSC::DFG::Validate::validateSSA()::<anonymous class>::operator()(const JSC::DFG::Edge &) const
1 0x102674d70 WTFCrash
2 0x1020104f2 JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&)::operator()(JSC::DFG::Edge const&) const
3 0x102010434 void JSC::DFG::Graph::doToChildren<JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&)>(JSC::DFG::Node*, JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&) const&)::'lambda'(JSC::DFG::Node*, JSC::DFG::Edge&)::operator()(JSC::DFG::Node*, JSC::DFG::Edge&) const
4 0x102010321 void JSC::DFG::Graph::doToChildrenWithNode<void JSC::DFG::Graph::doToChildren<JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&)>(JSC::DFG::Node*, JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&) const&)::'lambda'(JSC::DFG::Node*, JSC::DFG::Edge&)>(JSC::DFG::Node*, JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&) const&)
5 0x102010170 void JSC::DFG::Graph::doToChildren<JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&)>(JSC::DFG::Node*, JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&) const&)
6 0x102010107 JSC::DFG::Validate::validateSSA()
7 0x10200d27c JSC::DFG::Validate::validate()
8 0x10200b011 JSC::DFG::validate(JSC::DFG::Graph&, JSC::DFG::GraphDumpMode, WTF::CString)
9 0x101f508a3 JSC::DFG::(anonymous namespace)::dumpAndVerifyGraph(JSC::DFG::Graph&, char const*, bool)
10 0x101f50211 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&)
11 0x101f4e61a JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*)
12 0x102028dc0 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*)
13 0x1020273b4 JSC::DFG::Worklist::threadFunction(void*)
14 0x1026d9dd9 WTF::createThread(void (*)(void*), void*, char const*)::$_0::operator()() const
15 0x1026d9dac std::__1::__function::__func<WTF::createThread(void (*)(void*), void*, char const*)::$_0, std::__1::allocator<WTF::createThread(void (*)(void*), void*, char const*)::$_0>, void ()>::operator()()
16 0x102164e2a std::__1::function<void ()>::operator()() const
17 0x1026d8d2e WTF::threadEntryPoint(void*)
18 0x1026da6b8 WTF::wtfThreadEntryPoint(void*)
19 0x7fff8f81f268 _pthread_body
20 0x7fff8f81f1e5 _pthread_body
21 0x7fff8f81d41d thread_start
test_script_18665: line 2: 63192 Segmentation fault: 11 "$@" ../../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --enableFunctionDotArguments\=true --useFTLJIT\=true --ftlCrashesIfCantInitializeLLVM\=true --thresholdForJITAfterWarmUp\=10 --thresholdForJITSoon\=10 --thresholdForOptimizeAfterWarmUp\=20 --thresholdForOptimizeAfterLongWarmUp\=20 --thresholdForOptimizeSoon\=20 --thresholdForFTLOptimizeAfterWarmUp\=20 --thresholdForFTLOptimizeSoon\=20 --maximumEvalCacheableSourceLength\=150000 sink-huge-activation.js
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Basile Clement
This is incredibly weird. It looks like the allocation sinking phase for some reason failed to realize the node at @53 should be sunk because it uses the activation at @17 (i.e. ObjectAllocationSinking::determineSinkCandidates failed its job). I have absolutely no idea what could have caused this, and was unable to reproduce it either.
What revision did you see this in?