Bug 153805

Summary:

ASSERTION FAILED: !edge->isPhantomAllocation() in regress/script-tests/sink-huge-activation.js.ftl-eager in debug mode

Product:

WebKit

Reporter:

Filip Pizlo <fpizlo>

Component:

JavaScriptCore

Assignee:

Filip Pizlo <fpizlo>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

ap, commit-queue, keith_miller, mark.lam, msaboff, ryanhaddad, saam

Priority:

Version:

Other

Hardware:

All

OS:

All

Attachments:

Description	Flags
the patch	mark.lam: review+

Filip Pizlo

Reported 2016-02-02 15:13:07 PST

...

Attachments
the patch (3.97 KB, patch) 2016-03-15 20:37 PDT, Filip Pizlo	mark.lam: review+	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Alexey Proskuryakov

Comment 1 2016-02-27 12:08:44 PST

This happens on this bot fairly often, roughly once per day: https://build.webkit.org/builders/Apple%20Yosemite%20Debug%20JSC%20(Tests)?numbuilds=50

Saam Barati

Comment 2 2016-03-15 13:47:00 PDT

I just hit it.

Filip Pizlo

Comment 3 2016-03-15 15:36:56 PDT

I can repro. Here's the dump. At @60: validation failed: !edge->isPhantomAllocation() (/Volumes/Data/quartary/OpenSource/Source/JavaScriptCore/dfg/DFGValidate.cpp:594). At time of failure: DFG for foo#CDmn2K:[0x10ac8b400->0x10ac8ba60->0x10ac7af40, DFGFunctionCall, 205 (NeverInline)]: Fixpoint state: FixpointConverged; Form: SSA; Unification state: GloballyUnified; Ref count state: ExactRefCount Argument formats: FlushedJSValue, FlushedBoolean Block #0 (bc#0): (OSR target) Execution count: 1.000000 Predecessors: Successors: #1 (ForwardEdge) #2 (ForwardEdge) Dominated by: #0 Dominates: #0 #1 #2 Dominance Frontier: Iterated Dominance Frontier: Pre/Post Numbering: 0/2 States: StructuresAreWatched Availability: {locals = arg1:arg1:FlushedBoolean/Unavailable arg0:this:FlushedJSValue/Unavailable; heap = } Live: Values: 131:< 2:-> JSConstant(JS|PureInt, Othercell, Strong:Cell: 0x10ac3be80 (%Df:SymbolTable), ID: 19, bc#0) 132:< 20:-> JSConstant(JS|PureInt, Other, Undefined, bc#0) 28:< 42:-> JSConstant(JS|UseAsOther, Boolint32, Int32: 0, bc#0) 18:< 3:-> JSConstant(JS|UseAsOther, Otherobj, Weak:Cell: 0x10ac43fc0 (%C0:JSGlobalLexicalEnvironment), ID: 49, bc#0) 57:< 2:-> JSConstant(JS|UseAsOther, Function, Weak:Cell: 0x10ac67eb0 (%Cf:Function), ID: 50, bc#0) 51:< 2:-> JSConstant(JS|UseAsOther, Otherobj, Weak:Cell: 0x10ac37900 (%Eg:global), ID: 321, bc#0) 109:<!0:-> ExitOK(MustGen, W:SideState, bc#0) 108:< 1:-> GetStack(JS|PureInt, Bool, arg1, machine:arg1, FlushedBoolean, R:Stack(6), bc#0) 110:<!0:-> KillStack(MustGen, loc0, W:SideState, ClobbersExit, bc#0) 3:<!0:-> ZombieHint(MustGen, loc0, W:SideState, ClobbersExit, bc#0, ExitInvalid) 111:<!0:-> KillStack(MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid) 5:<!0:-> ZombieHint(MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid) 112:<!0:-> KillStack(MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid) 7:<!0:-> ZombieHint(MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid) 113:<!0:-> KillStack(MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid) 9:<!0:-> ZombieHint(MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid) 114:<!0:-> KillStack(MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid) 11:<!0:-> ZombieHint(MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid) 115:<!0:-> KillStack(MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid) 13:<!0:-> ZombieHint(MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid) 116:<!0:-> KillStack(MustGen, loc6, W:SideState, ClobbersExit, bc#0, ExitInvalid) 15:<!0:-> ZombieHint(MustGen, loc6, W:SideState, ClobbersExit, bc#0, ExitInvalid) 117:<!0:-> KillStack(MustGen, loc3, W:SideState, ClobbersExit, bc#1) 19:<!0:-> MovHint(Untyped:@18, MustGen, loc3, W:SideState, ClobbersExit, bc#1, ExitInvalid) 118:<!0:-> KillStack(MustGen, loc4, W:SideState, ClobbersExit, bc#3) 21:<!0:-> ZombieHint(MustGen, loc4, W:SideState, ClobbersExit, bc#3, ExitInvalid) 23:<!45:-> PhantomCreateActivation(JS|MustGen|UseAsOther, Otherobj, R:HeapObjectCount, W:HeapObjectCount, Exits, bc#6) 133:<!0:-> PutHint(Untyped:@23, Untyped:@131, MustGen, ActivationSymbolTablePLoc(0), W:SideState, ClobbersExit, bc#6) 134:<!0:-> PutHint(Untyped:@23, Untyped:@18, MustGen, ActivationScopePLoc(0), W:SideState, ClobbersExit, bc#6, ExitInvalid) 135:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(0), W:SideState, ClobbersExit, bc#6, ExitInvalid) 136:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(1), W:SideState, ClobbersExit, bc#6, ExitInvalid) 137:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(2), W:SideState, ClobbersExit, bc#6, ExitInvalid) 138:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(3), W:SideState, ClobbersExit, bc#6, ExitInvalid) 139:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(4), W:SideState, ClobbersExit, bc#6, ExitInvalid) 140:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(5), W:SideState, ClobbersExit, bc#6, ExitInvalid) 141:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(6), W:SideState, ClobbersExit, bc#6, ExitInvalid) 142:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(7), W:SideState, ClobbersExit, bc#6, ExitInvalid) 143:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(8), W:SideState, ClobbersExit, bc#6, ExitInvalid) 144:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(9), W:SideState, ClobbersExit, bc#6, ExitInvalid) 145:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(10), W:SideState, ClobbersExit, bc#6, ExitInvalid) 146:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(11), W:SideState, ClobbersExit, bc#6, ExitInvalid) 147:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(12), W:SideState, ClobbersExit, bc#6, ExitInvalid) 148:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(13), W:SideState, ClobbersExit, bc#6, ExitInvalid) 149:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(14), W:SideState, ClobbersExit, bc#6, ExitInvalid) 150:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(15), W:SideState, ClobbersExit, bc#6, ExitInvalid) 151:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(16), W:SideState, ClobbersExit, bc#6, ExitInvalid) 152:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(17), W:SideState, ClobbersExit, bc#6, ExitInvalid) 153:<!0:-> PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(18), W:SideState, ClobbersExit, bc#6, ExitInvalid) 154:<!0:-> PutHint(Untyped:@23, Untyped:Kill:@132, MustGen, ClosureVarPLoc(19), W:SideState, ClobbersExit, bc#6, ExitInvalid) 155:<!0:-> ExitOK(MustGen, W:SideState, bc#6) 119:<!0:-> KillStack(MustGen, loc5, W:SideState, ClobbersExit, bc#6) 24:<!0:-> MovHint(Untyped:@23, MustGen, loc5, W:SideState, ClobbersExit, bc#6, ExitInvalid) 120:<!0:-> KillStack(MustGen, loc3, W:SideState, ClobbersExit, bc#11) 26:<!0:-> MovHint(Untyped:@23, MustGen, loc3, W:SideState, ClobbersExit, bc#11, ExitInvalid) 156:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(16), W:SideState, ClobbersExit, bc#14) 157:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(15), W:SideState, ClobbersExit, bc#21) 158:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(10), W:SideState, ClobbersExit, bc#28) 159:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(14), W:SideState, ClobbersExit, bc#35) 160:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(9), W:SideState, ClobbersExit, bc#42) 161:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(3), W:SideState, ClobbersExit, bc#49) 162:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(13), W:SideState, ClobbersExit, bc#56) 163:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(8), W:SideState, ClobbersExit, bc#63) 164:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(2), W:SideState, ClobbersExit, bc#70) 165:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(7), W:SideState, ClobbersExit, bc#77) 166:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(18), W:SideState, ClobbersExit, bc#84) 167:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(5), W:SideState, ClobbersExit, bc#91) 168:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(0), W:SideState, ClobbersExit, bc#98) 169:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(6), W:SideState, ClobbersExit, bc#105) 170:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(4), W:SideState, ClobbersExit, bc#112) 171:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(11), W:SideState, ClobbersExit, bc#119) 172:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(19), W:SideState, ClobbersExit, bc#126) 173:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(12), W:SideState, ClobbersExit, bc#133) 174:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(17), W:SideState, ClobbersExit, bc#140) 175:<!0:-> PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(1), W:SideState, ClobbersExit, bc#147) 50:<!0:-> Branch(Boolean:Kill:@108, MustGen, T:#1/w:1.000000, F:#2/w:1.000000, W:SideState, bc#154) States: TakeBoth, StructuresAreWatched Availability: {locals = arg1:arg1:FlushedBoolean/@108 arg0:this:FlushedJSValue/Unavailable loc3:ConflictingFlush/@23 loc5:ConflictingFlush/@23; heap = ActivationSymbolTablePLoc(@23, 0)=>ConflictingFlush/@131, ActivationScopePLoc(@23, 0)=>ConflictingFlush/@18, ClosureVarPLoc(@23, 0)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 1)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 2)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 3)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 4)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 5)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 6)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 7)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 8)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 9)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 10)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 11)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 12)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 13)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 14)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 15)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 16)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 17)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 18)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 19)=>ConflictingFlush/@28} Live: @18, @23, @28, @51, @57, @131 Values: @18=>(Otherobj, NonArray, [%C0:JSGlobalLexicalEnvironment], Cell: 0x10ac43fc0 (%C0:JSGlobalLexicalEnvironment), ID: 49), @23=>(None), @28=>(Boolint32, Int32: 0), @51=>(Otherobj, TOP, TOP, Cell: 0x10ac37900 (%Eg:global), ID: 321), @57=>(Function, TOP, TOP, Cell: 0x10ac67eb0 (%Cf:Function), ID: 50), @131=>(Othercell, NonArray, [%Df:SymbolTable], Cell: 0x10ac3be80 (%Df:SymbolTable), ID: 19) Block #1 (bc#157): Execution count: 1.000000 Predecessors: #0 Successors: Dominated by: #0 #1 Dominates: #1 Dominance Frontier: Iterated Dominance Frontier: Pre/Post Numbering: 2/1 States: StructuresAreWatched Availability: {locals = arg1:arg1:FlushedBoolean/@108 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:ConflictingFlush/@23 loc4:DeadFlush/Undecided loc5:ConflictingFlush/@23 loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided; heap = ActivationSymbolTablePLoc(@23, 0)=>ConflictingFlush/@131, ActivationScopePLoc(@23, 0)=>ConflictingFlush/@18, ClosureVarPLoc(@23, 0)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 1)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 2)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 3)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 4)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 5)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 6)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 7)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 8)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 9)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 10)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 11)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 12)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 13)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 14)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 15)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 16)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 17)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 18)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 19)=>ConflictingFlush/@28} Live: @18, @23, @28, @51, @57, @131 Values: @18=>(Otherobj, NonArray, [%C0:JSGlobalLexicalEnvironment], Cell: 0x10ac43fc0 (%C0:JSGlobalLexicalEnvironment), ID: 49), @23=>(None), @28=>(Boolint32, Int32: 0), @51=>(Otherobj, TOP, TOP, Cell: 0x10ac37900 (%Eg:global), ID: 321), @57=>(Function, TOP, TOP, Cell: 0x10ac67eb0 (%Cf:Function), ID: 50), @131=>(Othercell, NonArray, [%Df:SymbolTable], Cell: 0x10ac3be80 (%Df:SymbolTable), ID: 19) 121:<!0:-> ExitOK(MustGen, W:SideState, bc#157) 122:<!0:-> KillStack(MustGen, loc10, W:SideState, ClobbersExit, bc#157) 52:<!0:-> MovHint(Untyped:@51, MustGen, loc10, W:SideState, ClobbersExit, bc#157, ExitInvalid) 123:<!0:-> KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#164) 58:<!0:-> MovHint(Untyped:@57, MustGen, loc7, W:SideState, ClobbersExit, bc#164, ExitInvalid) 60:< 2:-> NewFunction(Cell:Kill:@23, JS|UseAsOther, Function, <0x10ac7ae00, FunctionExecutable>, #<nogen>/<nogen>:[0x10ac7ae00], R:HeapObjectCount, W:HeapObjectCount, ExitsForExceptions, bc#172) 124:<!0:-> KillStack(MustGen, loc9, W:SideState, ClobbersExit, bc#172, ExitInvalid) 61:<!0:-> MovHint(Untyped:@60, MustGen, loc9, W:SideState, ClobbersExit, bc#172, ExitInvalid) 105:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#172, exit: bc#176) 129:< 2:-> MaterializeCreateActivation(KnownCell:Kill:@131, KnownCell:Kill:@18, Untyped:Kill:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, JS|VarArgs|PureInt, Otherobj, <0x10ac3be80, SymbolTable>, [id0, id1, id2, id3, id4, id5, id6, id7, id8, id9, id10, id11, id12, id13, id14, id15, id16, id17, id18, id19], R:HeapObjectCount, W:HeapObjectCount, ExitsForExceptions, bc#6, exit: bc#176) 176:<!0:-> MovHint(Untyped:@129, MustGen, loc5, W:SideState, ClobbersExit, bc#176) 177:<!0:-> ZombieHint(MustGen, loc3, W:SideState, ClobbersExit, bc#176, ExitInvalid) 178:<!0:-> ExitOK(MustGen, W:SideState, bc#176) 63:<!0:-> Call(Untyped:Kill:@57, Untyped:Kill:@51, Untyped:Kill:@60, JS|MustGen|VarArgs|PureInt, Other, R:World, W:Heap, ExitsForExceptions, ClobbersExit, bc#176) predicting Other 125:<!0:-> KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#176, ExitInvalid) 64:<!0:-> ZombieHint(MustGen, loc7, W:SideState, ClobbersExit, bc#176, ExitInvalid) 106:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#176, exit: bc#185) 68:< 2:-> GetClosureVar(KnownCell:Kill:@129, JS|UseAsOther, Boolint32, scope12, R:ScopeProperties(12), Exits, bc#185) predicting Boolint32 126:<!0:-> KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#185) 69:<!0:-> MovHint(Untyped:@68, MustGen, loc7, W:SideState, ClobbersExit, bc#185, ExitInvalid) 71:<!0:-> Return(Untyped:Kill:@68, MustGen, W:SideState, Exits, bc#193) States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated Availability: {locals = arg1:arg1:FlushedBoolean/@108 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:ConflictingFlush/@129 loc6:DeadFlush/Undecided loc7:ConflictingFlush/@68 loc8:DeadFlush/Undecided loc9:ConflictingFlush/@60 loc10:ConflictingFlush/@51 loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided; heap = ActivationSymbolTablePLoc(@23, 0)=>ConflictingFlush/@131, ActivationScopePLoc(@23, 0)=>ConflictingFlush/@18, ClosureVarPLoc(@23, 0)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 1)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 2)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 3)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 4)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 5)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 6)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 7)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 8)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 9)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 10)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 11)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 12)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 13)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 14)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 15)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 16)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 17)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 18)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 19)=>ConflictingFlush/@28} Live: Values: Block #2 (bc#195): Execution count: 1.000000 Predecessors: #0 Successors: Dominated by: #0 #2 Dominates: #2 Dominance Frontier: Iterated Dominance Frontier: Pre/Post Numbering: 1/0 States: StructuresAreWatched Availability: {locals = arg1:arg1:FlushedBoolean/@108 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:ConflictingFlush/@23 loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided; heap = ActivationSymbolTablePLoc(@23, 0)=>ConflictingFlush/@131, ActivationScopePLoc(@23, 0)=>ConflictingFlush/@18, ClosureVarPLoc(@23, 0)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 1)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 2)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 3)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 4)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 5)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 6)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 7)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 8)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 9)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 10)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 11)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 12)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 13)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 14)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 15)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 16)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 17)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 18)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 19)=>ConflictingFlush/@28} Live: @28 Values: @28=>(Boolint32, Int32: 0) 127:<!0:-> ExitOK(MustGen, W:SideState, bc#195) 128:<!0:-> KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#195) 76:<!0:-> MovHint(Untyped:@28, MustGen, loc7, W:SideState, ClobbersExit, bc#195, ExitInvalid) 78:<!0:-> Return(Untyped:Kill:@28, MustGen, W:SideState, Exits, bc#203) States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated Availability: {locals = arg1:arg1:FlushedBoolean/@108 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:ConflictingFlush/@23 loc6:DeadFlush/Undecided loc7:ConflictingFlush/@28 loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided; heap = ActivationSymbolTablePLoc(@23, 0)=>ConflictingFlush/@131, ActivationScopePLoc(@23, 0)=>ConflictingFlush/@18, ClosureVarPLoc(@23, 0)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 1)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 2)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 3)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 4)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 5)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 6)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 7)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 8)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 9)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 10)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 11)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 12)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 13)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 14)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 15)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 16)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 17)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 18)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 19)=>ConflictingFlush/@28} Live: Values: GC Values: Strong:Cell: 0x10ac7ae00 (%CO:FunctionExecutable), ID: 15 Weak:Cell: 0x10ac67eb0 (%Cf:Function), ID: 50 Weak:Cell: 0x10ac37900 (%Eg:global), ID: 321 Strong:Cell: 0x10ac3be80 (%Df:SymbolTable), ID: 19 Weak:Cell: 0x10ac43fc0 (%C0:JSGlobalLexicalEnvironment), ID: 49 Weak:Cell: 0x10ac67e80 (%Cf:Function), ID: 50 Desired watchpoints: Watchpoint sets: 0x10ade0370 Inline watchpoint sets: 0x10ac27fe0, 0x10ac24ee0, 0x10ac278e0, 0x10ac27760, 0x10ac27d60, 0x10ac276e0, 0x10ac267e0, 0x10ac27e60 Inferred values: 0x10ac62060 Buffer views: Object property conditions: Inferred types: Structures: %C0:JSGlobalLexicalEnvironment = 0x10ac26780:[JSGlobalLexicalEnvironment, {}, NonArray, Leaf] %CO:FunctionExecutable = 0x10ac27880:[FunctionExecutable, {}, NonArray, Leaf] %Cf:Function = 0x10ac26700:[Function, {}, NonArray, Proto:0x10ac2dde0] %Df:SymbolTable = 0x10ac27680:[SymbolTable, {}, NonArray, Leaf] %Eg:global = 0x10ac69c80:[global, {parseInt:100, Object:101, Function:102, Array:103, RegExp:104, EvalError:105, RangeError:106, ReferenceError:107, SyntaxError:108, TypeError:109, URIError:110, Proxy:111, Set:112, Map:113, Date:114, String:115, Symbol:116, Boolean:117, Number:118, Error:119, Promise:120, ArrayBuffer:121, WeakMap:122, WeakSet:123, eval:124, Intl:125, JSON:126, Math:127, Reflect:128, DataView:129, Float64Array:130, Float32Array:131, Uint32Array:132, Int32Array:133, Uint16Array:134, Int16Array:135, Uint8ClampedArray:136, Uint8Array:137, Int8Array:138, PrivateSymbol.Int8Array:139, PrivateSymbol.Int16Array:140, PrivateSymbol.Int32Array:141, PrivateSymbol.Uint8Array:142, PrivateSymbol.Uint8ClampedArray:143, PrivateSymbol.Uint16Array:144, PrivateSymbol.Uint32Array:145, PrivateSymbol.Float32Array:146, PrivateSymbol.Float64Array:147, console:148, debug:149, describe:150, describeArray:151, print:152, quit:153, abort:154, gc:155, fullGC:156, edenGC:157, forceGCSlowPaths:158, gcHeapSize:159, addressOf:160, version:161, run:162, load:163, readFile:164, checkSyntax:165, jscStack:166, readline:167, preciseTime:168, neverInlineFunction:169, noInline:170, noDFG:171, numberOfDFGCompiles:172, optimizeNextInvocation:173, reoptimizationRetryCount:174, transferArrayBuffer:175, failNextNewCodeBlock:176, Root:177, Element:178, getElement:179, setElementRoot:180, SimpleObject:181, getHiddenValue:182, setHiddenValue:183, DFGTrue:184, OSRExit:185, isFinalTier:186, predictInt32:187, isInt32:188, fiatInt52:189, effectful42:190, makeMasquerader:191, hasCustomProperties:192, createProxy:193, createRuntimeArray:194, createImpureGetter:195, createCustomGetterObject:196, setImpureGetterDelegate:197, dumpTypesForAllVariables:198, findTypeForExpression:199, returnTypeFor:200, dumpBasicBlockExecutionRanges:201, hasBasicBlockExecuted:202, basicBlockExecutionCount:203, enableExceptionFuzz:204, drainMicrotasks:205, is32BitPlatform:206, loadModule:207, checkModuleSyntax:208, platformSupportsSamplingProfiler:209, generateHeapSnapshot:210, startSamplingProfiler:211, samplingProfilerStackTraces:212}, NonArray, Proto:0x10ac4fff0, Has been dictionary, Leaf] ASSERTION FAILED: !edge->isPhantomAllocation() /Volumes/Data/quartary/OpenSource/Source/JavaScriptCore/dfg/DFGValidate.cpp(594) : auto JSC::DFG::Validate::validateSSA()::<anonymous class>::operator()(const JSC::DFG::Edge &) const

Filip Pizlo

Comment 4 2016-03-15 15:52:04 PDT

I'm beginning to think that this is an awesome race condition. This analysis probably needs to save the value of node->castOperand<FunctionExecutable*>()->singletonFunction()->isStillValid() so that it makes up its mind. Right now, it's possible that we will decide that a NewFunction is not a sink candidate and then later decide that it doesn't escape its activation, because the watchpoint fired and so the NewFunction suddenly started to seem like a sink candidate *after* we already excluded it from that list.

Filip Pizlo

Comment 5 2016-03-15 20:37:59 PDT

Created attachment 274167 [details] the patch

Mark Lam

Comment 6 2016-03-16 10:20:03 PDT

Comment on attachment 274167 [details] the patch r=me

Filip Pizlo

Comment 7 2016-03-16 13:12:35 PDT

Landed in http://trac.webkit.org/changeset/198296

Note You need to log in before you can comment on or make changes to this bug.