Bug 170222

Summary:

[JSC][MIPS][DFG] Use x86 generic HasOwnProperty

Product:

WebKit

Reporter:

Guillaume Emont <guijemont>

Component:

JavaScriptCore

Assignee:

Yusuke Suzuki <ysuzuki>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

annulen, aperez, buildbot, commit-queue, guijemont, jbriance, keith_miller, mark.lam, msaboff, saam, ysuzuki

Priority:

Version:

Other

Hardware:

Other

OS:

Linux

Attachments:

Description	Flags
Patch	none
Patch	none
Patch	none

Guillaume Emont

Reported 2017-03-28 18:34:24 PDT

We don't have enough registers for the generic version of the intrinsic, and simply using the X86 version on MIPS makes some stress tests crash. stress/has-own-property-name-cache-string-keys.js DFG ASSERTION FAILED: Edge verification error: @80->Check:String:@57 was expected to have type String but has type Top (14898167807) ../Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h(134) : void JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge(JSC::DFG::Node*, JSC::DFG ::Edge) [with AbstractStateType = JSC::DFG::InPlaceAbstractState] and JSTests/stress/has-own-property-name-cache-symbol-keys.js DFG ASSERTION FAILED: Edge verification error: @80->Check:Symbol:@57 was expected to have type Symbol but has type Top (14898167807) ../Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h(134) : void JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge(JSC::DFG::Node*, JSC::DFG ::Edge) [with AbstractStateType = JSC::DFG::InPlaceAbstractState] Ideally we should see if we can fix the X86 version or make a MIPS variant of it (I started playing with that but don't have it working yet), in the mean time, I think we should deactivate the intrinsic on MIPS.

Attachments
Patch (1.60 KB, patch) 2017-03-28 18:40 PDT, Guillaume Emont	no flags	Details Formatted Diff Diff
Patch (2.32 KB, patch) 2017-04-05 17:40 PDT, Guillaume Emont	no flags	Details Formatted Diff Diff
Patch (2.32 KB, patch) 2017-04-06 07:41 PDT, Guillaume Emont	no flags	Details Formatted Diff Diff
Show Obsolete (2) View All Add attachment proposed patch, testcase, etc.

Guillaume Emont

Comment 1 2017-03-28 18:40:04 PDT

Created attachment 305692 [details] Patch The patch.

Yusuke Suzuki

Comment 2 2017-04-03 00:33:36 PDT

Comment on attachment 305692 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=305692&action=review > Source/JavaScriptCore/ChangeLog:10 > + I think we should fix this issue. This is DFG edge verification assertion. Could you paste the actual dump for this assertion?

Guillaume Emont

Comment 3 2017-04-04 11:50:08 PDT

Here is the full dump when running has-own-property-name-cache-string-keys.js. This is on MIPS, when enabling the intrinsic and using the X86 special case for MIPS too (adding an "or CPU(MIPS)"). # jsc JSTests/stress/has-own-property-name-cache-string-keys.js DFG ASSERTION FAILED: Edge verification error: @80->Check:String:@57 was expected to have type String but has type Top (14898167807) ../Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h(134) : void JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge(JSC::DFG::Node*, JSC::DFG::Edge) [with AbstractStateType = JSC::DFG::InPlaceAbstractState] While handling node @80 Graph at time of failure: DFG for foo#<no-hash>:[0x71d834e0->0x71d83900->0x71dd2170, DFGFunctionCall, 141 (NeverInline)]: Fixpoint state: FixpointConverged; Form: ThreadedCPS; Unification state: GloballyUnified; Ref count state: ExactRefCount Arguments: -, @1 Block #0 (bc#0): (OSR target) Execution count: 1.000000 Predecessors: Successors: #1 #2 Dominated by: #0 Dominates: #0 #1 #2 Dominance Frontier: Iterated Dominance Frontier: States: StructuresAreWatched Vars Before: arg1:(Cell, TOP, TOP) arg0:(TopEmpty, TOP, TOP) Intersected Vars Before: arg1:(Cell, TOP, TOP) arg0:(TopEmpty, TOP, TOP) Var Links: arg1:@1 1:< 3:-> SetArgument(IsFlushed, arg1(B<Final>/FlushedCell), machine:arg1, W:SideState, bc#0) predicting Final 2:< 3:loc3> JSConstant(JS|PureInt, Other, Undefined, bc#0) 3:<!0:-> MovHint(Untyped:@2, MustGen, loc0, W:SideState, ClobbersExit, bc#0) 5:<!0:-> MovHint(Untyped:@2, MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid) 7:<!0:-> MovHint(Untyped:@2, MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid) 10:< 3:loc3> JSConstant(JS|UseAsOther, Otherobj, Weak:Object: 0x71dd80a0 with butterfly (nil) (%Aq:JSGlobalLexicalEnvironment), bc#1) 11:<!0:-> MovHint(Untyped:@10, MustGen, loc0, W:SideState, ClobbersExit, bc#1) 12:< 1:-> SetLocal(Untyped:@10, loc0(F~<Object>/FlushedJSValue), machine:loc0, W:Stack(-1), bc#1, exit: bc#3) predicting Otherobj 13:<!0:-> MovHint(Untyped:@10, MustGen, loc1, W:SideState, ClobbersExit, bc#3) 15:<!0:-> CheckTraps(MustGen, W:Watchpoint_fire, Exits, ClobbersExit, bc#6) 115:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#7) 16:< 2:loc3> JSConstant(JS|PureInt, Empty, <JSValue()>, bc#7) 17:<!0:-> MovHint(Untyped:@16, MustGen, loc3, W:SideState, ClobbersExit, bc#7) 19:< 1:loc4> JSConstant(JS|UseAsOther, Otherobj, Weak:Object: 0x71dec0a0 with butterfly 0x71d8c4a8 (%Af:global), bc#10) 20:<!0:-> MovHint(Untyped:@19, MustGen, loc7, W:SideState, ClobbersExit, bc#10) 25:< 2:loc4> JSConstant(JS|UseAsOther, Otherobj, Weak:Object: 0x71de0140 with butterfly 0x6e4529c8 (%C4:Function), bc#17) 27:<!0:-> MovHint(Untyped:@25, MustGen, loc7, W:SideState, ClobbersExit, bc#17) 31:< 2:loc5> JSConstant(JS|UseAsOther, Function, Weak:Object: 0x71df7fa0 with butterfly 0x6e463fa8 (%EV:Function), bc#25) 32:<!0:-> MovHint(Untyped:@31, MustGen, loc4, W:SideState, ClobbersExit, bc#25) 34:<!2:loc6> GetLocal(Untyped:@1, JS|MustGen|UseAsOther, Final, arg1(B<Final>/FlushedCell), machine:arg1, R:Stack(5), bc#34) predicting Final 35:<!0:-> MovHint(Untyped:@34, MustGen, loc6, W:SideState, ClobbersExit, bc#34) 37:<!5:loc6> DirectCall(Untyped:@31, Untyped:@25, Untyped:@34, JS|MustGen|VarArgs|UseAsOther, Array, <0x71d87c20, NativeExecutable>, <host function>, R:World, W:Heap, Exits, ClobbersExit, bc#37) predicting Array 38:<!0:-> MovHint(Untyped:@37, MustGen, loc3, W:SideState, ClobbersExit, bc#37, ExitInvalid) 116:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#37, exit: bc#46) 117:<!0:-> CheckStructure(Check:Cell:@37, MustGen, [%Ai:Array], R:JSCell_structureID, Exits, bc#37, exit: bc#46) 39:< 1:-> SetLocal(Cell:@37, loc3(M<Array>/FlushedCell), machine:loc1, W:Stack(-4), bc#37, exit: bc#46) predicting Array 40:<!0:-> MovHint(Untyped:@16, MustGen, loc4, W:SideState, ClobbersExit, bc#46) 42:< 3:loc3> JSConstant(JS|UseAsOther|ReallyWantsInt, Boolint32, Int32: 0, bc#49) 43:<!0:-> MovHint(Untyped:@42, MustGen, loc4, W:SideState, ClobbersExit, bc#49) 44:< 1:-> SetLocal(Int32:@42, loc4(O<Int32>/FlushedInt32), machine:loc2, W:Stack(-5), bc#49, exit: bc#52) predicting Int32 107:< 1:loc4> GetButterfly(Cell:@37, Storage|PureInt, R:JSObject_butterfly, Exits, bc#52) 45:< 2:loc4> GetArrayLength(KnownCell:@37, Untyped:@107, JS|UseAsOther, Nonboolint32, Contiguous+OriginalArray+InBounds+AsIs, R:Butterfly_publicLength, Exits, bc#52) 46:<!0:-> MovHint(Untyped:@45, MustGen, loc5, W:SideState, ClobbersExit, bc#52, ExitInvalid) 48:< 1:loc4> CompareLess(Int32:@42, Int32:@45, Boolean|UseAsOther, Bool, Exits, bc#61) 49:<!0:-> Branch(KnownBoolean:@48, MustGen, T:#1/w:10.000000, F:#2/w:1.000000, W:SideState, bc#61, ExitInvalid) States: TakeBoth, StructuresAreWatched Vars After: arg1:(Cell, TOP, TOP) arg0:(TopEmpty, TOP, TOP) loc0:(Otherobj, TOP, [%Aq:JSGlobalLexicalEnvironment], Object: 0x71dd80a0 with butterfly (nil) (%Aq:JSGlobalLexicalEnvironment)) loc1:(Otherobj, TOP, [%Aq:JSGlobalLexicalEnvironment], Object: 0x71dd80a0 with butterfly (nil) (%Aq:JSGlobalLexicalEnvironment)) loc2:(Other, Undefined) loc3:(Array, ArrayWithContiguous, [%Ai:Array]) loc4:(Boolint32, Int32: 0) loc5:(Int32) loc6:(Cell, TOP, TOP) loc7:(Otherobj, TOP, [%C4:Function], Object: 0x71de0140 with butterfly 0x6e4529c8 (%C4:Function)) Var Links: arg1:@34 loc0:@12 loc3:@39 loc4:@44 Block #1 (bc#65): (OSR target) Execution count: 10.000000 Predecessors: #0 #1 Successors: #1 #2 Dominated by: #0 #1 Dominates: #1 Dominance Frontier: #1 #2 Iterated Dominance Frontier: #1 #2 Loop header, contains: #1 Containing loop headers: #1 Phi Nodes: @103<loc3,2>->(@103, @39), @104<loc4,1>->(@92, @44), @105<loc0,2>->(@105, @12), @101<arg1,3>->(@101, @1) States: StructuresAreWatched Vars Before: arg1:(Cell, TOP, TOP) loc0:(Otherobj, TOP, [%Aq:JSGlobalLexicalEnvironment], Object: 0x71dd80a0 with butterfly (nil) (%Aq:JSGlobalLexicalEnvironment)) loc3:(Array, ArrayWithContiguous, [%Ai:Array]) loc4:(Int32) Intersected Vars Before: arg1:(Cell, TOP, TOP) loc0:(Otherobj, TOP, [%Aq:JSGlobalLexicalEnvironment], Object: 0x71dd80a0 with butterfly (nil) (%Aq:JSGlobalLexicalEnvironment)) loc3:(Array, ArrayWithContiguous, [%Ai:Array]) loc4:(Int32) Var Links: arg1:@101 loc0:@118 loc3:@103 loc4:@104 50:<!0:-> LoopHint(MustGen, W:SideState, bc#65) 51:<!0:-> CheckTraps(MustGen, W:Watchpoint_fire, Exits, ClobbersExit, bc#66) 112:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#67) 52:< 1:loc4> JSConstant(JS|PureInt, Empty, <JSValue()>, bc#67) 53:<!0:-> MovHint(Untyped:@52, MustGen, loc5, W:SideState, ClobbersExit, bc#67) 55:<!5:loc4> GetLocal(Untyped:@103, JS|MustGen|UseAsOther, Array, loc3(M<Array>/FlushedCell), machine:loc1, R:Stack(-4), bc#70) predicting Array 56:<!2:loc3> GetLocal(Untyped:@104, JS|MustGen|PureNum|UseAsOther|UseAsInt|ReallyWantsInt, Int32, loc4(O<Int32>/FlushedInt32), machine:loc2, R:Stack(-5), bc#70) predicting Int32 109:< 1:loc6> GetButterfly(Cell:@55, Storage|PureInt, R:JSObject_butterfly, Exits, bc#70) 57:<!3:loc6> GetByVal(KnownCell:@55, Int32:@56, Untyped:@109, JS|MustGen|UseAsOther, Stringident, Contiguous+OriginalArray+SaneChain+AsIs, R:Butterfly_publicLength,IndexedContiguousProperties, Exits, bc#70) predicting Stringident 58:<!0:-> MovHint(Untyped:@57, MustGen, loc5, W:SideState, ClobbersExit, bc#70, ExitInvalid) 60:< 2:loc5> JSConstant(JS|UseAsOther, Otherobj, Weak:Object: 0x71dec0a0 with butterfly 0x71d8c4a8 (%Af:global), bc#76) 61:<!0:-> MovHint(Untyped:@60, MustGen, loc9, W:SideState, ClobbersExit, bc#76) 118:<!0:-> PhantomLocal(Untyped:@105, MustGen, loc0(F~<Object>/FlushedJSValue), machine:loc0, W:SideState, bc#76, ExitInvalid) predicting Otherobj 66:< 2:loc7> JSConstant(JS|UseAsOther, Function, Weak:Object: 0x71df7080 with butterfly (nil) (%EU:Function), bc#83) 67:<!0:-> MovHint(Untyped:@66, MustGen, loc6, W:SideState, ClobbersExit, bc#83) 69:<!3:loc8> GetLocal(Untyped:@101, JS|MustGen|UseAsOther, Final, arg1(B<Final>/FlushedCell), machine:arg1, R:Stack(5), bc#91) predicting Final 70:<!0:-> MovHint(Untyped:@69, MustGen, loc11, W:SideState, ClobbersExit, bc#91) 73:<!0:-> CheckStructure(Cell:@69, MustGen, [%Ea:Object, %EG:Object, %Dy:Object, %EM:Object], R:JSCell_structureID, Exits, bc#94) 74:< 2:loc9> JSConstant(JS|UseAsOther, Function, Weak:Object: 0x71df4200 with butterfly 0x71ddc268 (%EV:Function), bc#94) 75:<!0:-> MovHint(Untyped:@74, MustGen, loc8, W:SideState, ClobbersExit, bc#94) 77:<!0:-> MovHint(Untyped:@57, MustGen, loc10, W:SideState, ClobbersExit, bc#103) 80:< 2:loc6> HasOwnProperty(Object:@69, Check:String:@57, Boolean|UseAsOther, Bool, R:World, W:Heap, Exits, ClobbersExit, bc#106) 84:<!0:-> Phantom(Check:Untyped:@74, MustGen, bc#106, ExitInvalid) 81:<!0:-> MovHint(Untyped:@80, MustGen, loc8, W:SideState, ClobbersExit, bc#106, ExitInvalid) 113:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#106, exit: bc#115) 86:<!1:loc6> DirectCall(Untyped:@66, Untyped:@60, Untyped:@80, JS|MustGen|VarArgs|PureInt, Other, <0x71dd2100, FunctionExecutable>, assert#<no-hash>/<nogen>:[0x71dd2100], R:World, W:Heap, Exits, ClobbersExit, bc#115) predicting Other 87:<!0:-> MovHint(Untyped:@86, MustGen, loc6, W:SideState, ClobbersExit, bc#115, ExitInvalid) 114:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#115, exit: bc#124) 89:< 1:loc6> JSConstant(JS|PureNum|ReallyWantsInt, Boolint32, Int32: 1, bc#124) 90:<!3:loc6> ArithAdd(Int32:@56, Int32:@89, Number|MustGen|UseAsOther|ReallyWantsInt, Int32, CheckOverflow, Exits, bc#124) 91:<!0:-> MovHint(Untyped:@90, MustGen, loc4, W:SideState, ClobbersExit, bc#124) 92:< 1:-> SetLocal(Int32:@90, loc4(O<Int32>/FlushedInt32), machine:loc2, W:Stack(-5), bc#124, exit: bc#126) predicting Int32 110:<!0:-> CheckStructure(Cell:@55, MustGen, [%Ai:Array], R:JSCell_structureID, Exits, bc#126) 111:< 1:loc3> GetButterfly(Cell:@55, Storage|PureInt, R:JSObject_butterfly, Exits, bc#126) 93:< 2:loc3> GetArrayLength(KnownCell:@55, Untyped:@111, JS|UseAsOther, Nonboolint32, Contiguous+OriginalArray+InBounds+AsIs, R:Butterfly_publicLength, Exits, bc#126) 94:<!0:-> MovHint(Untyped:@93, MustGen, loc5, W:SideState, ClobbersExit, bc#126, ExitInvalid) 96:< 1:loc3> CompareLess(Int32:@90, Int32:@93, Boolean|UseAsOther, Bool, Exits, bc#135) 97:<!0:-> Branch(KnownBoolean:@96, MustGen, T:#1/w:10.000000, F:#2/w:1.000000, W:SideState, bc#135, ExitInvalid) States: TakeBoth, StructuresAreWatched Vars After: arg1:(Final, TOP, TOP) loc0:(Otherobj, TOP, [%Aq:JSGlobalLexicalEnvironment], Object: 0x71dd80a0 with butterfly (nil) (%Aq:JSGlobalLexicalEnvironment)) loc3:(Array, ArrayWithContiguous, [%Ai:Array]) loc4:(Int32) loc5:(Int32) loc6:(Top, TOP, TOP) loc8:(Bool) loc9:(Otherobj, TOP, TOP, Object: 0x71dec0a0 with butterfly 0x71d8c4a8 (%Af:global)) loc10:(String, TOP, TOP) loc11:(Final, TOP, TOP) Var Links: arg1:@69 loc0:@118 loc3:@55 loc4:@92 Block #2 (bc#139): Execution count: 1.000000 Predecessors: #0 #1 Successors: Dominated by: #0 #2 Dominates: #2 Dominance Frontier: Iterated Dominance Frontier: Phi Nodes: @102<arg1,1>->(@101, @1) States: StructuresAreWatched Vars Before: arg1:(Cell, TOP, TOP) Intersected Vars Before: arg1:(Cell, TOP, TOP) Var Links: arg1:@100 98:< 1:loc3> JSConstant(JS|UseAsOther, Other, Undefined, bc#139) 99:<!0:-> Return(Untyped:@98, MustGen, W:SideState, Exits, bc#139) 100:<!0:-> Flush(Check:Untyped:@102, MustGen|IsFlushed, arg1(B<Final>/FlushedCell), machine:arg1, R:Stack(5), W:SideState, bc#139) predicting Final States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated Vars After: Var Links: arg1:@100 GC Values: Weak:Cell: 0x71d87c20 (%BU:NativeExecutable) Weak:Cell: 0x71dd2100 (%DA:FunctionExecutable) Weak:Object: 0x71df4200 with butterfly 0x71ddc268 (%EV:Function) Weak:Object: 0x71df7080 with butterfly (nil) (%EU:Function) Weak:Object: 0x71df7fa0 with butterfly 0x6e463fa8 (%EV:Function) Weak:Object: 0x71de0140 with butterfly 0x6e4529c8 (%C4:Function) Weak:Object: 0x71dec0a0 with butterfly 0x71d8c4a8 (%Af:global) Weak:Object: 0x71dd80a0 with butterfly (nil) (%Aq:JSGlobalLexicalEnvironment) Weak:Object: 0x71df70a0 with butterfly (nil) (%EU:Function) Desired watchpoints: Watchpoint sets: 0x74d9d738, 0x74d79ba0 Inline watchpoint sets: 0x71df84ec, 0x71df91bc, 0x71df83fc, 0x71df80dc, 0x71df81cc, 0x71df989c, 0x71df85dc, 0x57d7f73c, 0x71df952c Inferred values: 0x71de5440 Buffer views: Object property conditions: <Object: 0x71dec0a0 with butterfly 0x71d8c4a8 (%Af:global): Equivalence of Object with Object: 0x71de0140 with butterfly 0x6e4529c8 (%C4:Function)>, <Object: 0x71dc80a0 with butterfly 0x71dc4128 (%C9:Object): Equivalence of hasOwnProperty with Object: 0x71df4200 with butterfly 0x71ddc268 (%EV:Function)> Inferred types: Structures: %Af:global = 0x71da03c0:[global, {parseInt:100, Object:101, Function:102, Array:103, RegExp:104, RangeError:105, TypeError:106, PrivateSymbol.Object:107, PrivateSymbol.Array:108, ArrayBuffer:109, SharedArrayBuffer:110, String:111, Symbol:112, Number:113, Error:114, Map:115, Promise:116, eval:117, Intl:118, Reflect:119, debug:120, describe:121, describeArray:122, print:123, printErr:124, quit:125, abort:126, gc:127, fullGC:128, edenGC:129, forceGCSlowPaths:130, gcHeapSize:131, addressOf:132, getGetterSetter:133, version:134, run:135, runString:136, load:137, loadString:138, readFile:139, read:140, checkSyntax:141, sleepSeconds:142, jscStack:143, readline:144, preciseTime:145, neverInlineFunction:146, noInline:147, noDFG:148, noFTL:149, noOSRExitFuzzing:150, numberOfDFGCompiles:151, jscOptions:152, optimizeNextInvocation:153, reoptimizationRetryCount:154, transferArrayBuffer:155, failNextNewCodeBlock:156, shadowChickenFunctionsOnStack:157, setGlobalConstRedeclarationShouldNotThrow:158, Root:159, Element:160, getElement:161, setElementRoot:162, SimpleObject:163, getHiddenValue:164, setHiddenValue:165, DFGTrue:166, OSRExit:167, isFinalTier:168, predictInt32:169, isInt32:170, fiatInt52:171, effectful42:172, makeMasquerader:173, hasCustomProperties:174, createProxy:175, createRuntimeArray:176, createImpureGetter:177, createCustomGetterObject:178, createDOMJITNodeObject:179, createDOMJITGetterObject:180, createDOMJITGetterComplexObject:181, createDOMJITFunctionObject:182, createBuiltin:183, createGlobalObject:184, setImpureGetterDelegate:185, dumpTypesForAllVariables:186, findTypeForExpression:187, returnTypeFor:188, dumpBasicBlockExecutionRanges:189, hasBasicBlockExecuted:190, basicBlockExecutionCount:191, enableExceptionFuzz:192, drainMicrotasks:193, getRandomSeed:194, setRandomSeed:195, isRope:196, callerSourceOrigin:197, globalObjectForObject:198, is32BitPlatform:199, loadModule:200, checkModuleSyntax:201, platformSupportsSamplingProfiler:202, generateHeapSnapshot:203, resetSuperSamplerState:204, ensureArrayStorage:205, startSamplingProfiler:206, samplingProfilerStackTraces:207, maxArguments:208, asyncTestStart:209, asyncTestPassed:210, console:211, $:212, waitForReport:213, heapCapacity:214, flashHeapAccess:215, Math:216, Date:217}, NonArray, Proto:0x71dc80a0, Dictionary, Leaf] %Ai:Array = 0x71df9c70:[Array, {}, ArrayWithContiguous, Proto:0x71df43c0] %Aq:JSGlobalLexicalEnvironment = 0x71df9180:[JSGlobalLexicalEnvironment, {}, NonArray, Leaf] %BU:NativeExecutable = 0x71df83c0:[NativeExecutable, {}, NonArray, Leaf] %C4:Function = 0x57d7f700:[Function, {name:100, prototype:101, length:102, PrivateSymbol.create:103, PrivateSymbol.defineProperty:104, PrivateSymbol.getPrototypeOf:105, PrivateSymbol.getOwnPropertyNames:106, PrivateSymbol.getOwnPropertyDescriptor:107, getOwnPropertyNames:108}, NonArray, Proto:0x71de00a0, Leaf] %C9:Object = 0x71df94f0:[Object, {toString:100, toLocaleString:101, valueOf:102, hasOwnProperty:103, propertyIsEnumerable:104, isPrototypeOf:105, __defineGetter__:106, __defineSetter__:107, __lookupGetter__:108, __lookupSetter__:109, __proto__:110, constructor:111}, NonArray, Leaf] %DA:FunctionExecutable = 0x71df84b0:[FunctionExecutable, {}, NonArray, Leaf] %Dy:Object = 0x71da1f90:[Object, {0foo:0, 1foo:1, 2foo:2, 3foo:3, 4foo:4, 5foo:5, 6foo:100, 7foo:101, 8foo:102, 9foo:103, 10foo:104, 11foo:105, 12foo:106, 13foo:107, 14foo:108, 15foo:109, 16foo:110, 17foo:111, 18foo:112, 19foo:113, 20foo:114, 21foo:115, 22foo:116, 23foo:117, 24foo:118, 25foo:119, 26foo:120, 27foo:121, 28foo:122, 29foo:123, 30foo:124, 31foo:125, 32foo:126, 33foo:127, 34foo:128, 35foo:129, 36foo:130, 37foo:131, 38foo:132, 39foo:133, 40foo:134, 41foo:135, 42foo:136, 43foo:137, 44foo:138, 45foo:139, 46foo:140, 47foo:141, 48foo:142, 49foo:143, 50foo:144, 51foo:145, 52foo:146, 53foo:147, 54foo:148, 55foo:149, 56foo:150, 57foo:151, 58foo:152, 59foo:153, 60foo:154, 61foo:155, 62foo:156, 63foo:157, 64foo:158, 65foo:159, 66foo:160, 67foo:161, 68foo:162, 69foo:163, 70foo:164, 71foo:165, 72foo:166, 73foo:167, 74foo:168, 75foo:169, 76foo:170, 77foo:171, 78foo:172, 79foo:173, 80foo:174, 81foo:175, 82foo:176, 83foo:177, 84foo:178, 85foo:179, 86foo:180, 87foo:181, 88foo:182, 89foo:183, 90foo:184, 91foo:185, 92foo:186, 93foo:187, 94foo:188, 95foo:189, 96foo:190, 97foo:191, 98foo:192, 99foo:193, 100foo:194, 101foo:195, 102foo:196, 103foo:197, 104foo:198, 105foo:199, 106foo:200, 107foo:201, 108foo:202, 109foo:203, 110foo:204, 111foo:205, 112foo:206, 113foo:207, 114foo:208, 115foo:209, 116foo:210, 117foo:211, 118foo:212, 119foo:213, 120foo:214, 121foo:215, 122foo:216, 123foo:217, 124foo:218, 125foo:219, 126foo:220, 127foo:221, 128foo:222, 129foo:223, 130foo:224, 131foo:225, 132foo:226, 133foo:227, 134foo:228, 135foo:229, 136foo:230, 137foo:231, 138foo:232, 139foo:233, 140foo:234, 141foo:235, 142foo:236, 143foo:237, 144foo:238, 145foo:239, 146foo:240, 147foo:241, 148foo:242, 149foo:243, 150foo:244, 151foo:245, 152foo:246, 153foo:247, 154foo:248, 155foo:249, 156foo:250, 157foo:251, 158foo:252, 159foo:253, 160foo:254, 161foo:255, 162foo:256, 163foo:257, 164foo:258, 165foo:259, 166foo:260, 167foo:261, 168foo:262, 169foo:263, 170foo:264, 171foo:265, 172foo:266, 173foo:267, 174foo:268, 175foo:269, 176foo:270, 177foo:271, 178foo:272, 179foo:273, 180foo:274, 181foo:275, 182foo:276, 183foo:277, 184foo:278, 185foo:279, 186foo:280, 187foo:281, 188foo:282, 189foo:283, 190foo:284, 191foo:285, 192foo:286, 193foo:287, 194foo:288, 195foo:289, 196foo:290, 197foo:291, 198foo:292, 199foo:293, 200foo:294, 201foo:295, 202foo:296, 203foo:297, 204foo:298, 205foo:299, 206foo:300, 207foo:301, 208foo:302, 209foo:303, 210foo:304, 211foo:305, 212foo:306, 213foo:307, 214foo:308, 215foo:309, 216foo:310, 217foo:311, 218foo:312, 219foo:313, 220foo:314, 221foo:315, 222foo:316, 223foo:317, 224foo:318, 225foo:319, 226foo:320, 227foo:321, 228foo:322, 229foo:323, 230foo:324, 231foo:325, 232foo:326, 233foo:327, 234foo:328, 235foo:329, 236foo:330, 237foo:331, 238foo:332, 239foo:333, 240foo:334, 241foo:335, 242foo:336, 243foo:337, 244foo:338, 245foo:339, 246foo:340, 247foo:341, 248foo:342, 249foo:343, 250foo:344, 251foo:345, 252foo:346, 253foo:347, 254foo:348, 255foo:349, 256foo:350, 257foo:351, 258foo:352, 259foo:353, 260foo:354, 261foo:355, 262foo:356, 263foo:357, 264foo:358, 265foo:359, 266foo:360, 267foo:361, 268foo:362, 269foo:363, 270foo:364, 271foo:365, 272foo:366, 273foo:367, 274foo:368, 275foo:369, 276foo:370, 277foo:371, 278foo:372, 279foo:373, 280foo:374, 281foo:375, 282foo:376, 283foo:377, 284foo:378, 285foo:379, 286foo:380, 287foo:381, 288foo:382, 289foo:383, 290foo:384, 291foo:385, 292foo:386, 293foo:387, 294foo:388, 295foo:389, 296foo:390, 297foo:391, 298foo:392, 299foo:393, 300foo:394, 301foo:395, 302foo:396, 303foo:397, 304foo:398, 305foo:399, 306foo:400, 307foo:401, 308foo:402, 309foo:403, 310foo:404, 311foo:405, 312foo:406, 313foo:407, 314foo:408, 315foo:409, 316foo:410, 317foo:411, 318foo:412, 319foo:413, 320foo:414, 321foo:415, 322foo:416, 323foo:417, 324foo:418, 325foo:419, 326foo:420, 327foo:421, 328foo:422, 329foo:423, 330foo:424, 331foo:425, 332foo:426, 333foo:427, 334foo:428, 335foo:429, 336foo:430, 337foo:431, 338foo:432, 339foo:433, 340foo:434, 341foo:435, 342foo:436, 343foo:437, 344foo:438, 345foo:439, 346foo:440, 347foo:441, 348foo:442, 349foo:443, 350foo:444, 351foo:445, 352foo:446, 353foo:447, 354foo:448, 355foo:449, 356foo:450, 357foo:451, 358foo:452, 359foo:453, 360foo:454, 361foo:455, 362foo:456, 363foo:457, 364foo:458, 365foo:459, 366foo:460, 367foo:461, 368foo:462, 369foo:463, 370foo:464, 371foo:465, 372foo:466, 373foo:467, 374foo:468, 375foo:469, 376foo:470, 377foo:471, 378foo:472, 379foo:473, 380foo:474, 381foo:475, 382foo:476, 383foo:477, 384foo:478, 385foo:479, 386foo:480, 387foo:481, 388foo:482, 389foo:483, 390foo:484, 391foo:485, 392foo:486, 393foo:487, 394foo:488, 395foo:489, 396foo:490, 397foo:491, 398foo:492, 399foo:493, 400foo:494, 401foo:495, 402foo:496, 403foo:497, 404foo:498, 405foo:499, 406foo:500, 407foo:501, 408foo:502, 409foo:503, 410foo:504, 411foo:505, 412foo:506, 413foo:507, 414foo:508, 415foo:509, 416foo:510, 417foo:511, 418foo:512, 419foo:513, 420foo:514, 421foo:515, 422foo:516, 423foo:517, 424foo:518, 425foo:519, 426foo:520, 427foo:521, 428foo:522, 429foo:523, 430foo:524, 431foo:525, 432foo:526, 433foo:527, 434foo:528, 435foo:529, 436foo:530, 437foo:531, 438foo:532, 439foo:533, 440foo:534, 441foo:535, 442foo:536, 443foo:537, 444foo:538, 445foo:539, 446foo:540, 447foo:541, 448foo:542, 449foo:543, 450foo:544, 451foo:545, 452foo:546, 453foo:547, 454foo:548, 455foo:549, 456foo:550, 457foo:551}, NonArray, Proto:0x71dc80a0, Has been dictionary, Leaf] %EG:Object = 0x71da1540:[Object, {0foo:0, 1foo:1, 2foo:2, 3foo:3, 4foo:4, 5foo:5, 6foo:100, 7foo:101, 8foo:102, 9foo:103, 10foo:104, 11foo:105, 12foo:106, 13foo:107, 14foo:108, 15foo:109, 16foo:110, 17foo:111, 18foo:112, 19foo:113, 20foo:114, 21foo:115, 22foo:116, 23foo:117, 24foo:118, 25foo:119, 26foo:120, 27foo:121, 28foo:122, 29foo:123, 30foo:124, 31foo:125, 32foo:126, 33foo:127, 34foo:128}, NonArray, Proto:0x71dc80a0] %EM:Object = 0x71da1fe0:[Object, {0foo:0, 1foo:1, 2foo:2, 3foo:3, 4foo:4, 5foo:5, 6foo:100, 7foo:101, 8foo:102, 9foo:103, 10foo:104, 11foo:105, 12foo:106, 13foo:107, 14foo:108, 15foo:109, 16foo:110, 17foo:111, 18foo:112, 19foo:113, 20foo:114, 21foo:115, 22foo:116, 23foo:117, 24foo:118, 25foo:119, 26foo:120, 27foo:121, 28foo:122, 29foo:123, 30foo:124, 31foo:125, 32foo:126, 33foo:127, 34foo:128, 35foo:129, 36foo:130, 37foo:131, 38foo:132, 39foo:133, 40foo:134, 41foo:135, 42foo:136, 43foo:137, 44foo:138, 45foo:139, 46foo:140, 47foo:141, 48foo:142, 49foo:143, 50foo:144, 51foo:145, 52foo:146, 53foo:147, 54foo:148, 55foo:149, 56foo:150, 57foo:151, 58foo:152, 59foo:153, 60foo:154, 61foo:155, 62foo:156, 63foo:157, 64foo:158, 65foo:159, 66foo:160, 67foo:161, 68foo:162, 69foo:163, 70foo:164, 71foo:165, 72foo:166, 73foo:167, 74foo:168, 75foo:169, 76foo:170, 77foo:171, 78foo:172, 79foo:173, 80foo:174, 81foo:175, 82foo:176, 83foo:177, 84foo:178, 85foo:179, 86foo:180, 87foo:181, 88foo:182, 89foo:183, 90foo:184, 91foo:185, 92foo:186, 93foo:187, 94foo:188, 95foo:189, 96foo:190, 97foo:191, 98foo:192, 99foo:193, 100foo:194, 101foo:195, 102foo:196, 103foo:197, 104foo:198, 105foo:199, 106foo:200, 107foo:201, 108foo:202, 109foo:203, 110foo:204, 111foo:205, 112foo:206, 113foo:207, 114foo:208, 115foo:209, 116foo:210, 117foo:211, 118foo:212, 119foo:213, 120foo:214, 121foo:215, 122foo:216, 123foo:217, 124foo:218, 125foo:219, 126foo:220, 127foo:221, 128foo:222, 129foo:223, 130foo:224, 131foo:225, 132foo:226, 133foo:227, 134foo:228, 135foo:229, 136foo:230, 137foo:231, 138foo:232, 139foo:233, 140foo:234, 141foo:235, 142foo:236, 143foo:237, 144foo:238, 145foo:239, 146foo:240, 147foo:241, 148foo:242, 149foo:243, 150foo:244, 151foo:245, 152foo:246, 153foo:247, 154foo:248, 155foo:249, 156foo:250, 157foo:251, 158foo:252, 159foo:253, 160foo:254, 161foo:255, 162foo:256, 163foo:257, 164foo:258, 165foo:259, 166foo:260, 167foo:261, 168foo:262, 169foo:263, 170foo:264, 171foo:265, 172foo:266, 173foo:267, 174foo:268, 175foo:269, 176foo:270, 177foo:271, 178foo:272, 179foo:273, 180foo:274, 181foo:275, 182foo:276, 183foo:277, 184foo:278, 185foo:279, 186foo:280, 187foo:281, 188foo:282, 189foo:283, 190foo:284, 191foo:285, 192foo:286, 193foo:287, 194foo:288, 195foo:289, 196foo:290, 197foo:291, 198foo:292, 199foo:293, 200foo:294, 201foo:295, 202foo:296, 203foo:297, 204foo:298, 205foo:299, 206foo:300, 207foo:301, 208foo:302, 209foo:303, 210foo:304, 211foo:305, 212foo:306, 213foo:307, 214foo:308, 215foo:309, 216foo:310, 217foo:311, 218foo:312, 219foo:313, 220foo:314, 221foo:315, 222foo:316, 223foo:317, 224foo:318, 225foo:319, 226foo:320, 227foo:321, 228foo:322, 229foo:323, 230foo:324, 231foo:325, 232foo:326, 233foo:327, 234foo:328, 235foo:329, 236foo:330, 237foo:331, 238foo:332, 239foo:333, 240foo:334, 241foo:335, 242foo:336, 243foo:337, 244foo:338, 245foo:339, 246foo:340, 247foo:341, 248foo:342, 249foo:343, 250foo:344, 251foo:345, 252foo:346, 253foo:347, 254foo:348, 255foo:349, 256foo:350, 257foo:351, 258foo:352, 259foo:353, 260foo:354, 261foo:355, 262foo:356, 263foo:357, 264foo:358, 265foo:359, 266foo:360, 267foo:361, 268foo:362, 269foo:363, 270foo:364, 271foo:365, 272foo:366, 273foo:367, 274foo:368, 275foo:369, 276foo:370, 277foo:371, 278foo:372, 279foo:373, 280foo:374, 281foo:375, 282foo:376, 283foo:377, 284foo:378, 285foo:379, 286foo:380, 287foo:381, 288foo:382, 289foo:383, 290foo:384, 291foo:385, 292foo:386, 293foo:387, 294foo:388, 295foo:389, 296foo:390, 297foo:391, 298foo:392, 299foo:393, 300foo:394, 301foo:395, 302foo:396, 303foo:397, 304foo:398, 305foo:399, 306foo:400, 307foo:401, 308foo:402, 309foo:403, 310foo:404, 311foo:405, 312foo:406, 313foo:407, 314foo:408, 315foo:409, 316foo:410, 317foo:411, 318foo:412, 319foo:413, 320foo:414, 321foo:415, 322foo:416, 323foo:417, 324foo:418, 325foo:419, 326foo:420, 327foo:421, 328foo:422, 329foo:423, 330foo:424, 331foo:425, 332foo:426, 333foo:427, 334foo:428, 335foo:429, 336foo:430, 337foo:431, 338foo:432, 339foo:433, 340foo:434, 341foo:435, 342foo:436, 343foo:437, 344foo:438, 345foo:439, 346foo:440, 347foo:441, 348foo:442, 349foo:443, 350foo:444, 351foo:445, 352foo:446, 353foo:447, 354foo:448, 355foo:449, 356foo:450, 357foo:451, 358foo:452, 359foo:453, 360foo:454, 361foo:455, 362foo:456, 363foo:457, 364foo:458, 365foo:459, 366foo:460, 367foo:461, 368foo:462, 369foo:463, 370foo:464, 371foo:465, 372foo:466, 373foo:467, 374foo:468, 375foo:469, 376foo:470, 377foo:471, 378foo:472, 379foo:473, 380foo:474, 381foo:475, 382foo:476, 383foo:477, 384foo:478, 385foo:479, 386foo:480, 387foo:481, 388foo:482, 389foo:483, 390foo:484, 391foo:485, 392foo:486, 393foo:487, 394foo:488, 395foo:489, 396foo:490, 397foo:491, 398foo:492, 399foo:493, 400foo:494, 401foo:495, 402foo:496, 403foo:497, 404foo:498, 405foo:499, 406foo:500, 407foo:501, 408foo:502, 409foo:503, 410foo:504, 411foo:505, 412foo:506, 413foo:507, 414foo:508, 415foo:509, 416foo:510, 417foo:511, 418foo:512, 419foo:513, 420foo:514, 421foo:515, 422foo:516, 423foo:517, 424foo:518, 425foo:519, 426foo:520, 427foo:521, 428foo:522, 429foo:523, 430foo:524, 431foo:525, 432foo:526, 433foo:527, 434foo:528, 435foo:529, 436foo:530, 437foo:531, 438foo:532, 439foo:533, 440foo:534, 441foo:535, 442foo:536, 443foo:537, 444foo:538, 445foo:539, 446foo:540, 447foo:541, 448foo:542, 449foo:543, 450foo:544, 451foo:545, 452foo:546, 453foo:547, 454foo:548, 455foo:549, 456foo:550, 457foo:551, 458foo:552, 459foo:553, 460foo:554, 461foo:555, 462foo:556, 463foo:557, 464foo:558, 465foo:559, 466foo:560, 467foo:561, 468foo:562, 469foo:563, 470foo:564, 471foo:565, 472foo:566, 473foo:567, 474foo:568, 475foo:569, 476foo:570, 477foo:571, 478foo:572, 479foo:573, 480foo:574, 481foo:575, 482foo:576, 483foo:577, 484foo:578, 485foo:579, 486foo:580, 487foo:581, 488foo:582, 489foo:583, 490foo:584, 491foo:585, 492foo:586, 493foo:587, 494foo:588, 495foo:589, 496foo:590, 497foo:591, 498foo:592, 499foo:593, 500foo:594, 501foo:595, 502foo:596, 503foo:597, 504foo:598, 505foo:599, 506foo:600, 507foo:601, 508foo:602, 509foo:603, 510foo:604, 511foo:605, 512foo:606, 513foo:607, 514foo:608, 515foo:609, 516foo:610, 517foo:611, 518foo:612, 519foo:613, 520foo:614, 521foo:615, 522foo:616, 523foo:617, 524foo:618, 525foo:619, 526foo:620, 527foo:621, 528foo:622, 529foo:623, 530foo:624, 531foo:625, 532foo:626, 533foo:627, 534foo:628, 535foo:629, 536foo:630, 537foo:631, 538foo:632, 539foo:633, 540foo:634, 541foo:635, 542foo:636, 543foo:637, 544foo:638, 545foo:639, 546foo:640, 547foo:641, 548foo:642, 549foo:643, 550foo:644, 551foo:645, 552foo:646, 553foo:647, 554foo:648, 555foo:649, 556foo:650, 557foo:651, 558foo:652, 559foo:653, 560foo:654, 561foo:655, 562foo:656, 563foo:657, 564foo:658, 565foo:659, 566foo:660, 567foo:661, 568foo:662, 569foo:663, 570foo:664, 571foo:665, 572foo:666, 573foo:667, 574foo:668, 575foo:669, 576foo:670, 577foo:671, 578foo:672, 579foo:673, 580foo:674, 581foo:675, 582foo:676, 583foo:677, 584foo:678, 585foo:679, 586foo:680, 587foo:681, 588foo:682, 589foo:683, 590foo:684, 591foo:685, 592foo:686, 593foo:687, 594foo:688, 595foo:689, 596foo:690, 597foo:691, 598foo:692, 599foo:693, 600foo:694, 601foo:695, 602foo:696, 603foo:697, 604foo:698, 605foo:699, 606foo:700, 607foo:701, 608foo:702, 609foo:703, 610foo:704, 611foo:705, 612foo:706, 613foo:707, 614foo:708, 615foo:709, 616foo:710, 617foo:711, 618foo:712, 619foo:713, 620foo:714, 621foo:715, 622foo:716, 623foo:717, 624foo:718, 625foo:719, 626foo:720, 627foo:721, 628foo:722, 629foo:723, 630foo:724, 631foo:725, 632foo:726, 633foo:727, 634foo:728, 635foo:729, 636foo:730, 637foo:731, 638foo:732, 639foo:733, 640foo:734, 641foo:735, 642foo:736, 643foo:737, 644foo:738, 645foo:739, 646foo:740, 647foo:741, 648foo:742, 649foo:743, 650foo:744, 651foo:745, 652foo:746, 653foo:747}, NonArray, Proto:0x71dc80a0, Has been dictionary, Leaf] %EU:Function = 0x71df91d0:[Function, {}, NonArray, Proto:0x71de00a0] %EV:Function = 0x71df92c0:[Function, {name:100, length:101}, NonArray, Proto:0x71de00a0] %Ea:Object = 0x71da1f40:[Object, {0foo:0, 1foo:1, 2foo:2, 3foo:3, 4foo:4, 5foo:5, 6foo:100, 7foo:101, 8foo:102, 9foo:103, 10foo:104, 11foo:105, 12foo:106, 13foo:107, 14foo:108, 15foo:109, 16foo:110, 17foo:111, 18foo:112, 19foo:113, 20foo:114, 21foo:115, 22foo:116, 23foo:117, 24foo:118, 25foo:119, 26foo:120, 27foo:121, 28foo:122, 29foo:123, 30foo:124, 31foo:125, 32foo:126, 33foo:127, 34foo:128, 35foo:129, 36foo:130, 37foo:131, 38foo:132, 39foo:133, 40foo:134, 41foo:135, 42foo:136, 43foo:137, 44foo:138, 45foo:139, 46foo:140, 47foo:141, 48foo:142, 49foo:143, 50foo:144, 51foo:145, 52foo:146, 53foo:147, 54foo:148, 55foo:149, 56foo:150, 57foo:151, 58foo:152, 59foo:153, 60foo:154, 61foo:155, 62foo:156, 63foo:157, 64foo:158, 65foo:159, 66foo:160, 67foo:161, 68foo:162, 69foo:163, 70foo:164, 71foo:165, 72foo:166, 73foo:167, 74foo:168, 75foo:169, 76foo:170, 77foo:171, 78foo:172, 79foo:173, 80foo:174, 81foo:175, 82foo:176, 83foo:177, 84foo:178, 85foo:179, 86foo:180, 87foo:181, 88foo:182, 89foo:183, 90foo:184, 91foo:185, 92foo:186, 93foo:187, 94foo:188, 95foo:189, 96foo:190, 97foo:191, 98foo:192, 99foo:193, 100foo:194, 101foo:195, 102foo:196, 103foo:197, 104foo:198, 105foo:199, 106foo:200, 107foo:201, 108foo:202, 109foo:203, 110foo:204, 111foo:205, 112foo:206, 113foo:207, 114foo:208, 115foo:209, 116foo:210, 117foo:211, 118foo:212, 119foo:213, 120foo:214, 121foo:215, 122foo:216, 123foo:217, 124foo:218, 125foo:219, 126foo:220, 127foo:221, 128foo:222, 129foo:223, 130foo:224, 131foo:225, 132foo:226, 133foo:227, 134foo:228, 135foo:229, 136foo:230, 137foo:231, 138foo:232, 139foo:233, 140foo:234, 141foo:235, 142foo:236, 143foo:237, 144foo:238, 145foo:239, 146foo:240, 147foo:241, 148foo:242, 149foo:243, 150foo:244, 151foo:245, 152foo:246, 153foo:247, 154foo:248, 155foo:249, 156foo:250, 157foo:251, 158foo:252, 159foo:253, 160foo:254, 161foo:255, 162foo:256, 163foo:257, 164foo:258, 165foo:259, 166foo:260, 167foo:261, 168foo:262, 169foo:263, 170foo:264, 171foo:265, 172foo:266, 173foo:267, 174foo:268, 175foo:269, 176foo:270, 177foo:271, 178foo:272, 179foo:273, 180foo:274, 181foo:275, 182foo:276, 183foo:277, 184foo:278, 185foo:279, 186foo:280, 187foo:281, 188foo:282, 189foo:283, 190foo:284, 191foo:285, 192foo:286, 193foo:287, 194foo:288, 195foo:289, 196foo:290, 197foo:291, 198foo:292, 199foo:293, 200foo:294, 201foo:295, 202foo:296, 203foo:297, 204foo:298, 205foo:299, 206foo:300, 207foo:301, 208foo:302, 209foo:303, 210foo:304, 211foo:305, 212foo:306, 213foo:307, 214foo:308, 215foo:309, 216foo:310, 217foo:311, 218foo:312, 219foo:313, 220foo:314, 221foo:315, 222foo:316, 223foo:317, 224foo:318, 225foo:319, 226foo:320, 227foo:321, 228foo:322, 229foo:323, 230foo:324, 231foo:325, 232foo:326, 233foo:327, 234foo:328, 235foo:329, 236foo:330, 237foo:331, 238foo:332, 239foo:333, 240foo:334, 241foo:335, 242foo:336, 243foo:337, 244foo:338, 245foo:339, 246foo:340, 247foo:341, 248foo:342, 249foo:343, 250foo:344, 251foo:345, 252foo:346, 253foo:347, 254foo:348, 255foo:349, 256foo:350, 257foo:351, 258foo:352, 259foo:353, 260foo:354, 261foo:355, 262foo:356, 263foo:357, 264foo:358, 265foo:359, 266foo:360, 267foo:361, 268foo:362, 269foo:363, 270foo:364, 271foo:365, 272foo:366, 273foo:367, 274foo:368, 275foo:369, 276foo:370, 277foo:371, 278foo:372, 279foo:373, 280foo:374, 281foo:375, 282foo:376, 283foo:377, 284foo:378, 285foo:379, 286foo:380, 287foo:381, 288foo:382, 289foo:383, 290foo:384, 291foo:385, 292foo:386, 293foo:387, 294foo:388, 295foo:389, 296foo:390, 297foo:391, 298foo:392, 299foo:393, 300foo:394, 301foo:395, 302foo:396, 303foo:397, 304foo:398, 305foo:399, 306foo:400, 307foo:401, 308foo:402, 309foo:403, 310foo:404, 311foo:405, 312foo:406, 313foo:407, 314foo:408, 315foo:409, 316foo:410, 317foo:411, 318foo:412, 319foo:413, 320foo:414, 321foo:415, 322foo:416, 323foo:417, 324foo:418, 325foo:419}, NonArray, Proto:0x71dc80a0, Has been dictionary, Leaf] DFG ASSERTION FAILED: Edge verification error: @80->Check:String:@57 was expected to have type String but has type Top (14898167807) ../Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h(134) : void JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge(JSC::DFG::Node*, JSC::DFG::Edge) [with AbstractStateType = JSC::DFG::InPlaceAbstractState] Bus error #

Yusuke Suzuki

Comment 4 2017-04-04 12:08:04 PDT

Could you dump the stack trace too?

Yusuke Suzuki

Comment 5 2017-04-04 12:10:49 PDT

I think we should have speculation check on x86 generic version of HasOwnProperty DFG node.

Yusuke Suzuki

Comment 6 2017-04-04 12:12:36 PDT

(In reply to Yusuke Suzuki from comment #4) > Could you dump the stack trace too? I would like to see the bt of this. I guess this AI is used from DFGSpeculativeJIT code emitting phase.

Guillaume Emont

Comment 7 2017-04-04 12:31:51 PDT

(In reply to Yusuke Suzuki from comment #6) > (In reply to Yusuke Suzuki from comment #4) > > Could you dump the stack trace too? > > I would like to see the bt of this. I guess this AI is used from > DFGSpeculativeJIT code emitting phase. Here you go (again, this is running on MIPS, I don't know if the issue reproduces on X86, I haven't tried): Program received signal SIGBUS, Bus error. 0x00e65628 in WTFCrash () at ../Source/WTF/wtf/Assertions.cpp:323 323 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00e65628 in WTFCrash () at ../Source/WTF/wtf/Assertions.cpp:323 #1 0x00e65658 in WTFCrashWithSecurityImplication () at ../Source/WTF/wtf/Assertions.cpp:343 #2 0x00d3b898 in JSC::DFG::crash (graph=..., whileText=..., file=0xf19604 "../Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h", line=134, function=0xf1a0f0 <JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::verifyEdge(JSC::DFG::Node*, JSC::DFG::Edge)::__PRETTY_FUNCTION__> "void JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge(JSC::DFG::Node*, JSC::DFG::Edge) [with AbstractStateType = JSC::DFG::InPlaceAbstractState]", assertion=0x755a9260 "Edge verification error: @80->Check:String:@57 was expected to have type String but has type Top (14898167807)") at ../Source/JavaScriptCore/dfg/DFGGraph.cpp:1510 #3 0x00d3c9c4 in JSC::DFG::Graph::handleAssertionFailure (this=0x7fff5de8, node=0x71801e60, file=<optimized out>, line=<optimized out>, function=0xf1a0f0 <JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::verifyEdge(JSC::DFG::Node*, JSC::DFG::Edge)::__PRETTY_FUNCTION__> "void JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge(JSC::DFG::Node*, JSC::DFG::Edge) [with AbstractStateType = JSC::DFG::InPlaceAbstractState]", assertion=0x755a9260 "Edge verification error: @80->Check:String:@57 was expected to have type String but has type Top (14898167807)") at ../Source/JavaScriptCore/dfg/DFGGraph.cpp:1522 #4 0x00b8f33c in JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::verifyEdge (this=<optimized out>, node=0x71801e60, edge=...) at ../Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:134 #5 0x00b8f45c in JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::verifyEdges (this=0x6287f9f0, node=0x71801e60) at ../Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:140 #6 0x00b8f4e8 in JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::executeEffects (this=0x6287f9f0, clobberLimit=21, node=0x71801e60) at ../Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:176 #7 0x00de357c in JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::executeEffects (indexInBlock=<optimized out>, this=0x6287f9f0) at ../Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:3028 #8 JSC::DFG::SpeculativeJIT::compileCurrentBlock (this=0x6287f200) at ../Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:1767 #9 0x00de38f8 in JSC::DFG::SpeculativeJIT::compile (this=0x6287f200) at ../Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:1857 #10 0x00d57d3c in JSC::DFG::JITCompiler::compileFunction (this=0x7fff58c8) at ../Source/JavaScriptCore/dfg/DFGJITCompiler.cpp:438 #11 0x00b7a8f4 in JSC::DFG::Plan::compileInThreadImpl (this=0x75581000, longLivedState=...) at ../Source/JavaScriptCore/dfg/DFGPlan.cpp:392 #12 0x00b7b2b8 in JSC::DFG::Plan::compileInThread (this=0x75581000, longLivedState=..., threadData=<optimized out>) at ../Source/JavaScriptCore/dfg/DFGPlan.cpp:188 #13 0x00b75ba4 in JSC::DFG::compileImpl (callback=<optimized out>, mustHandleValues=..., osrEntryBytecodeIndex=65, mode=JSC::DFG::DFGMode, profiledDFGCodeBlock=0x0, codeBlock=0x725834e0, vm=...) at ../Source/JavaScriptCore/dfg/DFGDriver.cpp:111 #14 JSC::DFG::compile(JSC::VM&, JSC::CodeBlock*, JSC::CodeBlock*, JSC::DFG::CompilationMode, unsigned int, JSC::Operands<JSC::JSValue> const&, WTF::Ref<JSC::DeferredCompilationCallback>&&) (vm=..., codeBlock=0x725834e0, profiledDFGCodeBlock=0x0, mode=JSC::DFG::DFGMode, osrEntryBytecodeIndex=65, mustHandleValues=..., callback=<unknown type in /home/guijemont/dev/metrological/buildroot-wpe/output.dawn.hardfp/host/usr/mipsel-buildroot-linux-gnu/sysroot/usr/bin/jsc, CU 0x1914f218, DIE 0x192a3dd6>) at ../Source/JavaScriptCore/dfg/DFGDriver.cpp:130 #15 0x00704998 in JSC::operationOptimize (exec=0x7fff64e8, bytecodeIndex=65) at ../Source/JavaScriptCore/jit/JITOperations.cpp:1453 warning: GDB can't find the start of the function at 0x7341b247. GDB is unable to find the start of the function at 0x7341b247 and thus can't determine the size of that function's stack frame. This means that GDB may be unable to access that stack frame, or the frames below it. This problem is most likely caused by an invalid program counter or stack pointer. However, if you think GDB should simply search farther back from 0x7341b247 for code which looks like the beginning of a function, you can increase the range of the search using the `set heuristic-fence-post' command. #16 0x7341b248 in ?? () (gdb)

Yusuke Suzuki

Comment 8 2017-04-04 22:23:26 PDT

OK, I found the reason. This is not JSC bug. You should enable DFGFixupPhase's x86 ifdef of HasOwnProperty for MIPS too.

Guillaume Emont

Comment 9 2017-04-05 17:40:55 PDT

Created attachment 306343 [details] Patch Patch that uses the X86 version of HasOwnProperty for MIPS, this time also doing in in DFGFixupPhase.

Yusuke Suzuki

Comment 10 2017-04-06 03:03:17 PDT

Comment on attachment 306343 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=306343&action=review r=me with comment > Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:1385 > +#if CPU(X86) && USE(JSVALUE32_64) || CPU(MIPS) `#if (CPU(X86) || CPU(MIPS)) && USE(JSVALUE32_64)` is better.

Guillaume Emont

Comment 11 2017-04-06 07:41:02 PDT

Created attachment 306385 [details] Patch Patch with comment addressed. Thank you for your patience.

Yusuke Suzuki

Comment 12 2017-04-06 07:56:00 PDT

Comment on attachment 306385 [details] Patch r=me

WebKit Commit Bot

Comment 13 2017-04-06 08:23:56 PDT

Comment on attachment 306385 [details] Patch Clearing flags on attachment: 306385 Committed r215038: <http://trac.webkit.org/changeset/215038>

WebKit Commit Bot

Comment 14 2017-04-06 08:23:58 PDT

All reviewed patches have been landed. Closing bug.

Note You need to log in before you can comment on or make changes to this bug.