Bug 224354

Summary:

DFG ASSERTION FAILED

Product:

WebKit

Reporter:

rain <hexiaoyu>

Component:

JavaScriptCore

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED DUPLICATE

Severity:

Critical

CC:

fpizlo, mark.lam, saam, webkit-bug-importer, ysuzuki

Priority:

Keywords:

InRadar

Version:

WebKit Local Build

Hardware:

OS:

Linux

Attachments:

Description	Flags
poc	none

rain

Reported 2021-04-08 19:04:43 PDT

Created attachment 425569 [details] poc # crash output DFG ASSERTION FAILED: Live bytecode local not available: operand = this, availabilityMap = {locals = arg2:FlushedJSValue/Unavailable arg1:FlushedJSValue/Unavailable loc4:ConflictingFlush/D@65 loc6:ConflictingFlush/D@71 loc10:ConflictingFlush/D@195<Double>; heap = }, origin = bc#271 ../../Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp(174) : bool JSC::DFG::OSRAvailabilityAnalysisPhase<(lambda at ../../Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp:193:31), (lambda at ../../Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp:194:31)>::run() [HeadFunctor = (lambda at ../../Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp:193:31), TailFunctor = (lambda at ../../Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp:194:31)] While handling node D@131 Graph at time of failure: 37: DFG for V15#<no-hash>:[0x7efd0e1c45f0->0x7efd0e1c4260->0x7efd0e1e5280, DFGFunctionConstruct, 389 (DidTryToEnterInLoop) (StrictMode)]: 37: Fixpoint state: FixpointNotConverged; Form: SSA; Unification state: GloballyUnified; Ref count state: EverythingIsLive 37: Argument formats for entrypoint index: 0 : FlushedJSValue, FlushedJSValue, FlushedJSValue 37: Argument formats for entrypoint index: 1 : FlushedJSValue, FlushedJSValue, FlushedJSValue 0 37: Block #0 (bc#0): 0 37: Execution count: 1.000000 0 37: Predecessors: 0 37: Successors: #1 #10 0 37: Dominated by: #0 0 37: Dominates: #0 #1 #2 #3 #4 #5 #6 #7 #9 #10 0 37: Dominance Frontier: 0 37: Iterated Dominance Frontier: 0 37: States: StructuresAreWatched 0 37: Live: 0 37: Values: 0 0 37: D@46:< 7:-> JSConstant(JS|UseAsOther, Empty, <JSValue()>, bc#0, ExitInvalid) 1 0 37: D@23:< 3:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x7efd0e1bc060 with butterfly (nil) (Structure %BW:JSLexicalEnvironment), StructureID: 31388, bc#0, ExitInvalid) 2 0 37: D@3:< 10:-> JSConstant(JS|PureInt, Other, Undefined, bc#0, ExitInvalid) 3 0 37: D@185:< 0:-> JSConstant(JS|PureNum|UseAsOther, NonBoolInt32, Int32: 100, bc#0, ExitInvalid) 4 0 37: D@193:< 1:-> JSConstant(JS|PureInt, StringIdent, Strong:String (atomic),8Bit:(1),length:(76): const v39 = v38.concat(); v39; , StructureID: 15293, bc#0, ExitInvalid) 5 0 37: D@207:< 1:-> JSConstant(JS|UseAsOther, BoolInt32, Int32: 0, bc#0, ExitInvalid) 6 0 37: D@22:< 1:-> JSConstant(JS|PureInt, Function, Weak:Object: 0x7efd0e1f6080 with butterfly 0x7ee0163fe168 (Structure %EN:Function), StructureID: 59661, bc#0, ExitInvalid) 7 0 37: D@212:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x7efd0e7fa068 with butterfly 0x7ee0163e4408 (Structure %B6:global), StructureID: 53674, bc#0, ExitInvalid) 8 0 37: D@198:< 1:-> JSConstant(JS|UseAsOther, BoolInt32, Int32: 1, bc#0, ExitInvalid) 9 0 37: D@63:< 2:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x7efd0e1d4240 with butterfly 0x7ee0163fe148 (Structure %Em:Function), StructureID: 58385, bc#0, ExitInvalid) 10 0 37: D@219:< 2:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x7efd0e1d4000 with butterfly 0x7ee0163fce68 (Structure %Ak:Function), StructureID: 45983, bc#0, ExitInvalid) 11 0 37: D@162:< 0:-> JSConstant(Boolean|UseAsOther, Bool, True, bc#0, ExitInvalid) 12 0 37: D@34:< 2:-> DoubleConstant(Double|PureInt, BytecodeDouble, Double: 4636737291354636288, 100.000000, bc#0, ExitInvalid) 13 0 37: D@33:< 2:-> DoubleConstant(Double|PureInt, BytecodeDouble, Double: 4607182418800017408, 1.000000, bc#0, ExitInvalid) 14 0 37: D@209:<!0:-> EntrySwitch(MustGen, #1, #10, W:SideState, bc#0, ExitInvalid) 0 37: States: InvalidBranchDirection, StructuresAreWatched 0 37: Live: D@3, D@22, D@23, D@33<Double>, D@34<Double>, D@46, D@63, D@193, D@198, D@207, D@212, D@219 0 37: Values: 1 37: Block #1 (bc#0): (OSR target) 1 37: Execution count: 1.000000 1 37: Predecessors: #0 1 37: Successors: 1 37: Dominated by: #0 #1 1 37: Dominates: #1 1 37: Dominance Frontier: 1 37: Iterated Dominance Frontier: 1 37: States: StructuresAreWatched 1 37: Live: D@3, D@22, D@23, D@46, D@63 1 37: Values: 0 1 37: D@83:<!0:-> ExitOK(MustGen, W:SideState, bc#0, ExitValid) 1 1 37: D@218:<!0:-> InitializeEntrypointArguments(MustGen, W:SideState, ClobbersExit, bc#0, ExitValid) 2 1 37: D@217:<!0:-> ExitOK(MustGen, W:SideState, bc#0, ExitValid) 3 1 37: D@97:< 4:-> GetStack(JS|PureInt, this, FlushedJSValue, R:Stack(this), bc#0, ExitValid) 4 1 37: D@200:< 2:-> GetStack(JS|PureInt, Other, arg1, FlushedJSValue, R:Stack(arg1), bc#0, ExitValid) 5 1 37: D@98:< 5:-> GetStack(JS|PureInt, Other, arg2, FlushedJSValue, R:Stack(arg2), bc#0, ExitValid) 6 1 37: D@82:<!0:-> KillStack(MustGen, loc0, W:Stack(loc0), ClobbersExit, bc#0, ExitValid) 7 1 37: D@4:<!0:-> MovHint(Check:Untyped:D@3, MustGen, loc0, W:SideState, ClobbersExit, bc#0, ExitInvalid) 8 1 37: D@81:<!0:-> KillStack(MustGen, loc1, W:Stack(loc1), ClobbersExit, bc#0, ExitInvalid) 9 1 37: D@6:<!0:-> MovHint(Check:Untyped:D@3, MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid) 10 1 37: D@80:<!0:-> KillStack(MustGen, loc2, W:Stack(loc2), ClobbersExit, bc#0, ExitInvalid) 11 1 37: D@8:<!0:-> MovHint(Check:Untyped:D@3, MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid) 12 1 37: D@79:<!0:-> KillStack(MustGen, loc3, W:Stack(loc3), ClobbersExit, bc#0, ExitInvalid) 13 1 37: D@10:<!0:-> MovHint(Check:Untyped:D@3, MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid) 14 1 37: D@15:<!0:-> KillStack(MustGen, loc4, W:Stack(loc4), ClobbersExit, bc#0, ExitInvalid) 15 1 37: D@12:<!0:-> MovHint(Check:Untyped:D@3, MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid) 16 1 37: D@17:<!0:-> KillStack(MustGen, loc5, W:Stack(loc5), ClobbersExit, bc#0, ExitInvalid) 17 1 37: D@14:<!0:-> MovHint(Check:Untyped:D@3, MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid) 18 1 37: D@19:<!0:-> KillStack(MustGen, loc6, W:Stack(loc6), ClobbersExit, bc#0, ExitInvalid) 19 1 37: D@16:<!0:-> MovHint(Check:Untyped:D@3, MustGen, loc6, W:SideState, ClobbersExit, bc#0, ExitInvalid) 20 1 37: D@21:<!0:-> KillStack(MustGen, loc7, W:Stack(loc7), ClobbersExit, bc#0, ExitInvalid) 21 1 37: D@18:<!0:-> MovHint(Check:Untyped:D@3, MustGen, loc7, W:SideState, ClobbersExit, bc#0, ExitInvalid) 22 1 37: D@25:<!0:-> KillStack(MustGen, loc8, W:Stack(loc8), ClobbersExit, bc#0, ExitInvalid) 23 1 37: D@20:<!0:-> MovHint(Check:Untyped:Kill:D@3, MustGen, loc8, W:SideState, ClobbersExit, bc#0, ExitInvalid) 24 1 37: D@77:<!0:-> KillStack(MustGen, loc4, W:Stack(loc4), ClobbersExit, bc#1, ExitValid) 25 1 37: D@24:<!0:-> MovHint(Check:Untyped:D@23, MustGen, loc4, W:SideState, ClobbersExit, bc#1, ExitInvalid) 26 1 37: D@67:<!0:-> KillStack(MustGen, loc5, W:Stack(loc5), ClobbersExit, bc#3, ExitValid) 27 1 37: D@26:<!0:-> MovHint(Check:Untyped:D@23, MustGen, loc5, W:SideState, ClobbersExit, bc#3, ExitInvalid) 28 1 37: D@28:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#6, ExitValid) 29 1 37: D@29:< 9:-> CreateActivation(KnownCell:Kill:D@23, JS|UseAsOther, OtherObj, <0x7efd0e1c02d0, SymbolTable>, R:HeapObjectCount, W:HeapObjectCount,Watchpoint_fire, ExitsForExceptions, ClobbersExit, bc#7, ExitValid) 30 1 37: D@66:<!0:-> KillStack(MustGen, loc6, W:Stack(loc6), ClobbersExit, bc#7, ExitInvalid) 31 1 37: D@30:<!0:-> MovHint(Check:Untyped:D@29, MustGen, loc6, W:SideState, ClobbersExit, bc#7, ExitInvalid) 32 1 37: D@160:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#7, exit: bc#12, ExitValid) 33 1 37: D@178:<!0:-> KillStack(MustGen, loc4, W:Stack(loc4), ClobbersExit, bc#12, ExitValid) 34 1 37: D@32:<!0:-> MovHint(Check:Untyped:D@29, MustGen, loc4, W:SideState, ClobbersExit, bc#12, ExitInvalid) 35 1 37: D@103:<!0:-> Check(Check:Other:D@200, MustGen, Exits, bc#15, ExitValid) 36 1 37: D@35:<!0:-> PutClosureVar(KnownCell:D@29, Check:Untyped:Kill:D@200, MustGen, scope0, W:ScopeProperties(0), ClobbersExit, bc#15, ExitValid) 37 1 37: D@36:<!0:-> NotifyWrite(MustGen, 0x7efd4eba8c80, W:Watchpoint_fire,SideState, ClobbersExit, bc#15, ExitInvalid) 38 1 37: D@165:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#23, ExitValid) 39 1 37: D@102:<!0:-> Check(Check:Other:D@98, MustGen, Exits, bc#23, ExitValid) 40 1 37: D@38:<!0:-> PutClosureVar(KnownCell:D@29, Check:Untyped:D@98, MustGen, scope1, W:ScopeProperties(1), ClobbersExit, bc#23, ExitValid) 41 1 37: D@39:<!0:-> NotifyWrite(MustGen, 0x7efd4eba8ca0, W:Watchpoint_fire,SideState, ClobbersExit, bc#23, ExitInvalid) 42 1 37: D@171:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#31, ExitValid) 43 1 37: D@40:< 2:-> CreateClonedArguments(JS|UseAsOther, OtherObj, R:Stack,HeapObjectCount, W:HeapObjectCount, Exits, ClobbersExit, bc#31, ExitValid) 44 1 37: D@62:<!0:-> KillStack(MustGen, loc7, W:Stack(loc7), ClobbersExit, bc#31, ExitInvalid) 45 1 37: D@41:<!0:-> MovHint(Check:Untyped:D@40, MustGen, loc7, W:SideState, ClobbersExit, bc#31, ExitInvalid) 46 1 37: D@52:<!0:-> KillStack(MustGen, loc8, W:Stack(loc8), ClobbersExit, bc#33, ExitValid) 47 1 37: D@44:<!0:-> MovHint(Check:Untyped:D@97, MustGen, loc8, W:SideState, ClobbersExit, bc#33, ExitInvalid) 48 1 37: D@123:<!0:-> KillStack(MustGen, this, W:Stack(this), ClobbersExit, bc#36, ExitValid) 49 1 37: D@47:<!0:-> MovHint(Check:Untyped:D@46, MustGen, this, W:SideState, ClobbersExit, bc#36, ExitInvalid) 50 1 37: D@49:<!0:-> PutClosureVar(KnownCell:D@29, Check:Untyped:Kill:D@46, MustGen, scope3, W:ScopeProperties(3), ClobbersExit, bc#39, ExitValid) 51 1 37: D@50:<!0:-> PutClosureVar(KnownCell:D@29, Check:Untyped:D@97, MustGen, scope4, W:ScopeProperties(4), ClobbersExit, bc#47, ExitValid) 52 1 37: D@51:<!0:-> NotifyWrite(MustGen, 0x7efd4eba8ce0, W:Watchpoint_fire,SideState, ClobbersExit, bc#47, ExitInvalid) 53 1 37: D@230:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#55, ExitValid) 54 1 37: D@53:<!0:-> PutClosureVar(KnownCell:D@29, Check:Untyped:Kill:D@22, MustGen, scope5, W:ScopeProperties(5), ClobbersExit, bc#55, ExitValid) 55 1 37: D@54:<!0:-> NotifyWrite(MustGen, 0x7efd4eba8d00, W:Watchpoint_fire,SideState, ClobbersExit, bc#55, ExitInvalid) 56 1 37: D@224:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#63, ExitValid) 57 1 37: D@55:< 2:-> CreateActivation(KnownCell:D@29, JS|PureInt, OtherObj, <0x7efd0e1c0320, SymbolTable>, R:HeapObjectCount, W:HeapObjectCount,Watchpoint_fire, ExitsForExceptions, ClobbersExit, bc#63, ExitValid) 58 1 37: D@122:<!0:-> KillStack(MustGen, loc9, W:Stack(loc9), ClobbersExit, bc#63, ExitInvalid) 59 1 37: D@56:<!0:-> MovHint(Check:Untyped:D@55, MustGen, loc9, W:SideState, ClobbersExit, bc#63, ExitInvalid) 60 1 37: D@220:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#63, exit: bc#68, ExitValid) 61 1 37: D@120:<!0:-> KillStack(MustGen, loc4, W:Stack(loc4), ClobbersExit, bc#68, ExitValid) 62 1 37: D@58:<!0:-> MovHint(Check:Untyped:Kill:D@55, MustGen, loc4, W:SideState, ClobbersExit, bc#68, ExitInvalid) 63 1 37: D@60:<!0:-> PutClosureVar(KnownCell:Kill:D@29, Check:Untyped:Kill:D@40, MustGen, scope2, W:ScopeProperties(2), ClobbersExit, bc#71, ExitValid) 64 1 37: D@61:<!0:-> NotifyWrite(MustGen, 0x7efd4eba8d20, W:Watchpoint_fire,SideState, ClobbersExit, bc#71, ExitInvalid) 65 1 37: D@183:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#79, ExitValid) 66 1 37: D@114:<!0:-> KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#79, ExitInvalid) 67 1 37: D@64:<!0:-> MovHint(Check:Untyped:D@63, MustGen, loc10, W:SideState, ClobbersExit, bc#79, ExitInvalid) 68 1 37: D@109:<!0:-> KillStack(MustGen, loc15, W:Stack(loc15), ClobbersExit, bc#83, ExitValid) 69 1 37: D@68:<!0:-> MovHint(Check:Untyped:D@98, MustGen, loc15, W:SideState, ClobbersExit, bc#83, ExitInvalid) 70 1 37: D@104:<!0:-> KillStack(MustGen, loc13, W:Stack(loc13), ClobbersExit, bc#91, ExitValid) 71 1 37: D@70:<!0:-> MovHint(Check:Untyped:D@98, MustGen, loc13, W:SideState, ClobbersExit, bc#91, ExitInvalid) 72 1 37: D@125:<!0:-> KillStack(MustGen, loc14, W:Stack(loc14), ClobbersExit, bc#94, ExitValid) 73 1 37: D@72:<!0:-> MovHint(Check:Untyped:D@97, MustGen, loc14, W:SideState, ClobbersExit, bc#94, ExitInvalid) 74 1 37: D@74:<!1:-> Construct(Check:Untyped:Kill:D@63, Check:Untyped:Kill:D@97, Check:Untyped:Kill:D@98, JS|MustGen|VarArgs|PureInt, Uint16Array, R:World, W:Heap, ExitsForExceptions, ClobbersExit, bc#97, ExitValid) predicting Uint16Array 75 1 37: D@124:<!0:-> KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#97, ExitInvalid) 76 1 37: D@75:<!0:-> MovHint(Check:Untyped:Kill:D@74, MustGen, loc10, W:SideState, ClobbersExit, bc#97, ExitInvalid) 77 1 37: D@158:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#97, exit: bc#103, ExitValid) 78 1 37: D@78:<!0:-> ForceOSRExit(MustGen, W:SideState, Exits, bc#103, ExitValid) 79 1 37: D@0:<!0:-> Unreachable(MustGen, W:SideState, bc#103, ExitValid) 1 37: States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated 1 37: Live: 1 37: Values: 2 37: Block #2 (bc#271): 2 37: Execution count: 10.000000 2 37: Predecessors: #4 2 37: Successors: #4 2 37: Dominated by: #0 #2 #3 #4 #10 2 37: Dominates: #2 2 37: Dominance Frontier: #4 2 37: Iterated Dominance Frontier: #4 #7 2 37: States: StructuresAreWatched 2 37: Live: D@33<Double>, D@34<Double>, D@46, D@71, D@189<Double>, D@193, D@198, D@207, D@212, D@219 2 37: Values: 0 2 37: D@108:<!0:-> ExitOK(MustGen, W:SideState, bc#271, ExitValid) 1 2 37: D@107:< 1:-> Upsilon(DoubleRep:Kill:D@189<Double>, ^195, W:SideState, bc#271, ExitValid) 2 2 37: D@173:<!0:-> Jump(MustGen, T:#4, W:SideState, bc#271, ExitValid) 2 37: States: InvalidBranchDirection, StructuresAreWatched 2 37: Live: D@33<Double>, D@34<Double>, D@46, D@71, D@193, shadow(D@195<Double>), D@198, D@207, D@212, D@219 2 37: Values: 3 37: Block #3 (bc#271): 3 37: Execution count: 10.000000 3 37: Predecessors: #10 3 37: Successors: #4 3 37: Dominated by: #0 #3 #10 3 37: Dominates: #2 #3 #4 #5 3 37: Dominance Frontier: #7 3 37: Iterated Dominance Frontier: #7 3 37: States: StructuresAreWatched 3 37: Live: D@33<Double>, D@34<Double>, D@46, D@71, D@86<Double>, D@193, D@198, D@207, D@212, D@219 3 37: Values: 0 3 37: D@144:<!0:-> ExitOK(MustGen, W:SideState, bc#271, ExitValid) 1 3 37: D@145:< 1:-> Upsilon(DoubleRep:Kill:D@86<Double>, ^195, W:SideState, bc#271, ExitValid) 2 3 37: D@169:<!0:-> Jump(MustGen, T:#4, W:SideState, bc#271, ExitValid) 3 37: States: InvalidBranchDirection, StructuresAreWatched 3 37: Live: D@33<Double>, D@34<Double>, D@46, D@71, D@193, shadow(D@195<Double>), D@198, D@207, D@212, D@219 3 37: Values: 4 37: Block #4 (bc#271): (OSR target) 4 37: Execution count: 10.000000 4 37: Predecessors: #3 #2 4 37: Successors: #2 #5 4 37: Dominated by: #0 #3 #4 #10 4 37: Dominates: #2 #4 #5 4 37: Dominance Frontier: #4 #7 4 37: Iterated Dominance Frontier: #4 #7 4 37: States: StructuresAreWatched 4 37: Live: D@33<Double>, D@34<Double>, D@46, D@71, D@193, shadow(D@195<Double>), D@198, D@207, D@212, D@219 4 37: Values: 0 4 37: D@195:< 3:-> Phi(Double|PureInt, AnyIntAsDouble|NonIntAsDouble, W:SideState, bc#271, ExitInvalid) 1 4 37: D@132:<!0:-> MovHint(DoubleRep:D@195<Double>, MustGen, loc10, W:SideState, ClobbersExit, bc#271, ExitInvalid) 2 4 37: D@131:<!0:-> ExitOK(MustGen, W:SideState, bc#271, ExitValid) 3 4 37: D@181:<!0:-> LoopHint(MustGen, W:SideState, bc#271, ExitValid) 4 4 37: D@182:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#272, ExitValid) 5 4 37: D@130:<!0:-> KillStack(MustGen, loc11, W:Stack(loc11), ClobbersExit, bc#273, ExitValid) 6 4 37: D@184:<!0:-> MovHint(Check:Untyped:D@46, MustGen, loc11, W:SideState, ClobbersExit, bc#273, ExitInvalid) 7 4 37: D@129:<!0:-> KillStack(MustGen, loc12, W:Stack(loc12), ClobbersExit, bc#276, ExitValid) 8 4 37: D@186:<!0:-> MovHint(Check:Untyped:D@46, MustGen, loc12, W:SideState, ClobbersExit, bc#276, ExitInvalid) 9 4 37: D@127:<!0:-> KillStack(MustGen, loc13, W:Stack(loc13), ClobbersExit, bc#279, ExitValid) 10 4 37: D@188:<!0:-> MovHint(Check:Untyped:D@46, MustGen, loc13, W:SideState, ClobbersExit, bc#279, ExitInvalid) 11 4 37: D@190:< 23:-> NewObject(JS|UseAsOther, Final, %D0:Object, R:HeapObjectCount, W:HeapObjectCount, Exits, bc#282, ExitValid) 12 4 37: D@126:<!0:-> KillStack(MustGen, loc14, W:Stack(loc14), ClobbersExit, bc#282, ExitValid) 13 4 37: D@191:<!0:-> MovHint(Check:Untyped:D@190, MustGen, loc14, W:SideState, ClobbersExit, bc#282, ExitInvalid) 14 4 37: D@194:<!0:-> FilterPutByIdStatus(Check:Untyped:D@190, MustGen, (<Transition: [0x7efd0e1f9810:[0x7826, Object, {}, NonArray, Proto:0x7efd4ebbd368]] to 0x7efd0e1cd0a0:[0xf19d, Object, {a:0}, NonArray, Proto:0x7efd4ebbd368], [[]], offset = 0, >), W:SideState, bc#286, ExitValid) 15 4 37: D@27:< 2:-> ValueRep(DoubleRep:D@195<Double>, JS|PureInt, BytecodeDouble, bc#286, ExitValid) 16 4 37: D@196:<!0:-> PutByOffset(KnownCell:D@190, KnownCell:D@190, Check:Untyped:D@27, MustGen, id12{a}, 0, W:NamedProperties(12), ClobbersExit, bc#286, ExitValid) 17 4 37: D@197:<!0:-> PutStructure(KnownCell:D@190, MustGen, %D0:Object -> %Ap:Object, ID:61853, R:JSObject_butterfly, W:JSCell_indexingType,JSCell_structureID,JSCell_typeInfoFlags, ClobbersExit, bc#286, ExitInvalid) 18 4 37: D@199:<!0:-> FilterPutByIdStatus(Check:Untyped:D@190, MustGen, (<Transition: [0x7efd0e1cd0a0:[0xf19d, Object, {a:0}, NonArray, Proto:0x7efd4ebbd368]] to 0x7efd0e1cd110:[0xf20f, Object, {d:1, a:0}, NonArray, Proto:0x7efd4ebbd368], [[]], offset = 1, >), W:SideState, bc#292, ExitValid) 19 4 37: D@201:<!0:-> PutByOffset(KnownCell:D@190, KnownCell:D@190, Check:Untyped:D@198, MustGen, id13{d}, 1, W:NamedProperties(13), ClobbersExit, bc#292, ExitValid) 20 4 37: D@202:<!0:-> PutStructure(KnownCell:D@190, MustGen, %Ap:Object -> %DG:Object, ID:61967, R:JSObject_butterfly, W:JSCell_indexingType,JSCell_structureID,JSCell_typeInfoFlags, ClobbersExit, bc#292, ExitInvalid) 21 4 37: D@203:<!0:-> FilterPutByIdStatus(Check:Untyped:D@190, MustGen, (<Transition: [0x7efd0e1cd110:[0xf20f, Object, {d:1, a:0}, NonArray, Proto:0x7efd4ebbd368]] to 0x7efd0e1cd180:[0xf669, Object, {e:2, d:1, a:0}, NonArray, Proto:0x7efd4ebbd368], [[]], offset = 2, >), W:SideState, bc#298, ExitValid) 22 4 37: D@205:<!0:-> PutByOffset(KnownCell:D@190, KnownCell:D@190, Check:Untyped:Kill:D@27, MustGen, id14{e}, 2, W:NamedProperties(14), ClobbersExit, bc#298, ExitValid) 23 4 37: D@206:<!0:-> PutStructure(KnownCell:D@190, MustGen, %DG:Object -> %Ax:Object, ID:63081, R:JSObject_butterfly, W:JSCell_indexingType,JSCell_structureID,JSCell_typeInfoFlags, ClobbersExit, bc#298, ExitInvalid) 24 4 37: D@208:<!0:-> FilterPutByIdStatus(Check:Untyped:D@190, MustGen, (<Transition: [0x7efd0e1cd180:[0xf669, Object, {e:2, d:1, a:0}, NonArray, Proto:0x7efd4ebbd368]] to 0x7efd0e1cd1f0:[0xf74f, Object, {length:3, e:2, d:1, a:0}, NonArray, Proto:0x7efd4ebbd368], [[]], offset = 3, >), W:SideState, bc#304, ExitValid) 25 4 37: D@210:<!0:-> PutByOffset(KnownCell:D@190, KnownCell:D@190, Check:Untyped:D@207, MustGen, id15{length}, 3, W:NamedProperties(15), ClobbersExit, bc#304, ExitValid) 26 4 37: D@211:<!0:-> PutStructure(KnownCell:D@190, MustGen, %Ax:Object -> %AR:Object, ID:63311, R:JSObject_butterfly, W:JSCell_indexingType,JSCell_structureID,JSCell_typeInfoFlags, ClobbersExit, bc#304, ExitInvalid) 27 4 37: D@119:<!0:-> KillStack(MustGen, loc15, W:Stack(loc15), ClobbersExit, bc#310, ExitValid) 28 4 37: D@213:<!0:-> MovHint(Check:Untyped:D@212, MustGen, loc15, W:SideState, ClobbersExit, bc#310, ExitInvalid) 29 4 37: D@118:<!0:-> KillStack(MustGen, loc16, W:Stack(loc16), ClobbersExit, bc#317, ExitValid) 30 4 37: D@221:<!0:-> MovHint(Check:Untyped:D@219, MustGen, loc16, W:SideState, ClobbersExit, bc#317, ExitInvalid) 31 4 37: D@223:<!0:-> FilterPutByIdStatus(Check:Untyped:D@190, MustGen, (<Transition: [0x7efd0e1cd1f0:[0xf74f, Object, {length:3, e:2, d:1, a:0}, NonArray, Proto:0x7efd4ebbd368]] to 0x7efd0e1cd260:[0xf798, Object, {a:0, d:1, e:2, length:3, toString:4}, NonArray, Proto:0x7efd4ebbd368, Leaf (Watched)], [[]], offset = 4, >), W:SideState, bc#325, ExitValid) 32 4 37: D@225:<!0:-> PutByOffset(KnownCell:D@190, KnownCell:D@190, Check:Untyped:D@219, MustGen, id17{toString}, 4, W:NamedProperties(17), ClobbersExit, bc#325, ExitValid) 33 4 37: D@226:<!0:-> PutStructure(KnownCell:D@190, MustGen, %AR:Object -> %Eme:Object, ID:63384, R:JSObject_butterfly, W:JSCell_indexingType,JSCell_structureID,JSCell_typeInfoFlags, ClobbersExit, bc#325, ExitInvalid) 34 4 37: D@117:<!0:-> KillStack(MustGen, loc13, W:Stack(loc13), ClobbersExit, bc#331, ExitValid) 35 4 37: D@227:<!0:-> MovHint(Check:Untyped:D@190, MustGen, loc13, W:SideState, ClobbersExit, bc#331, ExitInvalid) 36 4 37: D@229:< 4:-> GetClosureVar(KnownCell:D@71, JS|UseAsOther, Uint16Array, scope3, R:ScopeProperties(3), Exits, bc#334, ExitValid) predicting Uint16Array 37 4 37: D@116:<!0:-> KillStack(MustGen, this, W:Stack(this), ClobbersExit, bc#334, ExitValid) 38 4 37: D@228:<!0:-> MovHint(Check:Untyped:D@229, MustGen, this, W:SideState, ClobbersExit, bc#334, ExitInvalid) 39 4 37: D@222:<!0:-> CheckNotEmpty(Check:Untyped:D@229, MustGen, Exits, bc#342, ExitValid) 40 4 37: D@216:<!1:-> InByVal(Check:Cell:D@229, Check:Untyped:Kill:D@190, Boolean|MustGen|PureInt, Bool, Uint16Array+NonArray+InBounds+AsIs+Read, R:World, W:Heap, Exits, ClobbersExit, bc#344, ExitValid) 41 4 37: D@113:<!0:-> KillStack(MustGen, loc12, W:Stack(loc12), ClobbersExit, bc#344, ExitInvalid) 42 4 37: D@214:<!0:-> MovHint(Check:Untyped:Kill:D@216, MustGen, loc12, W:SideState, ClobbersExit, bc#344, ExitInvalid) 43 4 37: D@146:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#344, exit: bc#349, ExitValid) 44 4 37: D@112:<!0:-> KillStack(MustGen, loc11, W:Stack(loc11), ClobbersExit, bc#349, ExitValid) 45 4 37: D@192:<!0:-> MovHint(Check:Untyped:D@193, MustGen, loc11, W:SideState, ClobbersExit, bc#349, ExitInvalid) 46 4 37: D@189:< 3:-> ArithAdd(DoubleRep:Kill:D@195<Double>, DoubleRep:D@33<Double>, Double|UseAsOther, AnyIntAsDouble|NonIntAsDouble, Unchecked, Exits, bc#352, ExitValid) 47 4 37: D@111:<!0:-> KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#352, ExitInvalid) 48 4 37: D@187:<!0:-> MovHint(DoubleRep:D@189<Double>, MustGen, loc10, W:SideState, ClobbersExit, bc#352, ExitInvalid) 49 4 37: D@177:< 1:-> CompareLess(DoubleRep:D@189<Double>, DoubleRep:D@34<Double>, Boolean|UseAsOther, Bool, Exits, bc#355, ExitValid) 50 4 37: D@175:<!0:-> Branch(KnownBoolean:Kill:D@177, MustGen, T:#2/w:10.000000, F:#5/w:1.000000, W:SideState, bc#355, ExitInvalid) 4 37: States: TakeBoth, StructuresAreWatched 4 37: Live: D@33<Double>, D@34<Double>, D@46, D@71, D@189<Double>, D@193, D@198, D@207, D@212, D@219, D@229 4 37: Values: 5 37: Block #5 (bc#359): 5 37: Execution count: 1.000000 5 37: Predecessors: #4 5 37: Successors: #7 5 37: Dominated by: #0 #3 #4 #5 #10 5 37: Dominates: #5 5 37: Dominance Frontier: #7 5 37: Iterated Dominance Frontier: #7 5 37: States: StructuresAreWatched 5 37: Live: D@229 5 37: Values: 0 5 37: D@106:<!0:-> ExitOK(MustGen, W:SideState, bc#359, ExitValid) 1 5 37: D@101:< 1:-> Upsilon(Check:Untyped:Kill:D@229, ^84, W:SideState, bc#359, ExitValid) 2 5 37: D@1:<!0:-> Jump(MustGen, T:#7, W:SideState, bc#359, ExitValid) 5 37: States: InvalidBranchDirection, StructuresAreWatched 5 37: Live: shadow(D@84) 5 37: Values: 6 37: Block #6 (bc#359): 6 37: Execution count: 1.000000 6 37: Predecessors: #10 6 37: Successors: #7 6 37: Dominated by: #0 #6 #10 6 37: Dominates: #6 6 37: Dominance Frontier: #7 6 37: Iterated Dominance Frontier: #7 6 37: States: StructuresAreWatched 6 37: Live: D@31 6 37: Values: 0 6 37: D@90:<!0:-> ExitOK(MustGen, W:SideState, bc#359, ExitValid) 1 6 37: D@88:< 1:-> Upsilon(Check:Untyped:Kill:D@31, ^84, W:SideState, bc#359, ExitValid) 2 6 37: D@172:<!0:-> Jump(MustGen, T:#7, W:SideState, bc#359, ExitValid) 6 37: States: InvalidBranchDirection, StructuresAreWatched 6 37: Live: shadow(D@84) 6 37: Values: 7 37: Block #7 (bc#359): 7 37: Execution count: 1.000000 7 37: Predecessors: #5 #6 7 37: Successors: #9 7 37: Dominated by: #0 #7 #10 7 37: Dominates: #7 #9 7 37: Dominance Frontier: 7 37: Iterated Dominance Frontier: 7 37: States: StructuresAreWatched 7 37: Live: shadow(D@84) 7 37: Values: 0 7 37: D@84:< 1:-> Phi(JS|PureInt, Uint16Array, W:SideState, bc#359, ExitInvalid) 1 7 37: D@100:<!0:-> MovHint(Check:Untyped:Kill:D@84, MustGen, this, W:SideState, ClobbersExit, bc#359, ExitInvalid) 2 7 37: D@99:<!0:-> ExitOK(MustGen, W:SideState, bc#359, ExitValid) 3 7 37: D@94:<!0:-> ExitOK(MustGen, W:SideState, bc#363, ExitValid) 4 7 37: D@87:<!0:-> Jump(MustGen, T:#9, W:SideState, bc#363, ExitValid) 7 37: States: InvalidBranchDirection, StructuresAreWatched 7 37: Live: 7 37: Values: 9 37: Block #9 (bc#363): (OSR target) 9 37: Execution count: 10.000000 9 37: Predecessors: #7 #9 9 37: Successors: #9 9 37: Dominated by: #0 #7 #9 #10 9 37: Dominates: #9 9 37: Dominance Frontier: #9 9 37: Iterated Dominance Frontier: #9 9 37: States: StructuresAreWatched 9 37: Live: 9 37: Values: 0 9 37: D@91:<!0:-> ExitOK(MustGen, W:SideState, bc#363, ExitValid) 1 9 37: D@157:<!0:-> LoopHint(MustGen, W:SideState, bc#363, ExitValid) 2 9 37: D@154:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#364, ExitValid) 3 9 37: D@128:<!0:-> Jump(MustGen, T:#9, W:SideState, bc#365, ExitInvalid) 9 37: States: InvalidBranchDirection, StructuresAreWatched 9 37: Live: 9 37: Values: 10 37: Block #10 (bc#381): (Catch Entrypoint) 10 37: Execution count: 1.000000 10 37: Predecessors: #0 10 37: Successors: #3 #6 10 37: Dominated by: #0 #10 10 37: Dominates: #2 #3 #4 #5 #6 #7 #9 #10 10 37: Dominance Frontier: 10 37: Iterated Dominance Frontier: 10 37: States: StructuresAreWatched 10 37: Live: D@3, D@33<Double>, D@34<Double>, D@46, D@193, D@198, D@207, D@212, D@219 10 37: Values: 0 10 37: D@215:<!0:-> InitializeEntrypointArguments(MustGen, W:SideState, ClobbersExit, bc#381, ExitInvalid) 1 10 37: D@95:<!0:-> ExitOK(MustGen, W:SideState, bc#381, ExitInvalid) 2 10 37: D@71:< 3:-> ExtractCatchLocal(JS|UseAsOther, OtherObj, R:CatchLocals(0), bc#381, ExitInvalid) 3 10 37: D@121:<!0:-> KillStack(MustGen, loc6, W:Stack(loc6), ClobbersExit, bc#381, ExitInvalid) 4 10 37: D@69:<!0:-> MovHint(Check:Untyped:D@71, MustGen, loc6, W:SideState, ClobbersExit, bc#381, ExitInvalid) 5 10 37: D@65:< 8:-> ExtractCatchLocal(JS|UseAsOther, OtherObj, R:CatchLocals(1), bc#381, ExitInvalid) 6 10 37: D@115:<!0:-> KillStack(MustGen, loc9, W:Stack(loc9), ClobbersExit, bc#381, ExitInvalid) 7 10 37: D@59:<!0:-> MovHint(Check:Untyped:D@65, MustGen, loc9, W:SideState, ClobbersExit, bc#381, ExitInvalid) 8 10 37: D@57:< 2:-> ExtractCatchLocal(JS|PureNum, OtherObj, R:CatchLocals(2), bc#381, ExitInvalid) 9 10 37: D@110:<!0:-> KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#381, ExitInvalid) 10 10 37: D@48:<!0:-> MovHint(Check:Untyped:D@57, MustGen, loc10, W:SideState, ClobbersExit, bc#381, ExitInvalid) 11 10 37: D@45:<!0:-> ClearCatchLocals(MustGen, W:CatchLocals, ClobbersExit, bc#381, ExitInvalid) 12 10 37: D@43:<!0:-> ExitOK(MustGen, W:SideState, bc#381, ExitValid) 13 10 37: D@31:< 1:-> GetStack(JS|PureInt, Uint16Array, this, FlushedJSValue, R:Stack(this), bc#381, exit: bc#385, ExitValid) 14 10 37: D@96:< 0:-> GetStack(JS|PureInt, Other, arg1, FlushedJSValue, R:Stack(arg1), bc#381, exit: bc#385, ExitValid) 15 10 37: D@204:< 0:-> GetStack(JS|PureInt, Other, arg2, FlushedJSValue, R:Stack(arg2), bc#381, exit: bc#385, ExitValid) 16 10 37: D@42:<!0:-> Check(Check:Cell:D@71, MustGen, Exits, bc#381, exit: bc#385, ExitValid) 17 10 37: D@37:<!0:-> Check(Check:Cell:D@65, MustGen, Exits, bc#381, exit: bc#385, ExitValid) 18 10 37: D@105:<!0:-> KillStack(MustGen, loc4, W:Stack(loc4), ClobbersExit, bc#195, ExitValid) 19 10 37: D@134:<!0:-> MovHint(Check:Untyped:D@65, MustGen, loc4, W:SideState, ClobbersExit, bc#195, ExitInvalid) 20 10 37: D@2:<!0:-> KillStack(MustGen, loc11, W:Stack(loc11), ClobbersExit, bc#198, ExitValid) 21 10 37: D@137:<!0:-> MovHint(Check:Untyped:D@46, MustGen, loc11, W:SideState, ClobbersExit, bc#198, ExitInvalid) 22 10 37: D@136:<!0:-> KillStack(MustGen, loc11, W:Stack(loc11), ClobbersExit, bc#201, ExitValid) 23 10 37: D@140:<!0:-> MovHint(Check:Untyped:Kill:D@57, MustGen, loc11, W:SideState, ClobbersExit, bc#201, ExitInvalid) 24 10 37: D@138:<!0:-> KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#204, ExitValid) 25 10 37: D@143:<!0:-> MovHint(Check:Untyped:Kill:D@3, MustGen, loc10, W:SideState, ClobbersExit, bc#204, ExitInvalid) 26 10 37: D@147:< 2:-> NewAsyncFunction(KnownCell:D@65, JS|UseAsOther, Function, <0x7efd0e1e5b80, FunctionExecutable>, v25#<nogen>/<nogen>:[0x7efd0e1e5b80], R:HeapObjectCount, W:HeapObjectCount,Watchpoint_fire, ExitsForExceptions, ClobbersExit, bc#207, ExitValid) 27 10 37: D@139:<!0:-> KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#207, ExitInvalid) 28 10 37: D@148:<!0:-> MovHint(Check:Untyped:D@147, MustGen, loc10, W:SideState, ClobbersExit, bc#207, ExitInvalid) 29 10 37: D@149:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#207, exit: bc#211, ExitValid) 30 10 37: D@152:<!0:-> PutClosureVar(KnownCell:D@65, Check:Untyped:Kill:D@147, MustGen, scope3, W:ScopeProperties(3), ClobbersExit, bc#211, ExitValid) 31 10 37: D@153:<!0:-> NotifyWrite(MustGen, 0x7efd4eba8d80, W:Watchpoint_fire,SideState, ClobbersExit, bc#211, ExitInvalid) 32 10 37: D@150:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#219, ExitValid) 33 10 37: D@155:< 2:-> GetClosureVar(KnownCell:D@65, JS|UseAsOther, NonIntAsDouble, scope0, R:ScopeProperties(0), Exits, bc#219, ExitValid) predicting NonIntAsDouble 34 10 37: D@141:<!0:-> KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#219, ExitValid) 35 10 37: D@156:<!0:-> MovHint(Check:Untyped:D@155, MustGen, loc10, W:SideState, ClobbersExit, bc#219, ExitInvalid) 36 10 37: D@93:< 4:-> DoubleRep(Check:RealNumber:Kill:D@155, Double|PureInt, BytecodeDouble, Exits, bc#227, ExitValid) 37 10 37: D@5:<!0:-> KillStack(MustGen, loc11, W:Stack(loc11), ClobbersExit, bc#227, ExitInvalid) 38 10 37: D@159:<!0:-> MovHint(DoubleRep:D@93<Double>, MustGen, loc11, W:SideState, ClobbersExit, bc#227, ExitInvalid) 39 10 37: D@92:< 4:-> ValueRep(DoubleRep:D@93<Double>, JS|PureInt, BytecodeDouble, bc#227, exit: bc#231, ExitValid) 40 10 37: D@7:<!0:-> KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#231, ExitValid) 41 10 37: D@161:<!0:-> MovHint(DoubleRep:D@93<Double>, MustGen, loc10, W:SideState, ClobbersExit, bc#231, ExitInvalid) 42 10 37: D@163:< 2:-> ArithAdd(DoubleRep:Kill:D@93<Double>, DoubleRep:D@33<Double>, Double|UseAsOther, AnyIntAsDouble|NonIntAsDouble, Unchecked, Exits, bc#234, ExitValid) 43 10 37: D@9:<!0:-> KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#234, ExitInvalid) 44 10 37: D@164:<!0:-> MovHint(DoubleRep:D@163<Double>, MustGen, loc10, W:SideState, ClobbersExit, bc#234, ExitInvalid) 45 10 37: D@89:< 1:-> ValueRep(DoubleRep:Kill:D@163<Double>, JS|PureInt, BytecodeDouble, bc#234, exit: bc#237, ExitValid) 46 10 37: D@166:<!0:-> PutClosureVar(KnownCell:D@65, Check:Untyped:Kill:D@89, MustGen, scope0, W:ScopeProperties(0), ClobbersExit, bc#237, ExitValid) 47 10 37: D@167:<!0:-> PutClosureVar(KnownCell:Kill:D@65, Check:Untyped:D@92, MustGen, scope1, W:ScopeProperties(1), ClobbersExit, bc#245, ExitValid) 48 10 37: D@168:<!0:-> NotifyWrite(MustGen, 0x7efd4eba8da0, W:Watchpoint_fire,SideState, ClobbersExit, bc#245, ExitInvalid) 49 10 37: D@151:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#253, ExitValid) 50 10 37: D@11:<!0:-> KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#253, ExitValid) 51 10 37: D@170:<!0:-> MovHint(Check:Untyped:D@46, MustGen, loc10, W:SideState, ClobbersExit, bc#253, ExitInvalid) 52 10 37: D@13:<!0:-> KillStack(MustGen, loc11, W:Stack(loc11), ClobbersExit, bc#256, ExitValid) 53 10 37: D@174:<!0:-> MovHint(Check:Untyped:D@92, MustGen, loc11, W:SideState, ClobbersExit, bc#256, ExitInvalid) 54 10 37: D@142:<!0:-> KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#264, ExitValid) 55 10 37: D@176:<!0:-> MovHint(Check:Untyped:D@92, MustGen, loc10, W:SideState, ClobbersExit, bc#264, ExitInvalid) 56 10 37: D@86:< 2:-> DoubleRep(RealNumber:Kill:D@92, Double|PureInt, BytecodeDouble, bc#264, exit: bc#267, ExitValid) 57 10 37: D@179:< 1:-> CompareLess(DoubleRep:D@86<Double>, DoubleRep:D@34<Double>, Boolean|UseAsOther, Bool, Exits, bc#267, ExitValid) 58 10 37: D@180:<!0:-> Branch(KnownBoolean:Kill:D@179, MustGen, T:#3/w:10.000000, F:#6/w:1.000000, W:SideState, bc#267, ExitInvalid) 10 37: States: TakeBoth, StructuresAreWatched 10 37: Live: D@31, D@33<Double>, D@34<Double>, D@46, D@71, D@86<Double>, D@193, D@198, D@207, D@212, D@219 10 37: Values: 37: GC Values: 37: Weak:Object: 0x7efd0e1d4240 with butterfly 0x7ee0163fe148 (Structure %Em:Function), StructureID: 58385 37: Strong:String (atomic),8Bit:(1),length:(76): const v39 = v38.concat(); v39; , StructureID: 15293 37: Weak:Object: 0x7efd0e1d4000 with butterfly 0x7ee0163fce68 (Structure %Ak:Function), StructureID: 45983 37: Weak:Object: 0x7efd0e7fa068 with butterfly 0x7ee0163e4408 (Structure %B6:global), StructureID: 53674 37: Strong:Cell: 0x7efd0e1e5b80 (%AG:FunctionExecutable), StructureID: 18549 37: Weak:Object: 0x7efd4eba9768 with butterfly 0x7ee0163e0010 (Structure %Cw:Array,ArrayWithDouble), StructureID: 35566 37: Weak:Object: 0x7efd4ebb6de8 with butterfly 0x7ee0163d8038 (Structure %EW:Array,ArrayWithContiguous), StructureID: 34627 37: Weak:Object: 0x7efd0e1b8000 with butterfly (nil) (Structure %BW:JSLexicalEnvironment), StructureID: 31388 37: Strong:String (atomic),8Bit:(1),length:(70): const v21 = (-1914445586)[v20]; v21; , StructureID: 15293 37: Strong:String (atomic),8Bit:(1),length:(58): 'super()' can't be called more than once in a constructor., StructureID: 15293 37: Strong:Cell: 0x7efd0e1c0320 (%AM:SymbolTable), StructureID: 19832 37: Strong:Cell: 0x7efd0e1c02d0 (%AM:SymbolTable), StructureID: 19832 37: Weak:Object: 0x7efd0e1bc060 with butterfly (nil) (Structure %BW:JSLexicalEnvironment), StructureID: 31388 37: Weak:Object: 0x7efd0e1f6080 with butterfly 0x7ee0163fe168 (Structure %EN:Function), StructureID: 59661 37: Desired watchpoints: 37: Watchpoint sets: 0x7efd4eba8080, 0x7efd4eba8100, 0x7efd4ebca4c0 37: Inline watchpoint sets: 0x7efd0e1fb548, 0x7efd0e1ccc28, 0x7efd0e1cc9f8, 0x7efd0e1f99b8, 0x7efd0e1f84b8, 0x7efd0e1f9fd8, 0x7efd0e1f8288, 0x7efd0e1f9b78, 0x7efd4ebd40c0, 0x7efd0e1cd2b8, 0x7efd0e1f8448, 0x7efd4ebd4280, 0x7efd0e1fb008 37: SymbolTables: 0x7efd0e1c0000 37: FunctionExecutables: 0x7efd0e1e5280 37: Buffer views: 37: Object property conditions: <Object: 0x7efd0e7fa068 with butterfly 0x7ee0163e4408 (Structure %B6:global), StructureID: 53674: Equivalence of String with Object: 0x7efd0e1d4000 with butterfly 0x7ee0163fce68 (Structure %Ak:Function), StructureID: 45983> 37: Structures: 37: %AG:FunctionExecutable = 0x7efd0e1f8230:[0x4875, FunctionExecutable, {}, NonArray, Leaf (Watched)] 37: %AM:SymbolTable = 0x7efd0e1f8460:[0x4d78, SymbolTable, {}, NonArray, Leaf (Watched)] 37: %AR:Object = 0x7efd0e1cd1f0:[0xf74f, Object, {length:3, e:2, d:1, a:0}, NonArray, Proto:0x7efd4ebbd368] 37: %Ak:Function = 0x7efd0e1fafb0:[0xb39f, Function, {length:100, name:101, prototype:102}, NonArray, Proto:0x7efd4ebfc248, Leaf (Watched)] 37: %Ap:Object = 0x7efd0e1cd0a0:[0xf19d, Object, {a:0}, NonArray, Proto:0x7efd4ebbd368] 37: %Ax:Object = 0x7efd0e1cd180:[0xf669, Object, {e:2, d:1, a:0}, NonArray, Proto:0x7efd4ebbd368] 37: %B6:global = 0x7efd0e1cc000:[0xd1aa, global, {Object:100, Function:101, Array:102, RegExp:103, SharedArrayBuffer:104, Atomics:105, String:106, Promise:107, BigInt:108, WeakRef:109, FinalizationRegistry:110, Intl:111, WebAssembly:112, Symbol.toStringTag:113, debug:114, describe:115, describeArray:116, print:117, printErr:118, quit:119, gc:120, fullGC:121, edenGC:122, gcHeapSize:123, MemoryFootprint:124, resetMemoryPeak:125, addressOf:126, version:127, run:128, runString:129, load:130, loadString:131, readFile:132, read:133, checkSyntax:134, sleepSeconds:135, jscStack:136, readline:137, preciseTime:138, neverInlineFunction:139, noInline:140, noDFG:141, noFTL:142, noOSRExitFuzzing:143, numberOfDFGCompiles:144, callerIsOMGCompiled:145, jscOptions:146, optimizeNextInvocation:147, reoptimizationRetryCount:148, transferArrayBuffer:149, failNextNewCodeBlock:150, OSRExit:151, isFinalTier:152, predictInt32:153, isInt32:154, isPureNaN:155, fiatInt52:156, effectful42:157, makeMasquerader:158, hasCustomProperties:159, createGlobalObject:160, createHeapBigInt:161, useBigInt32:162, isBigInt32:163, isHeapBigInt:164, dumpTypesForAllVariables:165, drainMicrotasks:166, setTimeout:167, releaseWeakRefs:168, finalizationRegistryLiveCount:169, finalizationRegistryDeadCount:170, getRandomSeed:171, setRandomSeed:172, isRope:173, callerSourceOrigin:174, is32BitPlatform:175, checkModuleSyntax:176, platformSupportsSamplingProfiler:177, generateHeapSnapshot:178, generateHeapSnapshotForGCDebugging:179, resetSuperSamplerState:180, ensureArrayStorage:181, startSamplingProfiler:182, samplingProfilerStackTraces:183, maxArguments:184, asyncTestStart:185, asyncTestPassed:186, WebAssemblyMemoryMode:187, console:188, $:189, $262:190, waitForReport:191, heapCapacity:192, flashHeapAccess:193, disableRichSourceInfo:194, mallocInALoop:195, totalCompileTime:196, fuzzilli:197, setUnhandledRejectionCallback:198, asDoubleNumber:199, dropAllLocks:200, Uint16Array:201, Uint16Array:202}, NonArray, Proto:0x7efd4ebbd368, Dictionary, Leaf (Watched)] 37: %BW:JSLexicalEnvironment = 0x7efd0e1f9960:[0x7a9c, JSLexicalEnvironment, {}, NonArray, Leaf (Watched)] 37: %Cw:Array,ArrayWithDouble = 0x7efd0e1f9f80:[0x8aee, Array, {}, CopyOnWriteArrayWithDouble, Proto:0x7efd4ebbd7e8, Leaf (Watched)] 37: %D0:Object = 0x7efd0e1f9810:[0x7826, Object, {}, NonArray, Proto:0x7efd4ebbd368] 37: %DG:Object = 0x7efd0e1cd110:[0xf20f, Object, {d:1, a:0}, NonArray, Proto:0x7efd4ebbd368] 37: %EN:Function = 0x7efd0e1ccbd0:[0xe90d, Function, {homeObject:100, prototype:101}, NonArray, Proto:0x7efd0e1d4240, Leaf (Watched)] 37: %EW:Array,ArrayWithContiguous = 0x7efd0e1f9dc0:[0x8743, Array, {}, ArrayWithContiguous, Proto:0x7efd4ebbd7e8] 37: %Em:Function = 0x7efd0e1cc9a0:[0xe411, Function, {length:100, name:101, prototype:102, BYTES_PER_ELEMENT:103}, NonArray, Proto:0x7efd0e1d4210, Leaf (Watched)] 37: %Eme:Object = 0x7efd0e1cd260:[0xf798, Object, {a:0, d:1, e:2, length:3, toString:4}, NonArray, Proto:0x7efd4ebbd368, Leaf (Watched)] DFG ASSERTION FAILED: Live bytecode local not available: operand = this, availabilityMap = {locals = arg2:FlushedJSValue/Unavailable arg1:FlushedJSValue/Unavailable loc4:ConflictingFlush/D@65 loc6:ConflictingFlush/D@71 loc10:ConflictingFlush/D@195<Double>; heap = }, origin = bc#271 ../../Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp(174) : bool JSC::DFG::OSRAvailabilityAnalysisPhase<(lambda at ../../Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp:193:31), (lambda at ../../Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp:194:31)>::run() [HeadFunctor = (lambda at ../../Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp:193:31), TailFunctor = (lambda at ../../Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp:194:31)] Aborted (core dumped)

Attachments
poc (72.10 KB, text/x-matlab) 2021-04-08 19:04 PDT, rain	no flags	Details
View All Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2021-04-09 18:09:30 PDT

<rdar://problem/76479457>

Yusuke Suzuki

Comment 2 2021-04-10 00:45:04 PDT

Thanks for your report! I've tried and I cannot reproduce this crash. Can you offer 1. which revision you used 2. which command line options you added

Yusuke Suzuki

Comment 3 2021-04-10 00:45:23 PDT

Reopened.

rain

Comment 4 2021-04-10 01:00:29 PDT

I compile it with afl+asan.

rain

Comment 5 2021-04-10 01:06:06 PDT

Command: ./jsc poc Enviroment: ubuntu18.04 Compile command: refer to this:https://github.com/sslab-gatech/DIE/blob/master/engines/build-jsc-cov.sh and set the environment variable: export AFL_USE_ASAN=1

Yusuke Suzuki

Comment 6 2021-04-10 01:08:06 PDT

What is the revision? Is this still reproducible with Tip-of-trunk?

Yusuke Suzuki

Comment 7 2021-04-10 01:13:19 PDT

OK, now I've found that this is dupe of bug 221353 :) *** This bug has been marked as a duplicate of bug 221353 ***

Note You need to log in before you can comment on or make changes to this bug.