Bug 148239 – Rare failure in regress/script-tests/sink-huge-activation.js.ftl-eager

• Status: NEW
• Component: JavaScriptCore

[Filip Pizlo]

Here's the text of the failure.  I wasn't able to reproduce it.  It was a debug build.





At @53: validation failed: !edge->isPhantomAllocation() (/Volumes/Data/tertiary/OpenSource/Source/JavaScriptCore/dfg/DFGValidate.cpp:562).

At time of failure:

DFG for foo#<no-hash>:[0x1046dab90->0x1046da250->0x104487b00, DFGFunctionCall, 205 (NeverInline)]:
  Fixpoint state: FixpointConverged; Form: SSA; Unification state: GloballyUnified; Ref count state: ExactRefCount
  Argument formats: FlushedJSValue, FlushedBoolean

Block #0 (<none>): (OSR target)
  Execution count: 1.000000
  Predecessors:
  Successors: #1 (ForwardEdge) #2 (ForwardEdge)
  Dominated by: #0
  Dominates: #0 #1 #2
  Dominance Frontier: 
  Iterated Dominance Frontier: 
  Pre/Post Numbering: 0/2
  States: StructuresAreWatched
  Availability: {locals = arg1:arg1:FlushedBoolean/Unavailable arg0:this:FlushedJSValue/Unavailable; heap = }
  Live: 
  Values: 
 118:< 2:->	JSConstant(JS|PureInt, Othercell, Strong:Cell: 0x10446c790 (%CC:SymbolTable), ID: 19)
 119:< 20:->	JSConstant(JS|PureInt, Other, Undefined)
  49:< 2:->	JSConstant(JS|UseAsOther, Function, Weak:Cell: 0x104458ca0 (%CG:Function), ID: 39)
  12:< 5:->	JSConstant(JS|UseAsOther, Otherobj, Weak:Cell: 0x104443800 (%Ak:global), ID: 413)
  22:< 42:->	JSConstant(JS|UseAsOther, Boolint32, Int32: 0)
 101:< 1:->	GetStack(JS|PureInt, Bool, arg1, machine:arg1, FlushedBoolean, R:Stack(6), bc#0)
 102:<!0:->	KillStack(MustGen, loc0, W:SideState, bc#0)
   3:<!0:->	ZombieHint(MustGen, loc0, W:SideState, bc#0)
 103:<!0:->	KillStack(MustGen, loc1, W:SideState, bc#0)
   5:<!0:->	ZombieHint(MustGen, loc1, W:SideState, bc#0)
 104:<!0:->	KillStack(MustGen, loc2, W:SideState, bc#0)
   7:<!0:->	ZombieHint(MustGen, loc2, W:SideState, bc#0)
 105:<!0:->	KillStack(MustGen, loc3, W:SideState, bc#0)
   9:<!0:->	ZombieHint(MustGen, loc3, W:SideState, bc#0)
 106:<!0:->	KillStack(MustGen, loc0, W:SideState, bc#1)
  13:<!0:->	MovHint(@12, MustGen, loc0, W:SideState, bc#1)
 107:<!0:->	KillStack(MustGen, loc1, W:SideState, bc#3)
  15:<!0:->	ZombieHint(MustGen, loc1, W:SideState, bc#3)
  17:<!45:->	PhantomCreateActivation(JS|MustGen|UseAsOther, Otherobj, R:HeapObjectCount, W:HeapObjectCount, bc#6)
 120:<!0:->	PutHint(@17, @118, MustGen, ActivationSymbolTablePLoc(0), W:SideState, bc#6)
 121:<!0:->	PutHint(@17, @12, MustGen, ActivationScopePLoc(0), W:SideState, bc#6)
 122:<!0:->	PutHint(@17, @119, MustGen, ClosureVarPLoc(0), W:SideState, bc#6)
 123:<!0:->	PutHint(@17, @119, MustGen, ClosureVarPLoc(1), W:SideState, bc#6)
 124:<!0:->	PutHint(@17, @119, MustGen, ClosureVarPLoc(2), W:SideState, bc#6)
 125:<!0:->	PutHint(@17, @119, MustGen, ClosureVarPLoc(3), W:SideState, bc#6)
 126:<!0:->	PutHint(@17, @119, MustGen, ClosureVarPLoc(4), W:SideState, bc#6)
 127:<!0:->	PutHint(@17, @119, MustGen, ClosureVarPLoc(5), W:SideState, bc#6)
 128:<!0:->	PutHint(@17, @119, MustGen, ClosureVarPLoc(6), W:SideState, bc#6)
 129:<!0:->	PutHint(@17, @119, MustGen, ClosureVarPLoc(7), W:SideState, bc#6)
 130:<!0:->	PutHint(@17, @119, MustGen, ClosureVarPLoc(8), W:SideState, bc#6)
 131:<!0:->	PutHint(@17, @119, MustGen, ClosureVarPLoc(9), W:SideState, bc#6)
 132:<!0:->	PutHint(@17, @119, MustGen, ClosureVarPLoc(10), W:SideState, bc#6)
 133:<!0:->	PutHint(@17, @119, MustGen, ClosureVarPLoc(11), W:SideState, bc#6)
 134:<!0:->	PutHint(@17, @119, MustGen, ClosureVarPLoc(12), W:SideState, bc#6)
 135:<!0:->	PutHint(@17, @119, MustGen, ClosureVarPLoc(13), W:SideState, bc#6)
 136:<!0:->	PutHint(@17, @119, MustGen, ClosureVarPLoc(14), W:SideState, bc#6)
 137:<!0:->	PutHint(@17, @119, MustGen, ClosureVarPLoc(15), W:SideState, bc#6)
 138:<!0:->	PutHint(@17, @119, MustGen, ClosureVarPLoc(16), W:SideState, bc#6)
 139:<!0:->	PutHint(@17, @119, MustGen, ClosureVarPLoc(17), W:SideState, bc#6)
 140:<!0:->	PutHint(@17, @119, MustGen, ClosureVarPLoc(18), W:SideState, bc#6)
 141:<!0:->	PutHint(@17, Kill:@119, MustGen, ClosureVarPLoc(19), W:SideState, bc#6)
 108:<!0:->	KillStack(MustGen, loc2, W:SideState, bc#6)
  18:<!0:->	MovHint(@17, MustGen, loc2, W:SideState, bc#6)
 109:<!0:->	KillStack(MustGen, loc0, W:SideState, bc#11)
  20:<!0:->	MovHint(@17, MustGen, loc0, W:SideState, bc#11)
 142:<!0:->	PutHint(@17, @22, MustGen, ClosureVarPLoc(16), W:SideState, bc#14)
 143:<!0:->	PutHint(@17, @22, MustGen, ClosureVarPLoc(15), W:SideState, bc#21)
 144:<!0:->	PutHint(@17, @22, MustGen, ClosureVarPLoc(10), W:SideState, bc#28)
 145:<!0:->	PutHint(@17, @22, MustGen, ClosureVarPLoc(14), W:SideState, bc#35)
 146:<!0:->	PutHint(@17, @22, MustGen, ClosureVarPLoc(9), W:SideState, bc#42)
 147:<!0:->	PutHint(@17, @22, MustGen, ClosureVarPLoc(3), W:SideState, bc#49)
 148:<!0:->	PutHint(@17, @22, MustGen, ClosureVarPLoc(13), W:SideState, bc#56)
 149:<!0:->	PutHint(@17, @22, MustGen, ClosureVarPLoc(8), W:SideState, bc#63)
 150:<!0:->	PutHint(@17, @22, MustGen, ClosureVarPLoc(2), W:SideState, bc#70)
 151:<!0:->	PutHint(@17, @22, MustGen, ClosureVarPLoc(7), W:SideState, bc#77)
 152:<!0:->	PutHint(@17, @22, MustGen, ClosureVarPLoc(18), W:SideState, bc#84)
 153:<!0:->	PutHint(@17, @22, MustGen, ClosureVarPLoc(5), W:SideState, bc#91)
 154:<!0:->	PutHint(@17, @22, MustGen, ClosureVarPLoc(0), W:SideState, bc#98)
 155:<!0:->	PutHint(@17, @22, MustGen, ClosureVarPLoc(6), W:SideState, bc#105)
 156:<!0:->	PutHint(@17, @22, MustGen, ClosureVarPLoc(4), W:SideState, bc#112)
 157:<!0:->	PutHint(@17, @22, MustGen, ClosureVarPLoc(11), W:SideState, bc#119)
 158:<!0:->	PutHint(@17, @22, MustGen, ClosureVarPLoc(19), W:SideState, bc#126)
 159:<!0:->	PutHint(@17, @22, MustGen, ClosureVarPLoc(12), W:SideState, bc#133)
 160:<!0:->	PutHint(@17, @22, MustGen, ClosureVarPLoc(17), W:SideState, bc#140)
 161:<!0:->	PutHint(@17, @22, MustGen, ClosureVarPLoc(1), W:SideState, bc#147)
  44:<!0:->	Branch(Boolean:Kill:@101, MustGen, T:#1/w:1.000000, F:#2/w:1.000000, W:SideState, bc#154)
  States: TakeBoth, StructuresAreWatched
  Availability: {locals = arg1:arg1:FlushedBoolean/@101 arg0:this:FlushedJSValue/Unavailable loc0:ConflictingFlush/@17 loc2:ConflictingFlush/@17; heap = ActivationScopePLoc(@17, 0)=>ConflictingFlush/@12, ClosureVarPLoc(@17, 0)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 1)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 2)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 3)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 4)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 5)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 6)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 7)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 8)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 9)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 10)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 11)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 12)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 13)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 14)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 15)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 16)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 17)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 18)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 19)=>ConflictingFlush/@22, ActivationSymbolTablePLoc(@17, 0)=>ConflictingFlush/@118}
  Live: @12, @17, @22, @49, @118
  Values: @12=>(Otherobj, TOP, TOP, Cell: 0x104443800 (%Ak:global), ID: 413), @17=>(None), @22=>(Boolint32, Int32: 0), @49=>(Function, TOP, TOP, Cell: 0x104458ca0 (%CG:Function), ID: 39), @118=>(Othercell, NonArray, [%CC:SymbolTable], Cell: 0x10446c790 (%CC:SymbolTable), ID: 19)

Block #1 (bc#157):
  Execution count: 1.000000
  Predecessors: #0
  Successors:
  Dominated by: #0 #1
  Dominates: #1
  Dominance Frontier: 
  Iterated Dominance Frontier: 
  Pre/Post Numbering: 2/1
  States: StructuresAreWatched
  Availability: {locals = arg1:arg1:FlushedBoolean/@101 arg0:this:FlushedJSValue/Unavailable loc0:ConflictingFlush/@17 loc1:DeadFlush/Undecided loc2:ConflictingFlush/@17 loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided; heap = ActivationScopePLoc(@17, 0)=>ConflictingFlush/@12, ClosureVarPLoc(@17, 0)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 1)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 2)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 3)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 4)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 5)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 6)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 7)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 8)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 9)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 10)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 11)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 12)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 13)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 14)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 15)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 16)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 17)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 18)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 19)=>ConflictingFlush/@22, ActivationSymbolTablePLoc(@17, 0)=>ConflictingFlush/@118}
  Live: @12, @17, @22, @49, @118
  Values: @12=>(Otherobj, TOP, TOP, Cell: 0x104443800 (%Ak:global), ID: 413), @17=>(None), @22=>(Boolint32, Int32: 0), @49=>(Function, TOP, TOP, Cell: 0x104458ca0 (%CG:Function), ID: 39), @118=>(Othercell, NonArray, [%CC:SymbolTable], Cell: 0x10446c790 (%CC:SymbolTable), ID: 19)
 110:<!0:->	KillStack(MustGen, loc6, W:SideState, bc#157)
  46:<!0:->	MovHint(@12, MustGen, loc6, W:SideState, bc#157)
 111:<!0:->	KillStack(MustGen, loc4, W:SideState, bc#164)
  50:<!0:->	MovHint(@49, MustGen, loc4, W:SideState, bc#164)
  53:< 2:->	NewFunction(Cell:Kill:@17, JS|UseAsOther, Function, <0x104487900, FunctionExecutable>, #<nogen>/<nogen>:[0x104487900], R:HeapObjectCount, W:HeapObjectCount, bc#172)
 112:<!0:->	KillStack(MustGen, loc5, W:SideState, bc#172)
  54:<!0:->	MovHint(@53, MustGen, loc5, W:SideState, bc#172)
  98:<!0:->	InvalidationPoint(MustGen,PASS: regress/script-tests/sink-huge-activation.js.ftl-no-cjit-validate

 116:< 2:->	MaterializeCreateActivation(KnownCell:Kill:@118, KnownCell:@12, Kill:@22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, @22, JS|VarArgs|PureInt, Otherobj, <0x10446c790, SymbolTable>, [id0, id1, id2, id3, id4, id5, id6, id7, id8, id9, id10, id11, id12, id13, id14, id15, id16, id17, id18, id19], R:HeapObjectCount, W:HeapObjectCount, bc#6, exit: bc#176)
 162:<!0:->	MovHint(@116, MustGen, loc2, W:SideState, bc#176)
 163:<!0:->	ZombieHint(MustGen, loc0, W:SideState, bc#176)
  56:<!0:->	Call(Kill:@49, Kill:@12, Kill:@53, JS|MustGen|VarArgs|PureInt, Other, R:World, W:Heap, bc#176)  predicting Other
 113:<!0:->	KillStack(MustGen, loc4, W:SideState, bc#176)
  57:<!0:->	ZombieHint(MustGen, loc4, W:SideState, bc#176)
  99:<!0:->	InvalidationPoint(MustGen, W:SideState, bc#176, exit: bc#185)
  61:< 2:->	GetClosureVar(KnownCell:Kill:@116, JS|UseAsOther, Boolint32, scope12, R:ScopeProperties(12), bc#185)  predicting Boolint32
 114:<!0:->	KillStack(MustGen, loc4, W:SideState, bc#185)
  62:<!0:->	MovHint(@61, MustGen, loc4, W:SideState, bc#185)
  64:<!0:->	Return(Kill:@61, MustGen, W:SideState, bc#193)
  States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated
  Availability: {locals = arg1:arg1:FlushedBoolean/@101 arg0:this:FlushedJSValue/Unavailable loc1:DeadFlush/Undecided loc2:ConflictingFlush/@116 loc3:DeadFlush/Undecided loc4:ConflictingFlush/@61 loc5:ConflictingFlush/@53 loc6:ConflictingFlush/@12 loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided; heap = ActivationScopePLoc(@17, 0)=>ConflictingFlush/@12, ClosureVarPLoc(@17, 0)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 1)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 2)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 3)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 4)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 5)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 6)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 7)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 8)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 9)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 10)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 11)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 12)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 13)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 14)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 15)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 16)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 17)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 18)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 19)=>ConflictingFlush/@22, ActivationSymbolTablePLoc(@17, 0)=>ConflictingFlush/@118}
  Live: 
  Values: 

Block #2 (bc#195):
  Execution count: 1.000000
  Predecessors: #0
  Successors:
  Dominated by: #0 #2
  Dominates: #2
  Dominance Frontier: 
  Iterated Dominance Frontier: 
  Pre/Post Numbering: 1/0
  States: StructuresAreWatched
  Availability: {locals = arg1:arg1:FlushedBoolean/@101 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:ConflictingFlush/@17 loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:DeadFlush/Undecided loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided; heap = ActivationScopePLoc(@17, 0)=>ConflictingFlush/@12, ClosureVarPLoc(@17, 0)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 1)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 2)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 3)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 4)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 5)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 6)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 7)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 8)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 9)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 10)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 11)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 12)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 13)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 14)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 15)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 16)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 17)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 18)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 19)=>ConflictingFlush/@22, ActivationSymbolTablePLoc(@17, 0)=>ConflictingFlush/@118}
  Live: @22
  Values: @22=>(Boolint32, Int32: 0)
 115:<!0:->	KillStack(MustGen, loc4, W:SideState, bc#195)
  69:<!0:->	MovHint(@22, MustGen, loc4, W:SideState, bc#195)
  71:<!0:->	Return(Kill:@22, MustGen, W:SideState, bc#203)
  States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated
  Availability: {locals = arg1:arg1:FlushedBoolean/@101 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:ConflictingFlush/@17 loc3:DeadFlush/Undecided loc4:ConflictingFlush/@22 loc5:DeadFlush/Undecided loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided; heap = ActivationScopePLoc(@17, 0)=>ConflictingFlush/@12, ClosureVarPLoc(@17, 0)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 1)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 2)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 3)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 4)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 5)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 6)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 7)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 8)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 9)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 10)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 11)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 12)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 13)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 14)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 15)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 16)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 17)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 18)=>ConflictingFlush/@22, ClosureVarPLoc(@17, 19)=>ConflictingFlush/@22, ActivationSymbolTablePLoc(@17, 0)=>ConflictingFlush/@118}
  Live: 
  Values: 

GC Values:
    Strong:Cell: 0x104487900 (%EE:FunctionExecutable), ID: 16
    Weak:Cell: 0x104458ca0 (%CG:Function), ID: 39
    Strong:Cell: 0x10446c790 (%CC:SymbolTable), ID: 19
    Weak:Cell: 0x104443800 (%Ak:global), ID: 413
    Weak:Cell: 0x104458c70 (%CG:Function), ID: 39
Desired watchpoints:
    Watchpoint sets: 0x1047c2000
    Inline watchpoint sets: 0x10442be98, 0x10442bd48, 0x10442bfe8, 0x10442b958, 0x10442b808, 0x1044290a8
    Inferred values: 0x10447e460
    Buffer views: 
    Object property conditions: 
Structures:
    %Ak:global             = 0x10446c8e0:[global, {parseInt:100, Object:101, Function:102, Array:103, RegExp:104, EvalError:105, RangeError:106, ReferenceError:107, SyntaxError:108, TypeError:109, URIError:110, Set:111, Map:112, Date:113, String:114, Symbol:115, Boolean:116, Number:117, Error:118, Promise:119, ArrayBuffer:120, WeakMap:121, WeakSet:122, eval:123, Intl:124, JSON:125, Math:126, Reflect:127, DataView:128, Float64Array:129, Float32Array:130, Uint32Array:131, Int32Array:132, Uint16Array:133, Int16Array:134, Uint8ClampedArray:135, Uint8Array:136, Int8Array:137, console:138, debug:139, describe:140, describeArray:141, print:142, quit:143, gc:144, fullGC:145, edenGC:146, gcHeapSize:147, deleteAllCompiledCode:148, addressOf:149, dumpCallFrame:150, version:151, run:152, load:153, readFile:154, checkSyntax:155, jscStack:156, readline:157, preciseTime:158, neverInlineFunction:159, noInline:160, numberOfDFGCompiles:161, optimizeNextInvocation:162, reoptimizationRetryCount:163, transferArrayBuffer:164, Root:165, Element:166, getElement:167, setElementRoot:168, DFGTrue:169, OSRExit:170, isFinalTier:171, predictInt32:172, isInt32:173, fiatInt52:174, effectful42:175, makeMasquerader:176, hasCustomProperties:177, createProxy:178, createRuntimeArray:179, createImpureGetter:180, setImpureGetterDelegate:181, dumpTypesForAllVariables:182, findTypeForExpression:183, returnTypeFor:184, dumpBasicBlockExecutionRanges:185, hasBasicBlockExecuted:186, enableExceptionFuzz:187, arguments:188}, NonArray, Proto:0x104457ff0]
    %CC:SymbolTable        = 0x10442b7b0:[SymbolTable, {}, NonArray]
    %CG:Function           = 0x10442ae80:[Function, {}, NonArray, Proto:0x104439e20]
    %EE:FunctionExecutable = 0x10442b900:[FunctionExecutable, {}, NonArray]

ASSERTION FAILED: !edge->isPhantomAllocation()
/Volumes/Data/tertiary/OpenSource/Source/JavaScriptCore/dfg/DFGValidate.cpp(562) : auto JSC::DFG::Validate::validateSSA()::<anonymous class>::operator()(const JSC::DFG::Edge &) const
1   0x102674d70 WTFCrash
2   0x1020104f2 JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&)::operator()(JSC::DFG::Edge const&) const
3   0x102010434 void JSC::DFG::Graph::doToChildren<JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&)>(JSC::DFG::Node*, JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&) const&)::'lambda'(JSC::DFG::Node*, JSC::DFG::Edge&)::operator()(JSC::DFG::Node*, JSC::DFG::Edge&) const
4   0x102010321 void JSC::DFG::Graph::doToChildrenWithNode<void JSC::DFG::Graph::doToChildren<JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&)>(JSC::DFG::Node*, JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&) const&)::'lambda'(JSC::DFG::Node*, JSC::DFG::Edge&)>(JSC::DFG::Node*, JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&) const&)
5   0x102010170 void JSC::DFG::Graph::doToChildren<JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&)>(JSC::DFG::Node*, JSC::DFG::Validate::validateSSA()::'lambda'(JSC::DFG::Edge const&) const&)
6   0x102010107 JSC::DFG::Validate::validateSSA()
7   0x10200d27c JSC::DFG::Validate::validate()
8   0x10200b011 JSC::DFG::validate(JSC::DFG::Graph&, JSC::DFG::GraphDumpMode, WTF::CString)
9   0x101f508a3 JSC::DFG::(anonymous namespace)::dumpAndVerifyGraph(JSC::DFG::Graph&, char const*, bool)
10  0x101f50211 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&)
11  0x101f4e61a JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*)
12  0x102028dc0 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*)
13  0x1020273b4 JSC::DFG::Worklist::threadFunction(void*)
14  0x1026d9dd9 WTF::createThread(void (*)(void*), void*, char const*)::$_0::operator()() const
15  0x1026d9dac std::__1::__function::__func<WTF::createThread(void (*)(void*), void*, char const*)::$_0, std::__1::allocator<WTF::createThread(void (*)(void*), void*, char const*)::$_0>, void ()>::operator()()
16  0x102164e2a std::__1::function<void ()>::operator()() const
17  0x1026d8d2e WTF::threadEntryPoint(void*)
18  0x1026da6b8 WTF::wtfThreadEntryPoint(void*)
19  0x7fff8f81f268 _pthread_body
20  0x7fff8f81f1e5 _pthread_body
21  0x7fff8f81d41d thread_start
test_script_18665: line 2: 63192 Segmentation fault: 11  "$@" ../../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --enableFunctionDotArguments\=true --useFTLJIT\=true --ftlCrashesIfCantInitializeLLVM\=true --thresholdForJITAfterWarmUp\=10 --thresholdForJITSoon\=10 --thresholdForOptimizeAfterWarmUp\=20 --thresholdForOptimizeAfterLongWarmUp\=20 --thresholdForOptimizeSoon\=20 --thresholdForFTLOptimizeAfterWarmUp\=20 --thresholdForFTLOptimizeSoon\=20 --maximumEvalCacheableSourceLength\=150000 sink-huge-activation.js

[Basile Clement]

This is incredibly weird. It looks like the allocation sinking phase for some reason failed to realize the node at @53 should be sunk because it uses the activation at @17 (i.e. ObjectAllocationSinking::determineSinkCandidates failed its job). I have absolutely no idea what could have caused this, and was unable to reproduce it either.

What revision did you see this in?