Bug 153805 – ASSERTION FAILED: !edge->isPhantomAllocation() in regress/script-tests/sink-huge-activation.js.ftl-eager in debug mode

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Filip Pizlo]

...

[Alexey Proskuryakov]

This happens on this bot fairly often, roughly once per day:

https://build.webkit.org/builders/Apple%20Yosemite%20Debug%20JSC%20(Tests)?numbuilds=50

[Saam Barati]

I just hit it.

[Filip Pizlo]

I can repro.  Here's the dump.

At @60: validation failed: !edge->isPhantomAllocation() (/Volumes/Data/quartary/OpenSource/Source/JavaScriptCore/dfg/DFGValidate.cpp:594).

At time of failure:

DFG for foo#CDmn2K:[0x10ac8b400->0x10ac8ba60->0x10ac7af40, DFGFunctionCall, 205 (NeverInline)]:
  Fixpoint state: FixpointConverged; Form: SSA; Unification state: GloballyUnified; Ref count state: ExactRefCount
  Argument formats: FlushedJSValue, FlushedBoolean

Block #0 (bc#0): (OSR target)
  Execution count: 1.000000
  Predecessors:
  Successors: #1 (ForwardEdge) #2 (ForwardEdge)
  Dominated by: #0
  Dominates: #0 #1 #2
  Dominance Frontier: 
  Iterated Dominance Frontier: 
  Pre/Post Numbering: 0/2
  States: StructuresAreWatched
  Availability: {locals = arg1:arg1:FlushedBoolean/Unavailable arg0:this:FlushedJSValue/Unavailable; heap = }
  Live: 
  Values: 
 131:< 2:->	JSConstant(JS|PureInt, Othercell, Strong:Cell: 0x10ac3be80 (%Df:SymbolTable), ID: 19, bc#0)
 132:< 20:->	JSConstant(JS|PureInt, Other, Undefined, bc#0)
  28:< 42:->	JSConstant(JS|UseAsOther, Boolint32, Int32: 0, bc#0)
  18:< 3:->	JSConstant(JS|UseAsOther, Otherobj, Weak:Cell: 0x10ac43fc0 (%C0:JSGlobalLexicalEnvironment), ID: 49, bc#0)
  57:< 2:->	JSConstant(JS|UseAsOther, Function, Weak:Cell: 0x10ac67eb0 (%Cf:Function), ID: 50, bc#0)
  51:< 2:->	JSConstant(JS|UseAsOther, Otherobj, Weak:Cell: 0x10ac37900 (%Eg:global), ID: 321, bc#0)
 109:<!0:->	ExitOK(MustGen, W:SideState, bc#0)
 108:< 1:->	GetStack(JS|PureInt, Bool, arg1, machine:arg1, FlushedBoolean, R:Stack(6), bc#0)
 110:<!0:->	KillStack(MustGen, loc0, W:SideState, ClobbersExit, bc#0)
   3:<!0:->	ZombieHint(MustGen, loc0, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 111:<!0:->	KillStack(MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid)
   5:<!0:->	ZombieHint(MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 112:<!0:->	KillStack(MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid)
   7:<!0:->	ZombieHint(MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 113:<!0:->	KillStack(MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid)
   9:<!0:->	ZombieHint(MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 114:<!0:->	KillStack(MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid)
  11:<!0:->	ZombieHint(MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 115:<!0:->	KillStack(MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid)
  13:<!0:->	ZombieHint(MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 116:<!0:->	KillStack(MustGen, loc6, W:SideState, ClobbersExit, bc#0, ExitInvalid)
  15:<!0:->	ZombieHint(MustGen, loc6, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 117:<!0:->	KillStack(MustGen, loc3, W:SideState, ClobbersExit, bc#1)
  19:<!0:->	MovHint(Untyped:@18, MustGen, loc3, W:SideState, ClobbersExit, bc#1, ExitInvalid)
 118:<!0:->	KillStack(MustGen, loc4, W:SideState, ClobbersExit, bc#3)
  21:<!0:->	ZombieHint(MustGen, loc4, W:SideState, ClobbersExit, bc#3, ExitInvalid)
  23:<!45:->	PhantomCreateActivation(JS|MustGen|UseAsOther, Otherobj, R:HeapObjectCount, W:HeapObjectCount, Exits, bc#6)
 133:<!0:->	PutHint(Untyped:@23, Untyped:@131, MustGen, ActivationSymbolTablePLoc(0), W:SideState, ClobbersExit, bc#6)
 134:<!0:->	PutHint(Untyped:@23, Untyped:@18, MustGen, ActivationScopePLoc(0), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 135:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(0), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 136:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(1), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 137:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(2), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 138:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(3), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 139:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(4), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 140:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(5), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 141:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(6), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 142:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(7), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 143:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(8), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 144:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(9), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 145:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(10), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 146:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(11), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 147:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(12), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 148:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(13), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 149:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(14), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 150:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(15), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 151:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(16), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 152:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(17), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 153:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(18), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 154:<!0:->	PutHint(Untyped:@23, Untyped:Kill:@132, MustGen, ClosureVarPLoc(19), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 155:<!0:->	ExitOK(MustGen, W:SideState, bc#6)
 119:<!0:->	KillStack(MustGen, loc5, W:SideState, ClobbersExit, bc#6)
  24:<!0:->	MovHint(Untyped:@23, MustGen, loc5, W:SideState, ClobbersExit, bc#6, ExitInvalid)
 120:<!0:->	KillStack(MustGen, loc3, W:SideState, ClobbersExit, bc#11)
  26:<!0:->	MovHint(Untyped:@23, MustGen, loc3, W:SideState, ClobbersExit, bc#11, ExitInvalid)
 156:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(16), W:SideState, ClobbersExit, bc#14)
 157:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(15), W:SideState, ClobbersExit, bc#21)
 158:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(10), W:SideState, ClobbersExit, bc#28)
 159:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(14), W:SideState, ClobbersExit, bc#35)
 160:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(9), W:SideState, ClobbersExit, bc#42)
 161:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(3), W:SideState, ClobbersExit, bc#49)
 162:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(13), W:SideState, ClobbersExit, bc#56)
 163:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(8), W:SideState, ClobbersExit, bc#63)
 164:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(2), W:SideState, ClobbersExit, bc#70)
 165:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(7), W:SideState, ClobbersExit, bc#77)
 166:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(18), W:SideState, ClobbersExit, bc#84)
 167:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(5), W:SideState, ClobbersExit, bc#91)
 168:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(0), W:SideState, ClobbersExit, bc#98)
 169:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(6), W:SideState, ClobbersExit, bc#105)
 170:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(4), W:SideState, ClobbersExit, bc#112)
 171:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(11), W:SideState, ClobbersExit, bc#119)
 172:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(19), W:SideState, ClobbersExit, bc#126)
 173:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(12), W:SideState, ClobbersExit, bc#133)
 174:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(17), W:SideState, ClobbersExit, bc#140)
 175:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(1), W:SideState, ClobbersExit, bc#147)
  50:<!0:->	Branch(Boolean:Kill:@108, MustGen, T:#1/w:1.000000, F:#2/w:1.000000, W:SideState, bc#154)
  States: TakeBoth, StructuresAreWatched
  Availability: {locals = arg1:arg1:FlushedBoolean/@108 arg0:this:FlushedJSValue/Unavailable loc3:ConflictingFlush/@23 loc5:ConflictingFlush/@23; heap = ActivationSymbolTablePLoc(@23, 0)=>ConflictingFlush/@131, ActivationScopePLoc(@23, 0)=>ConflictingFlush/@18, ClosureVarPLoc(@23, 0)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 1)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 2)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 3)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 4)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 5)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 6)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 7)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 8)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 9)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 10)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 11)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 12)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 13)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 14)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 15)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 16)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 17)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 18)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 19)=>ConflictingFlush/@28}
  Live: @18, @23, @28, @51, @57, @131
  Values: @18=>(Otherobj, NonArray, [%C0:JSGlobalLexicalEnvironment], Cell: 0x10ac43fc0 (%C0:JSGlobalLexicalEnvironment), ID: 49), @23=>(None), @28=>(Boolint32, Int32: 0), @51=>(Otherobj, TOP, TOP, Cell: 0x10ac37900 (%Eg:global), ID: 321), @57=>(Function, TOP, TOP, Cell: 0x10ac67eb0 (%Cf:Function), ID: 50), @131=>(Othercell, NonArray, [%Df:SymbolTable], Cell: 0x10ac3be80 (%Df:SymbolTable), ID: 19)

Block #1 (bc#157):
  Execution count: 1.000000
  Predecessors: #0
  Successors:
  Dominated by: #0 #1
  Dominates: #1
  Dominance Frontier: 
  Iterated Dominance Frontier: 
  Pre/Post Numbering: 2/1
  States: StructuresAreWatched
  Availability: {locals = arg1:arg1:FlushedBoolean/@108 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:ConflictingFlush/@23 loc4:DeadFlush/Undecided loc5:ConflictingFlush/@23 loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided; heap = ActivationSymbolTablePLoc(@23, 0)=>ConflictingFlush/@131, ActivationScopePLoc(@23, 0)=>ConflictingFlush/@18, ClosureVarPLoc(@23, 0)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 1)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 2)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 3)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 4)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 5)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 6)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 7)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 8)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 9)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 10)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 11)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 12)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 13)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 14)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 15)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 16)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 17)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 18)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 19)=>ConflictingFlush/@28}
  Live: @18, @23, @28, @51, @57, @131
  Values: @18=>(Otherobj, NonArray, [%C0:JSGlobalLexicalEnvironment], Cell: 0x10ac43fc0 (%C0:JSGlobalLexicalEnvironment), ID: 49), @23=>(None), @28=>(Boolint32, Int32: 0), @51=>(Otherobj, TOP, TOP, Cell: 0x10ac37900 (%Eg:global), ID: 321), @57=>(Function, TOP, TOP, Cell: 0x10ac67eb0 (%Cf:Function), ID: 50), @131=>(Othercell, NonArray, [%Df:SymbolTable], Cell: 0x10ac3be80 (%Df:SymbolTable), ID: 19)
 121:<!0:->	ExitOK(MustGen, W:SideState, bc#157)
 122:<!0:->	KillStack(MustGen, loc10, W:SideState, ClobbersExit, bc#157)
  52:<!0:->	MovHint(Untyped:@51, MustGen, loc10, W:SideState, ClobbersExit, bc#157, ExitInvalid)
 123:<!0:->	KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#164)
  58:<!0:->	MovHint(Untyped:@57, MustGen, loc7, W:SideState, ClobbersExit, bc#164, ExitInvalid)
  60:< 2:->	NewFunction(Cell:Kill:@23, JS|UseAsOther, Function, <0x10ac7ae00, FunctionExecutable>, #<nogen>/<nogen>:[0x10ac7ae00], R:HeapObjectCount, W:HeapObjectCount, ExitsForExceptions, bc#172)
 124:<!0:->	KillStack(MustGen, loc9, W:SideState, ClobbersExit, bc#172, ExitInvalid)
  61:<!0:->	MovHint(Untyped:@60, MustGen, loc9, W:SideState, ClobbersExit, bc#172, ExitInvalid)
 105:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#172, exit: bc#176)
 129:< 2:->	MaterializeCreateActivation(KnownCell:Kill:@131, KnownCell:Kill:@18, Untyped:Kill:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, JS|VarArgs|PureInt, Otherobj, <0x10ac3be80, SymbolTable>, [id0, id1, id2, id3, id4, id5, id6, id7, id8, id9, id10, id11, id12, id13, id14, id15, id16, id17, id18, id19], R:HeapObjectCount, W:HeapObjectCount, ExitsForExceptions, bc#6, exit: bc#176)
 176:<!0:->	MovHint(Untyped:@129, MustGen, loc5, W:SideState, ClobbersExit, bc#176)
 177:<!0:->	ZombieHint(MustGen, loc3, W:SideState, ClobbersExit, bc#176, ExitInvalid)
 178:<!0:->	ExitOK(MustGen, W:SideState, bc#176)
  63:<!0:->	Call(Untyped:Kill:@57, Untyped:Kill:@51, Untyped:Kill:@60, JS|MustGen|VarArgs|PureInt, Other, R:World, W:Heap, ExitsForExceptions, ClobbersExit, bc#176)  predicting Other
 125:<!0:->	KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#176, ExitInvalid)
  64:<!0:->	ZombieHint(MustGen, loc7, W:SideState, ClobbersExit, bc#176, ExitInvalid)
 106:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#176, exit: bc#185)
  68:< 2:->	GetClosureVar(KnownCell:Kill:@129, JS|UseAsOther, Boolint32, scope12, R:ScopeProperties(12), Exits, bc#185)  predicting Boolint32
 126:<!0:->	KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#185)
  69:<!0:->	MovHint(Untyped:@68, MustGen, loc7, W:SideState, ClobbersExit, bc#185, ExitInvalid)
  71:<!0:->	Return(Untyped:Kill:@68, MustGen, W:SideState, Exits, bc#193)
  States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated
  Availability: {locals = arg1:arg1:FlushedBoolean/@108 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:ConflictingFlush/@129 loc6:DeadFlush/Undecided loc7:ConflictingFlush/@68 loc8:DeadFlush/Undecided loc9:ConflictingFlush/@60 loc10:ConflictingFlush/@51 loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided; heap = ActivationSymbolTablePLoc(@23, 0)=>ConflictingFlush/@131, ActivationScopePLoc(@23, 0)=>ConflictingFlush/@18, ClosureVarPLoc(@23, 0)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 1)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 2)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 3)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 4)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 5)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 6)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 7)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 8)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 9)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 10)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 11)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 12)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 13)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 14)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 15)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 16)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 17)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 18)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 19)=>ConflictingFlush/@28}
  Live: 
  Values: 

Block #2 (bc#195):
  Execution count: 1.000000
  Predecessors: #0
  Successors:
  Dominated by: #0 #2
  Dominates: #2
  Dominance Frontier: 
  Iterated Dominance Frontier: 
  Pre/Post Numbering: 1/0
  States: StructuresAreWatched
  Availability: {locals = arg1:arg1:FlushedBoolean/@108 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:ConflictingFlush/@23 loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided; heap = ActivationSymbolTablePLoc(@23, 0)=>ConflictingFlush/@131, ActivationScopePLoc(@23, 0)=>ConflictingFlush/@18, ClosureVarPLoc(@23, 0)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 1)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 2)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 3)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 4)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 5)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 6)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 7)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 8)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 9)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 10)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 11)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 12)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 13)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 14)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 15)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 16)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 17)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 18)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 19)=>ConflictingFlush/@28}
  Live: @28
  Values: @28=>(Boolint32, Int32: 0)
 127:<!0:->	ExitOK(MustGen, W:SideState, bc#195)
 128:<!0:->	KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#195)
  76:<!0:->	MovHint(Untyped:@28, MustGen, loc7, W:SideState, ClobbersExit, bc#195, ExitInvalid)
  78:<!0:->	Return(Untyped:Kill:@28, MustGen, W:SideState, Exits, bc#203)
  States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated
  Availability: {locals = arg1:arg1:FlushedBoolean/@108 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:ConflictingFlush/@23 loc6:DeadFlush/Undecided loc7:ConflictingFlush/@28 loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided; heap = ActivationSymbolTablePLoc(@23, 0)=>ConflictingFlush/@131, ActivationScopePLoc(@23, 0)=>ConflictingFlush/@18, ClosureVarPLoc(@23, 0)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 1)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 2)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 3)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 4)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 5)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 6)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 7)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 8)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 9)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 10)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 11)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 12)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 13)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 14)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 15)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 16)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 17)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 18)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 19)=>ConflictingFlush/@28}
  Live: 
  Values: 

GC Values:
    Strong:Cell: 0x10ac7ae00 (%CO:FunctionExecutable), ID: 15
    Weak:Cell: 0x10ac67eb0 (%Cf:Function), ID: 50
    Weak:Cell: 0x10ac37900 (%Eg:global), ID: 321
    Strong:Cell: 0x10ac3be80 (%Df:SymbolTable), ID: 19
    Weak:Cell: 0x10ac43fc0 (%C0:JSGlobalLexicalEnvironment), ID: 49
    Weak:Cell: 0x10ac67e80 (%Cf:Function), ID: 50
Desired watchpoints:
    Watchpoint sets: 0x10ade0370
    Inline watchpoint sets: 0x10ac27fe0, 0x10ac24ee0, 0x10ac278e0, 0x10ac27760, 0x10ac27d60, 0x10ac276e0, 0x10ac267e0, 0x10ac27e60
    Inferred values: 0x10ac62060
    Buffer views: 
    Object property conditions: 
    Inferred types: 
Structures:
    %C0:JSGlobalLexicalEnvironment = 0x10ac26780:[JSGlobalLexicalEnvironment, {}, NonArray, Leaf]
    %CO:FunctionExecutable         = 0x10ac27880:[FunctionExecutable, {}, NonArray, Leaf]
    %Cf:Function                   = 0x10ac26700:[Function, {}, NonArray, Proto:0x10ac2dde0]
    %Df:SymbolTable                = 0x10ac27680:[SymbolTable, {}, NonArray, Leaf]
    %Eg:global                     = 0x10ac69c80:[global, {parseInt:100, Object:101, Function:102, Array:103, RegExp:104, EvalError:105, RangeError:106, ReferenceError:107, SyntaxError:108, TypeError:109, URIError:110, Proxy:111, Set:112, Map:113, Date:114, String:115, Symbol:116, Boolean:117, Number:118, Error:119, Promise:120, ArrayBuffer:121, WeakMap:122, WeakSet:123, eval:124, Intl:125, JSON:126, Math:127, Reflect:128, DataView:129, Float64Array:130, Float32Array:131, Uint32Array:132, Int32Array:133, Uint16Array:134, Int16Array:135, Uint8ClampedArray:136, Uint8Array:137, Int8Array:138, PrivateSymbol.Int8Array:139, PrivateSymbol.Int16Array:140, PrivateSymbol.Int32Array:141, PrivateSymbol.Uint8Array:142, PrivateSymbol.Uint8ClampedArray:143, PrivateSymbol.Uint16Array:144, PrivateSymbol.Uint32Array:145, PrivateSymbol.Float32Array:146, PrivateSymbol.Float64Array:147, console:148, debug:149, describe:150, describeArray:151, print:152, quit:153, abort:154, gc:155, fullGC:156, edenGC:157, forceGCSlowPaths:158, gcHeapSize:159, addressOf:160, version:161, run:162, load:163, readFile:164, checkSyntax:165, jscStack:166, readline:167, preciseTime:168, neverInlineFunction:169, noInline:170, noDFG:171, numberOfDFGCompiles:172, optimizeNextInvocation:173, reoptimizationRetryCount:174, transferArrayBuffer:175, failNextNewCodeBlock:176, Root:177, Element:178, getElement:179, setElementRoot:180, SimpleObject:181, getHiddenValue:182, setHiddenValue:183, DFGTrue:184, OSRExit:185, isFinalTier:186, predictInt32:187, isInt32:188, fiatInt52:189, effectful42:190, makeMasquerader:191, hasCustomProperties:192, createProxy:193, createRuntimeArray:194, createImpureGetter:195, createCustomGetterObject:196, setImpureGetterDelegate:197, dumpTypesForAllVariables:198, findTypeForExpression:199, returnTypeFor:200, dumpBasicBlockExecutionRanges:201, hasBasicBlockExecuted:202, basicBlockExecutionCount:203, enableExceptionFuzz:204, drainMicrotasks:205, is32BitPlatform:206, loadModule:207, checkModuleSyntax:208, platformSupportsSamplingProfiler:209, generateHeapSnapshot:210, startSamplingProfiler:211, samplingProfilerStackTraces:212}, NonArray, Proto:0x10ac4fff0, Has been dictionary, Leaf]

ASSERTION FAILED: !edge->isPhantomAllocation()
/Volumes/Data/quartary/OpenSource/Source/JavaScriptCore/dfg/DFGValidate.cpp(594) : auto JSC::DFG::Validate::validateSSA()::<anonymous class>::operator()(const JSC::DFG::Edge &) const

[Filip Pizlo]

I'm beginning to think that this is an awesome race condition.  This analysis probably needs to save the value of node->castOperand<FunctionExecutable*>()->singletonFunction()->isStillValid() so that it makes up its mind.

Right now, it's possible that we will decide that a NewFunction is not a sink candidate and then later decide that it doesn't escape its activation, because the watchpoint fired and so the NewFunction suddenly started to seem like a sink candidate *after* we already excluded it from that list.

[Filip Pizlo]

Created attachment 274167 [details]
the patch

[Mark Lam]

Comment on attachment 274167 [details]
the patch

r=me

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/198296