153805 – ASSERTION FAILED: !edge->isPhantomAllocation() in regress/script-tests/sink-huge-activation.js.ftl-eager in debug mode

Bug 153805 - ASSERTION FAILED: !edge->isPhantomAllocation() in regress/script-tests/sink-huge-activation.js.ftl-eager in debug mode

Summary: ASSERTION FAILED: !edge->isPhantomAllocation() in regress/script-tests/sink-h...

Status:	RESOLVED FIXED

Alias:	None

Product:	WebKit
Classification:	Unclassified
Component:	JavaScriptCore (show other bugs)
Version:	Other
Hardware:	All All

Importance:	P2 Normal
Assignee:	Filip Pizlo

URL:
Keywords:

Depends on:
Blocks:

Reported:	2016-02-02 15:13 PST by Filip Pizlo
Modified:	2016-03-16 13:12 PDT (History)
CC List:	7 users (show)

See Also:

Attachments
the patch (3.97 KB, patch) 2016-03-15 20:37 PDT, Filip Pizlo	mark.lam: review+	Details \| Formatted Diff \| Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Filip Pizlo 2016-02-02 15:13:07 PST

...

Comment 1 Alexey Proskuryakov 2016-02-27 12:08:44 PST

This happens on this bot fairly often, roughly once per day:

https://build.webkit.org/builders/Apple%20Yosemite%20Debug%20JSC%20(Tests)?numbuilds=50

Comment 2 Saam Barati 2016-03-15 13:47:00 PDT

I just hit it.

Comment 3 Filip Pizlo 2016-03-15 15:36:56 PDT

I can repro.  Here's the dump.

At @60: validation failed: !edge->isPhantomAllocation() (/Volumes/Data/quartary/OpenSource/Source/JavaScriptCore/dfg/DFGValidate.cpp:594).

At time of failure:

DFG for foo#CDmn2K:[0x10ac8b400->0x10ac8ba60->0x10ac7af40, DFGFunctionCall, 205 (NeverInline)]:
  Fixpoint state: FixpointConverged; Form: SSA; Unification state: GloballyUnified; Ref count state: ExactRefCount
  Argument formats: FlushedJSValue, FlushedBoolean

Block #0 (bc#0): (OSR target)
  Execution count: 1.000000
  Predecessors:
  Successors: #1 (ForwardEdge) #2 (ForwardEdge)
  Dominated by: #0
  Dominates: #0 #1 #2
  Dominance Frontier: 
  Iterated Dominance Frontier: 
  Pre/Post Numbering: 0/2
  States: StructuresAreWatched
  Availability: {locals = arg1:arg1:FlushedBoolean/Unavailable arg0:this:FlushedJSValue/Unavailable; heap = }
  Live: 
  Values: 
 131:< 2:->	JSConstant(JS|PureInt, Othercell, Strong:Cell: 0x10ac3be80 (%Df:SymbolTable), ID: 19, bc#0)
 132:< 20:->	JSConstant(JS|PureInt, Other, Undefined, bc#0)
  28:< 42:->	JSConstant(JS|UseAsOther, Boolint32, Int32: 0, bc#0)
  18:< 3:->	JSConstant(JS|UseAsOther, Otherobj, Weak:Cell: 0x10ac43fc0 (%C0:JSGlobalLexicalEnvironment), ID: 49, bc#0)
  57:< 2:->	JSConstant(JS|UseAsOther, Function, Weak:Cell: 0x10ac67eb0 (%Cf:Function), ID: 50, bc#0)
  51:< 2:->	JSConstant(JS|UseAsOther, Otherobj, Weak:Cell: 0x10ac37900 (%Eg:global), ID: 321, bc#0)
 109:<!0:->	ExitOK(MustGen, W:SideState, bc#0)
 108:< 1:->	GetStack(JS|PureInt, Bool, arg1, machine:arg1, FlushedBoolean, R:Stack(6), bc#0)
 110:<!0:->	KillStack(MustGen, loc0, W:SideState, ClobbersExit, bc#0)
   3:<!0:->	ZombieHint(MustGen, loc0, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 111:<!0:->	KillStack(MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid)
   5:<!0:->	ZombieHint(MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 112:<!0:->	KillStack(MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid)
   7:<!0:->	ZombieHint(MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 113:<!0:->	KillStack(MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid)
   9:<!0:->	ZombieHint(MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 114:<!0:->	KillStack(MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid)
  11:<!0:->	ZombieHint(MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 115:<!0:->	KillStack(MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid)
  13:<!0:->	ZombieHint(MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 116:<!0:->	KillStack(MustGen, loc6, W:SideState, ClobbersExit, bc#0, ExitInvalid)
  15:<!0:->	ZombieHint(MustGen, loc6, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 117:<!0:->	KillStack(MustGen, loc3, W:SideState, ClobbersExit, bc#1)
  19:<!0:->	MovHint(Untyped:@18, MustGen, loc3, W:SideState, ClobbersExit, bc#1, ExitInvalid)
 118:<!0:->	KillStack(MustGen, loc4, W:SideState, ClobbersExit, bc#3)
  21:<!0:->	ZombieHint(MustGen, loc4, W:SideState, ClobbersExit, bc#3, ExitInvalid)
  23:<!45:->	PhantomCreateActivation(JS|MustGen|UseAsOther, Otherobj, R:HeapObjectCount, W:HeapObjectCount, Exits, bc#6)
 133:<!0:->	PutHint(Untyped:@23, Untyped:@131, MustGen, ActivationSymbolTablePLoc(0), W:SideState, ClobbersExit, bc#6)
 134:<!0:->	PutHint(Untyped:@23, Untyped:@18, MustGen, ActivationScopePLoc(0), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 135:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(0), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 136:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(1), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 137:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(2), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 138:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(3), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 139:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(4), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 140:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(5), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 141:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(6), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 142:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(7), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 143:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(8), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 144:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(9), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 145:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(10), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 146:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(11), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 147:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(12), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 148:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(13), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 149:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(14), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 150:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(15), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 151:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(16), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 152:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(17), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 153:<!0:->	PutHint(Untyped:@23, Untyped:@132, MustGen, ClosureVarPLoc(18), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 154:<!0:->	PutHint(Untyped:@23, Untyped:Kill:@132, MustGen, ClosureVarPLoc(19), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 155:<!0:->	ExitOK(MustGen, W:SideState, bc#6)
 119:<!0:->	KillStack(MustGen, loc5, W:SideState, ClobbersExit, bc#6)
  24:<!0:->	MovHint(Untyped:@23, MustGen, loc5, W:SideState, ClobbersExit, bc#6, ExitInvalid)
 120:<!0:->	KillStack(MustGen, loc3, W:SideState, ClobbersExit, bc#11)
  26:<!0:->	MovHint(Untyped:@23, MustGen, loc3, W:SideState, ClobbersExit, bc#11, ExitInvalid)
 156:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(16), W:SideState, ClobbersExit, bc#14)
 157:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(15), W:SideState, ClobbersExit, bc#21)
 158:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(10), W:SideState, ClobbersExit, bc#28)
 159:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(14), W:SideState, ClobbersExit, bc#35)
 160:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(9), W:SideState, ClobbersExit, bc#42)
 161:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(3), W:SideState, ClobbersExit, bc#49)
 162:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(13), W:SideState, ClobbersExit, bc#56)
 163:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(8), W:SideState, ClobbersExit, bc#63)
 164:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(2), W:SideState, ClobbersExit, bc#70)
 165:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(7), W:SideState, ClobbersExit, bc#77)
 166:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(18), W:SideState, ClobbersExit, bc#84)
 167:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(5), W:SideState, ClobbersExit, bc#91)
 168:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(0), W:SideState, ClobbersExit, bc#98)
 169:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(6), W:SideState, ClobbersExit, bc#105)
 170:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(4), W:SideState, ClobbersExit, bc#112)
 171:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(11), W:SideState, ClobbersExit, bc#119)
 172:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(19), W:SideState, ClobbersExit, bc#126)
 173:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(12), W:SideState, ClobbersExit, bc#133)
 174:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(17), W:SideState, ClobbersExit, bc#140)
 175:<!0:->	PutHint(Untyped:@23, Untyped:@28, MustGen, ClosureVarPLoc(1), W:SideState, ClobbersExit, bc#147)
  50:<!0:->	Branch(Boolean:Kill:@108, MustGen, T:#1/w:1.000000, F:#2/w:1.000000, W:SideState, bc#154)
  States: TakeBoth, StructuresAreWatched
  Availability: {locals = arg1:arg1:FlushedBoolean/@108 arg0:this:FlushedJSValue/Unavailable loc3:ConflictingFlush/@23 loc5:ConflictingFlush/@23; heap = ActivationSymbolTablePLoc(@23, 0)=>ConflictingFlush/@131, ActivationScopePLoc(@23, 0)=>ConflictingFlush/@18, ClosureVarPLoc(@23, 0)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 1)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 2)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 3)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 4)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 5)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 6)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 7)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 8)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 9)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 10)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 11)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 12)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 13)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 14)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 15)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 16)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 17)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 18)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 19)=>ConflictingFlush/@28}
  Live: @18, @23, @28, @51, @57, @131
  Values: @18=>(Otherobj, NonArray, [%C0:JSGlobalLexicalEnvironment], Cell: 0x10ac43fc0 (%C0:JSGlobalLexicalEnvironment), ID: 49), @23=>(None), @28=>(Boolint32, Int32: 0), @51=>(Otherobj, TOP, TOP, Cell: 0x10ac37900 (%Eg:global), ID: 321), @57=>(Function, TOP, TOP, Cell: 0x10ac67eb0 (%Cf:Function), ID: 50), @131=>(Othercell, NonArray, [%Df:SymbolTable], Cell: 0x10ac3be80 (%Df:SymbolTable), ID: 19)

Block #1 (bc#157):
  Execution count: 1.000000
  Predecessors: #0
  Successors:
  Dominated by: #0 #1
  Dominates: #1
  Dominance Frontier: 
  Iterated Dominance Frontier: 
  Pre/Post Numbering: 2/1
  States: StructuresAreWatched
  Availability: {locals = arg1:arg1:FlushedBoolean/@108 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:ConflictingFlush/@23 loc4:DeadFlush/Undecided loc5:ConflictingFlush/@23 loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided; heap = ActivationSymbolTablePLoc(@23, 0)=>ConflictingFlush/@131, ActivationScopePLoc(@23, 0)=>ConflictingFlush/@18, ClosureVarPLoc(@23, 0)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 1)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 2)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 3)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 4)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 5)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 6)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 7)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 8)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 9)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 10)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 11)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 12)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 13)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 14)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 15)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 16)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 17)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 18)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 19)=>ConflictingFlush/@28}
  Live: @18, @23, @28, @51, @57, @131
  Values: @18=>(Otherobj, NonArray, [%C0:JSGlobalLexicalEnvironment], Cell: 0x10ac43fc0 (%C0:JSGlobalLexicalEnvironment), ID: 49), @23=>(None), @28=>(Boolint32, Int32: 0), @51=>(Otherobj, TOP, TOP, Cell: 0x10ac37900 (%Eg:global), ID: 321), @57=>(Function, TOP, TOP, Cell: 0x10ac67eb0 (%Cf:Function), ID: 50), @131=>(Othercell, NonArray, [%Df:SymbolTable], Cell: 0x10ac3be80 (%Df:SymbolTable), ID: 19)
 121:<!0:->	ExitOK(MustGen, W:SideState, bc#157)
 122:<!0:->	KillStack(MustGen, loc10, W:SideState, ClobbersExit, bc#157)
  52:<!0:->	MovHint(Untyped:@51, MustGen, loc10, W:SideState, ClobbersExit, bc#157, ExitInvalid)
 123:<!0:->	KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#164)
  58:<!0:->	MovHint(Untyped:@57, MustGen, loc7, W:SideState, ClobbersExit, bc#164, ExitInvalid)
  60:< 2:->	NewFunction(Cell:Kill:@23, JS|UseAsOther, Function, <0x10ac7ae00, FunctionExecutable>, #<nogen>/<nogen>:[0x10ac7ae00], R:HeapObjectCount, W:HeapObjectCount, ExitsForExceptions, bc#172)
 124:<!0:->	KillStack(MustGen, loc9, W:SideState, ClobbersExit, bc#172, ExitInvalid)
  61:<!0:->	MovHint(Untyped:@60, MustGen, loc9, W:SideState, ClobbersExit, bc#172, ExitInvalid)
 105:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#172, exit: bc#176)
 129:< 2:->	MaterializeCreateActivation(KnownCell:Kill:@131, KnownCell:Kill:@18, Untyped:Kill:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, Untyped:@28, JS|VarArgs|PureInt, Otherobj, <0x10ac3be80, SymbolTable>, [id0, id1, id2, id3, id4, id5, id6, id7, id8, id9, id10, id11, id12, id13, id14, id15, id16, id17, id18, id19], R:HeapObjectCount, W:HeapObjectCount, ExitsForExceptions, bc#6, exit: bc#176)
 176:<!0:->	MovHint(Untyped:@129, MustGen, loc5, W:SideState, ClobbersExit, bc#176)
 177:<!0:->	ZombieHint(MustGen, loc3, W:SideState, ClobbersExit, bc#176, ExitInvalid)
 178:<!0:->	ExitOK(MustGen, W:SideState, bc#176)
  63:<!0:->	Call(Untyped:Kill:@57, Untyped:Kill:@51, Untyped:Kill:@60, JS|MustGen|VarArgs|PureInt, Other, R:World, W:Heap, ExitsForExceptions, ClobbersExit, bc#176)  predicting Other
 125:<!0:->	KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#176, ExitInvalid)
  64:<!0:->	ZombieHint(MustGen, loc7, W:SideState, ClobbersExit, bc#176, ExitInvalid)
 106:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#176, exit: bc#185)
  68:< 2:->	GetClosureVar(KnownCell:Kill:@129, JS|UseAsOther, Boolint32, scope12, R:ScopeProperties(12), Exits, bc#185)  predicting Boolint32
 126:<!0:->	KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#185)
  69:<!0:->	MovHint(Untyped:@68, MustGen, loc7, W:SideState, ClobbersExit, bc#185, ExitInvalid)
  71:<!0:->	Return(Untyped:Kill:@68, MustGen, W:SideState, Exits, bc#193)
  States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated
  Availability: {locals = arg1:arg1:FlushedBoolean/@108 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:ConflictingFlush/@129 loc6:DeadFlush/Undecided loc7:ConflictingFlush/@68 loc8:DeadFlush/Undecided loc9:ConflictingFlush/@60 loc10:ConflictingFlush/@51 loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided; heap = ActivationSymbolTablePLoc(@23, 0)=>ConflictingFlush/@131, ActivationScopePLoc(@23, 0)=>ConflictingFlush/@18, ClosureVarPLoc(@23, 0)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 1)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 2)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 3)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 4)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 5)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 6)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 7)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 8)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 9)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 10)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 11)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 12)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 13)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 14)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 15)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 16)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 17)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 18)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 19)=>ConflictingFlush/@28}
  Live: 
  Values: 

Block #2 (bc#195):
  Execution count: 1.000000
  Predecessors: #0
  Successors:
  Dominated by: #0 #2
  Dominates: #2
  Dominance Frontier: 
  Iterated Dominance Frontier: 
  Pre/Post Numbering: 1/0
  States: StructuresAreWatched
  Availability: {locals = arg1:arg1:FlushedBoolean/@108 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:ConflictingFlush/@23 loc6:DeadFlush/Undecided loc7:DeadFlush/Undecided loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided; heap = ActivationSymbolTablePLoc(@23, 0)=>ConflictingFlush/@131, ActivationScopePLoc(@23, 0)=>ConflictingFlush/@18, ClosureVarPLoc(@23, 0)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 1)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 2)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 3)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 4)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 5)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 6)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 7)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 8)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 9)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 10)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 11)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 12)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 13)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 14)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 15)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 16)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 17)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 18)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 19)=>ConflictingFlush/@28}
  Live: @28
  Values: @28=>(Boolint32, Int32: 0)
 127:<!0:->	ExitOK(MustGen, W:SideState, bc#195)
 128:<!0:->	KillStack(MustGen, loc7, W:SideState, ClobbersExit, bc#195)
  76:<!0:->	MovHint(Untyped:@28, MustGen, loc7, W:SideState, ClobbersExit, bc#195, ExitInvalid)
  78:<!0:->	Return(Untyped:Kill:@28, MustGen, W:SideState, Exits, bc#203)
  States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated
  Availability: {locals = arg1:arg1:FlushedBoolean/@108 arg0:this:FlushedJSValue/Unavailable loc0:DeadFlush/Undecided loc1:DeadFlush/Undecided loc2:DeadFlush/Undecided loc3:DeadFlush/Undecided loc4:DeadFlush/Undecided loc5:ConflictingFlush/@23 loc6:DeadFlush/Undecided loc7:ConflictingFlush/@28 loc8:DeadFlush/Undecided loc9:DeadFlush/Undecided loc10:DeadFlush/Undecided loc11:DeadFlush/Undecided loc12:DeadFlush/Undecided loc13:DeadFlush/Undecided loc14:DeadFlush/Undecided loc15:DeadFlush/Undecided; heap = ActivationSymbolTablePLoc(@23, 0)=>ConflictingFlush/@131, ActivationScopePLoc(@23, 0)=>ConflictingFlush/@18, ClosureVarPLoc(@23, 0)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 1)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 2)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 3)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 4)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 5)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 6)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 7)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 8)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 9)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 10)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 11)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 12)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 13)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 14)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 15)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 16)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 17)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 18)=>ConflictingFlush/@28, ClosureVarPLoc(@23, 19)=>ConflictingFlush/@28}
  Live: 
  Values: 

GC Values:
    Strong:Cell: 0x10ac7ae00 (%CO:FunctionExecutable), ID: 15
    Weak:Cell: 0x10ac67eb0 (%Cf:Function), ID: 50
    Weak:Cell: 0x10ac37900 (%Eg:global), ID: 321
    Strong:Cell: 0x10ac3be80 (%Df:SymbolTable), ID: 19
    Weak:Cell: 0x10ac43fc0 (%C0:JSGlobalLexicalEnvironment), ID: 49
    Weak:Cell: 0x10ac67e80 (%Cf:Function), ID: 50
Desired watchpoints:
    Watchpoint sets: 0x10ade0370
    Inline watchpoint sets: 0x10ac27fe0, 0x10ac24ee0, 0x10ac278e0, 0x10ac27760, 0x10ac27d60, 0x10ac276e0, 0x10ac267e0, 0x10ac27e60
    Inferred values: 0x10ac62060
    Buffer views: 
    Object property conditions: 
    Inferred types: 
Structures:
    %C0:JSGlobalLexicalEnvironment = 0x10ac26780:[JSGlobalLexicalEnvironment, {}, NonArray, Leaf]
    %CO:FunctionExecutable         = 0x10ac27880:[FunctionExecutable, {}, NonArray, Leaf]
    %Cf:Function                   = 0x10ac26700:[Function, {}, NonArray, Proto:0x10ac2dde0]
    %Df:SymbolTable                = 0x10ac27680:[SymbolTable, {}, NonArray, Leaf]
    %Eg:global                     = 0x10ac69c80:[global, {parseInt:100, Object:101, Function:102, Array:103, RegExp:104, EvalError:105, RangeError:106, ReferenceError:107, SyntaxError:108, TypeError:109, URIError:110, Proxy:111, Set:112, Map:113, Date:114, String:115, Symbol:116, Boolean:117, Number:118, Error:119, Promise:120, ArrayBuffer:121, WeakMap:122, WeakSet:123, eval:124, Intl:125, JSON:126, Math:127, Reflect:128, DataView:129, Float64Array:130, Float32Array:131, Uint32Array:132, Int32Array:133, Uint16Array:134, Int16Array:135, Uint8ClampedArray:136, Uint8Array:137, Int8Array:138, PrivateSymbol.Int8Array:139, PrivateSymbol.Int16Array:140, PrivateSymbol.Int32Array:141, PrivateSymbol.Uint8Array:142, PrivateSymbol.Uint8ClampedArray:143, PrivateSymbol.Uint16Array:144, PrivateSymbol.Uint32Array:145, PrivateSymbol.Float32Array:146, PrivateSymbol.Float64Array:147, console:148, debug:149, describe:150, describeArray:151, print:152, quit:153, abort:154, gc:155, fullGC:156, edenGC:157, forceGCSlowPaths:158, gcHeapSize:159, addressOf:160, version:161, run:162, load:163, readFile:164, checkSyntax:165, jscStack:166, readline:167, preciseTime:168, neverInlineFunction:169, noInline:170, noDFG:171, numberOfDFGCompiles:172, optimizeNextInvocation:173, reoptimizationRetryCount:174, transferArrayBuffer:175, failNextNewCodeBlock:176, Root:177, Element:178, getElement:179, setElementRoot:180, SimpleObject:181, getHiddenValue:182, setHiddenValue:183, DFGTrue:184, OSRExit:185, isFinalTier:186, predictInt32:187, isInt32:188, fiatInt52:189, effectful42:190, makeMasquerader:191, hasCustomProperties:192, createProxy:193, createRuntimeArray:194, createImpureGetter:195, createCustomGetterObject:196, setImpureGetterDelegate:197, dumpTypesForAllVariables:198, findTypeForExpression:199, returnTypeFor:200, dumpBasicBlockExecutionRanges:201, hasBasicBlockExecuted:202, basicBlockExecutionCount:203, enableExceptionFuzz:204, drainMicrotasks:205, is32BitPlatform:206, loadModule:207, checkModuleSyntax:208, platformSupportsSamplingProfiler:209, generateHeapSnapshot:210, startSamplingProfiler:211, samplingProfilerStackTraces:212}, NonArray, Proto:0x10ac4fff0, Has been dictionary, Leaf]

ASSERTION FAILED: !edge->isPhantomAllocation()
/Volumes/Data/quartary/OpenSource/Source/JavaScriptCore/dfg/DFGValidate.cpp(594) : auto JSC::DFG::Validate::validateSSA()::<anonymous class>::operator()(const JSC::DFG::Edge &) const

Comment 4 Filip Pizlo 2016-03-15 15:52:04 PDT

I'm beginning to think that this is an awesome race condition.  This analysis probably needs to save the value of node->castOperand<FunctionExecutable*>()->singletonFunction()->isStillValid() so that it makes up its mind.

Right now, it's possible that we will decide that a NewFunction is not a sink candidate and then later decide that it doesn't escape its activation, because the watchpoint fired and so the NewFunction suddenly started to seem like a sink candidate *after* we already excluded it from that list.

Comment 5 Filip Pizlo 2016-03-15 20:37:59 PDT

Created attachment 274167 [details]
the patch

Comment 6 Mark Lam 2016-03-16 10:20:03 PDT

Comment on attachment 274167 [details]
the patch

r=me

Comment 7 Filip Pizlo 2016-03-16 13:12:35 PDT

Landed in http://trac.webkit.org/changeset/198296