Bug 170222 – [JSC][MIPS][DFG] Use x86 generic HasOwnProperty

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Guillaume Emont]

We don't have enough registers for the generic version of the intrinsic, and simply using the X86 version on MIPS makes some stress tests crash.

  stress/has-own-property-name-cache-string-keys.js
  DFG ASSERTION FAILED: Edge verification error: @80->Check:String:@57 was expected to have type String but has type Top (14898167807)
  ../Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h(134) : void JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge(JSC::DFG::Node*, JSC::DFG
  ::Edge) [with AbstractStateType = JSC::DFG::InPlaceAbstractState]

and

  JSTests/stress/has-own-property-name-cache-symbol-keys.js
  DFG ASSERTION FAILED: Edge verification error: @80->Check:Symbol:@57 was expected to have type Symbol but has type Top (14898167807)
  ../Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h(134) : void JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge(JSC::DFG::Node*, JSC::DFG
  ::Edge) [with AbstractStateType = JSC::DFG::InPlaceAbstractState]


Ideally we should see if we can fix the X86 version or make a MIPS variant of it (I started playing with that but don't have it working yet), in the mean time, I think we should deactivate the intrinsic on MIPS.

[Guillaume Emont]

Created attachment 305692 [details]
Patch

The patch.

[Yusuke Suzuki]

Comment on attachment 305692 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=305692&action=review

> Source/JavaScriptCore/ChangeLog:10
> +

I think we should fix this issue.
This is DFG edge verification assertion.
Could you paste the actual dump for this assertion?

[Guillaume Emont]

Here is the full dump when running has-own-property-name-cache-string-keys.js. This is on MIPS, when enabling the intrinsic and using the X86 special case for MIPS too (adding an "or CPU(MIPS)").

# jsc JSTests/stress/has-own-property-name-cache-string-keys.js
DFG ASSERTION FAILED: Edge verification error: @80->Check:String:@57 was expected to have type String but has type Top (14898167807)
../Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h(134) : void JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge(JSC::DFG::Node*, JSC::DFG::Edge) [with AbstractStateType = JSC::DFG::InPlaceAbstractState]

While handling node @80

Graph at time of failure:

DFG for foo#<no-hash>:[0x71d834e0->0x71d83900->0x71dd2170, DFGFunctionCall, 141 (NeverInline)]:
  Fixpoint state: FixpointConverged; Form: ThreadedCPS; Unification state: GloballyUnified; Ref count state: ExactRefCount
  Arguments: -, @1

Block #0 (bc#0): (OSR target)
  Execution count: 1.000000
  Predecessors:
  Successors: #1 #2
  Dominated by: #0
  Dominates: #0 #1 #2
  Dominance Frontier:
  Iterated Dominance Frontier:
  States: StructuresAreWatched
  Vars Before: arg1:(Cell, TOP, TOP) arg0:(TopEmpty, TOP, TOP)
  Intersected Vars Before: arg1:(Cell, TOP, TOP) arg0:(TopEmpty, TOP, TOP)
  Var Links: arg1:@1
   1:< 3:->     SetArgument(IsFlushed, arg1(B<Final>/FlushedCell), machine:arg1, W:SideState, bc#0)  predicting Final
   2:< 3:loc3>  JSConstant(JS|PureInt, Other, Undefined, bc#0)
   3:<!0:->     MovHint(Untyped:@2, MustGen, loc0, W:SideState, ClobbersExit, bc#0)
   5:<!0:->     MovHint(Untyped:@2, MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid)
   7:<!0:->     MovHint(Untyped:@2, MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid)
  10:< 3:loc3>  JSConstant(JS|UseAsOther, Otherobj, Weak:Object: 0x71dd80a0 with butterfly (nil) (%Aq:JSGlobalLexicalEnvironment), bc#1)
  11:<!0:->     MovHint(Untyped:@10, MustGen, loc0, W:SideState, ClobbersExit, bc#1)
  12:< 1:->     SetLocal(Untyped:@10, loc0(F~<Object>/FlushedJSValue), machine:loc0, W:Stack(-1), bc#1, exit: bc#3)  predicting Otherobj
  13:<!0:->     MovHint(Untyped:@10, MustGen, loc1, W:SideState, ClobbersExit, bc#3)
  15:<!0:->     CheckTraps(MustGen, W:Watchpoint_fire, Exits, ClobbersExit, bc#6)
 115:<!0:->     InvalidationPoint(MustGen, W:SideState, Exits, bc#7)
  16:< 2:loc3>  JSConstant(JS|PureInt, Empty, <JSValue()>, bc#7)
  17:<!0:->     MovHint(Untyped:@16, MustGen, loc3, W:SideState, ClobbersExit, bc#7)
  19:< 1:loc4>  JSConstant(JS|UseAsOther, Otherobj, Weak:Object: 0x71dec0a0 with butterfly 0x71d8c4a8 (%Af:global), bc#10)
  20:<!0:->     MovHint(Untyped:@19, MustGen, loc7, W:SideState, ClobbersExit, bc#10)
  25:< 2:loc4>  JSConstant(JS|UseAsOther, Otherobj, Weak:Object: 0x71de0140 with butterfly 0x6e4529c8 (%C4:Function), bc#17)
  27:<!0:->     MovHint(Untyped:@25, MustGen, loc7, W:SideState, ClobbersExit, bc#17)
  31:< 2:loc5>  JSConstant(JS|UseAsOther, Function, Weak:Object: 0x71df7fa0 with butterfly 0x6e463fa8 (%EV:Function), bc#25)
  32:<!0:->     MovHint(Untyped:@31, MustGen, loc4, W:SideState, ClobbersExit, bc#25)
  34:<!2:loc6>  GetLocal(Untyped:@1, JS|MustGen|UseAsOther, Final, arg1(B<Final>/FlushedCell), machine:arg1, R:Stack(5), bc#34)  predicting Final
  35:<!0:->     MovHint(Untyped:@34, MustGen, loc6, W:SideState, ClobbersExit, bc#34)
  37:<!5:loc6>  DirectCall(Untyped:@31, Untyped:@25, Untyped:@34, JS|MustGen|VarArgs|UseAsOther, Array, <0x71d87c20, NativeExecutable>, <host function>, R:World, W:Heap, Exits, ClobbersExit, bc#37)  predicting Array
  38:<!0:->     MovHint(Untyped:@37, MustGen, loc3, W:SideState, ClobbersExit, bc#37, ExitInvalid)
 116:<!0:->     InvalidationPoint(MustGen, W:SideState, Exits, bc#37, exit: bc#46)
 117:<!0:->     CheckStructure(Check:Cell:@37, MustGen, [%Ai:Array], R:JSCell_structureID, Exits, bc#37, exit: bc#46)
  39:< 1:->     SetLocal(Cell:@37, loc3(M<Array>/FlushedCell), machine:loc1, W:Stack(-4), bc#37, exit: bc#46)  predicting Array
  40:<!0:->     MovHint(Untyped:@16, MustGen, loc4, W:SideState, ClobbersExit, bc#46)
  42:< 3:loc3>  JSConstant(JS|UseAsOther|ReallyWantsInt, Boolint32, Int32: 0, bc#49)
  43:<!0:->     MovHint(Untyped:@42, MustGen, loc4, W:SideState, ClobbersExit, bc#49)
  44:< 1:->     SetLocal(Int32:@42, loc4(O<Int32>/FlushedInt32), machine:loc2, W:Stack(-5), bc#49, exit: bc#52)  predicting Int32
 107:< 1:loc4>  GetButterfly(Cell:@37, Storage|PureInt, R:JSObject_butterfly, Exits, bc#52)
  45:< 2:loc4>  GetArrayLength(KnownCell:@37, Untyped:@107, JS|UseAsOther, Nonboolint32, Contiguous+OriginalArray+InBounds+AsIs, R:Butterfly_publicLength, Exits, bc#52)
  46:<!0:->     MovHint(Untyped:@45, MustGen, loc5, W:SideState, ClobbersExit, bc#52, ExitInvalid)
  48:< 1:loc4>  CompareLess(Int32:@42, Int32:@45, Boolean|UseAsOther, Bool, Exits, bc#61)
  49:<!0:->     Branch(KnownBoolean:@48, MustGen, T:#1/w:10.000000, F:#2/w:1.000000, W:SideState, bc#61, ExitInvalid)
  States: TakeBoth, StructuresAreWatched
  Vars After: arg1:(Cell, TOP, TOP) arg0:(TopEmpty, TOP, TOP) loc0:(Otherobj, TOP, [%Aq:JSGlobalLexicalEnvironment], Object: 0x71dd80a0 with butterfly (nil) (%Aq:JSGlobalLexicalEnvironment)) loc1:(Otherobj, TOP, [%Aq:JSGlobalLexicalEnvironment], Object: 0x71dd80a0 with butterfly (nil) (%Aq:JSGlobalLexicalEnvironment)) loc2:(Other, Undefined) loc3:(Array, ArrayWithContiguous, [%Ai:Array]) loc4:(Boolint32, Int32: 0) loc5:(Int32) loc6:(Cell, TOP, TOP) loc7:(Otherobj, TOP, [%C4:Function], Object: 0x71de0140 with butterfly 0x6e4529c8 (%C4:Function))
  Var Links: arg1:@34 loc0:@12 loc3:@39 loc4:@44

Block #1 (bc#65): (OSR target)
  Execution count: 10.000000
  Predecessors: #0 #1
  Successors: #1 #2
  Dominated by: #0 #1
  Dominates: #1
  Dominance Frontier: #1 #2
  Iterated Dominance Frontier: #1 #2
  Loop header, contains: #1
  Containing loop headers: #1
  Phi Nodes: @103<loc3,2>->(@103, @39), @104<loc4,1>->(@92, @44), @105<loc0,2>->(@105, @12), @101<arg1,3>->(@101, @1)
  States: StructuresAreWatched
  Vars Before: arg1:(Cell, TOP, TOP) loc0:(Otherobj, TOP, [%Aq:JSGlobalLexicalEnvironment], Object: 0x71dd80a0 with butterfly (nil) (%Aq:JSGlobalLexicalEnvironment)) loc3:(Array, ArrayWithContiguous, [%Ai:Array]) loc4:(Int32)
  Intersected Vars Before: arg1:(Cell, TOP, TOP) loc0:(Otherobj, TOP, [%Aq:JSGlobalLexicalEnvironment], Object: 0x71dd80a0 with butterfly (nil) (%Aq:JSGlobalLexicalEnvironment)) loc3:(Array, ArrayWithContiguous, [%Ai:Array]) loc4:(Int32)
  Var Links: arg1:@101 loc0:@118 loc3:@103 loc4:@104
  50:<!0:->     LoopHint(MustGen, W:SideState, bc#65)
  51:<!0:->     CheckTraps(MustGen, W:Watchpoint_fire, Exits, ClobbersExit, bc#66)
 112:<!0:->     InvalidationPoint(MustGen, W:SideState, Exits, bc#67)
  52:< 1:loc4>  JSConstant(JS|PureInt, Empty, <JSValue()>, bc#67)
  53:<!0:->     MovHint(Untyped:@52, MustGen, loc5, W:SideState, ClobbersExit, bc#67)
  55:<!5:loc4>  GetLocal(Untyped:@103, JS|MustGen|UseAsOther, Array, loc3(M<Array>/FlushedCell), machine:loc1, R:Stack(-4), bc#70)  predicting Array
  56:<!2:loc3>  GetLocal(Untyped:@104, JS|MustGen|PureNum|UseAsOther|UseAsInt|ReallyWantsInt, Int32, loc4(O<Int32>/FlushedInt32), machine:loc2, R:Stack(-5), bc#70)  predicting Int32
 109:< 1:loc6>  GetButterfly(Cell:@55, Storage|PureInt, R:JSObject_butterfly, Exits, bc#70)
  57:<!3:loc6>  GetByVal(KnownCell:@55, Int32:@56, Untyped:@109, JS|MustGen|UseAsOther, Stringident, Contiguous+OriginalArray+SaneChain+AsIs, R:Butterfly_publicLength,IndexedContiguousProperties, Exits, bc#70)  predicting Stringident
  58:<!0:->     MovHint(Untyped:@57, MustGen, loc5, W:SideState, ClobbersExit, bc#70, ExitInvalid)
  60:< 2:loc5>  JSConstant(JS|UseAsOther, Otherobj, Weak:Object: 0x71dec0a0 with butterfly 0x71d8c4a8 (%Af:global), bc#76)
  61:<!0:->     MovHint(Untyped:@60, MustGen, loc9, W:SideState, ClobbersExit, bc#76)
 118:<!0:->     PhantomLocal(Untyped:@105, MustGen, loc0(F~<Object>/FlushedJSValue), machine:loc0, W:SideState, bc#76, ExitInvalid)  predicting Otherobj
  66:< 2:loc7>  JSConstant(JS|UseAsOther, Function, Weak:Object: 0x71df7080 with butterfly (nil) (%EU:Function), bc#83)
  67:<!0:->     MovHint(Untyped:@66, MustGen, loc6, W:SideState, ClobbersExit, bc#83)
  69:<!3:loc8>  GetLocal(Untyped:@101, JS|MustGen|UseAsOther, Final, arg1(B<Final>/FlushedCell), machine:arg1, R:Stack(5), bc#91)  predicting Final
  70:<!0:->     MovHint(Untyped:@69, MustGen, loc11, W:SideState, ClobbersExit, bc#91)
  73:<!0:->     CheckStructure(Cell:@69, MustGen, [%Ea:Object, %EG:Object, %Dy:Object, %EM:Object], R:JSCell_structureID, Exits, bc#94)
  74:< 2:loc9>  JSConstant(JS|UseAsOther, Function, Weak:Object: 0x71df4200 with butterfly 0x71ddc268 (%EV:Function), bc#94)
  75:<!0:->     MovHint(Untyped:@74, MustGen, loc8, W:SideState, ClobbersExit, bc#94)
  77:<!0:->     MovHint(Untyped:@57, MustGen, loc10, W:SideState, ClobbersExit, bc#103)
  80:< 2:loc6>  HasOwnProperty(Object:@69, Check:String:@57, Boolean|UseAsOther, Bool, R:World, W:Heap, Exits, ClobbersExit, bc#106)
  84:<!0:->     Phantom(Check:Untyped:@74, MustGen, bc#106, ExitInvalid)
  81:<!0:->     MovHint(Untyped:@80, MustGen, loc8, W:SideState, ClobbersExit, bc#106, ExitInvalid)
 113:<!0:->     InvalidationPoint(MustGen, W:SideState, Exits, bc#106, exit: bc#115)
  86:<!1:loc6>  DirectCall(Untyped:@66, Untyped:@60, Untyped:@80, JS|MustGen|VarArgs|PureInt, Other, <0x71dd2100, FunctionExecutable>, assert#<no-hash>/<nogen>:[0x71dd2100], R:World, W:Heap, Exits, ClobbersExit, bc#115)  predicting Other
  87:<!0:->     MovHint(Untyped:@86, MustGen, loc6, W:SideState, ClobbersExit, bc#115, ExitInvalid)
 114:<!0:->     InvalidationPoint(MustGen, W:SideState, Exits, bc#115, exit: bc#124)
  89:< 1:loc6>  JSConstant(JS|PureNum|ReallyWantsInt, Boolint32, Int32: 1, bc#124)
  90:<!3:loc6>  ArithAdd(Int32:@56, Int32:@89, Number|MustGen|UseAsOther|ReallyWantsInt, Int32, CheckOverflow, Exits, bc#124)
  91:<!0:->     MovHint(Untyped:@90, MustGen, loc4, W:SideState, ClobbersExit, bc#124)
  92:< 1:->     SetLocal(Int32:@90, loc4(O<Int32>/FlushedInt32), machine:loc2, W:Stack(-5), bc#124, exit: bc#126)  predicting Int32
 110:<!0:->     CheckStructure(Cell:@55, MustGen, [%Ai:Array], R:JSCell_structureID, Exits, bc#126)
 111:< 1:loc3>  GetButterfly(Cell:@55, Storage|PureInt, R:JSObject_butterfly, Exits, bc#126)
  93:< 2:loc3>  GetArrayLength(KnownCell:@55, Untyped:@111, JS|UseAsOther, Nonboolint32, Contiguous+OriginalArray+InBounds+AsIs, R:Butterfly_publicLength, Exits, bc#126)
  94:<!0:->     MovHint(Untyped:@93, MustGen, loc5, W:SideState, ClobbersExit, bc#126, ExitInvalid)
  96:< 1:loc3>  CompareLess(Int32:@90, Int32:@93, Boolean|UseAsOther, Bool, Exits, bc#135)
  97:<!0:->     Branch(KnownBoolean:@96, MustGen, T:#1/w:10.000000, F:#2/w:1.000000, W:SideState, bc#135, ExitInvalid)
  States: TakeBoth, StructuresAreWatched
  Vars After: arg1:(Final, TOP, TOP) loc0:(Otherobj, TOP, [%Aq:JSGlobalLexicalEnvironment], Object: 0x71dd80a0 with butterfly (nil) (%Aq:JSGlobalLexicalEnvironment)) loc3:(Array, ArrayWithContiguous, [%Ai:Array]) loc4:(Int32) loc5:(Int32) loc6:(Top, TOP, TOP) loc8:(Bool) loc9:(Otherobj, TOP, TOP, Object: 0x71dec0a0 with butterfly 0x71d8c4a8 (%Af:global)) loc10:(String, TOP, TOP) loc11:(Final, TOP, TOP)
  Var Links: arg1:@69 loc0:@118 loc3:@55 loc4:@92

Block #2 (bc#139):
  Execution count: 1.000000
  Predecessors: #0 #1
  Successors:
  Dominated by: #0 #2
  Dominates: #2
  Dominance Frontier:
  Iterated Dominance Frontier:
  Phi Nodes: @102<arg1,1>->(@101, @1)
  States: StructuresAreWatched
  Vars Before: arg1:(Cell, TOP, TOP)
  Intersected Vars Before: arg1:(Cell, TOP, TOP)
  Var Links: arg1:@100
  98:< 1:loc3>  JSConstant(JS|UseAsOther, Other, Undefined, bc#139)
  99:<!0:->     Return(Untyped:@98, MustGen, W:SideState, Exits, bc#139)
 100:<!0:->     Flush(Check:Untyped:@102, MustGen|IsFlushed, arg1(B<Final>/FlushedCell), machine:arg1, R:Stack(5), W:SideState, bc#139)  predicting Final
  States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated
  Vars After:
  Var Links: arg1:@100

GC Values:
    Weak:Cell: 0x71d87c20 (%BU:NativeExecutable)
    Weak:Cell: 0x71dd2100 (%DA:FunctionExecutable)
    Weak:Object: 0x71df4200 with butterfly 0x71ddc268 (%EV:Function)
    Weak:Object: 0x71df7080 with butterfly (nil) (%EU:Function)
    Weak:Object: 0x71df7fa0 with butterfly 0x6e463fa8 (%EV:Function)
    Weak:Object: 0x71de0140 with butterfly 0x6e4529c8 (%C4:Function)
    Weak:Object: 0x71dec0a0 with butterfly 0x71d8c4a8 (%Af:global)
    Weak:Object: 0x71dd80a0 with butterfly (nil) (%Aq:JSGlobalLexicalEnvironment)
    Weak:Object: 0x71df70a0 with butterfly (nil) (%EU:Function)
Desired watchpoints:
    Watchpoint sets: 0x74d9d738, 0x74d79ba0
    Inline watchpoint sets: 0x71df84ec, 0x71df91bc, 0x71df83fc, 0x71df80dc, 0x71df81cc, 0x71df989c, 0x71df85dc, 0x57d7f73c, 0x71df952c
    Inferred values: 0x71de5440
    Buffer views:
    Object property conditions: <Object: 0x71dec0a0 with butterfly 0x71d8c4a8 (%Af:global): Equivalence of Object with Object: 0x71de0140 with butterfly 0x6e4529c8 (%C4:Function)>, <Object: 0x71dc80a0 with butterfly 0x71dc4128 (%C9:Object): Equivalence of hasOwnProperty with Object: 0x71df4200 with butterfly 0x71ddc268 (%EV:Function)>
    Inferred types:
Structures:
    %Af:global                     = 0x71da03c0:[global, {parseInt:100, Object:101, Function:102, Array:103, RegExp:104, RangeError:105, TypeError:106, PrivateSymbol.Object:107, PrivateSymbol.Array:108, ArrayBuffer:109, SharedArrayBuffer:110, String:111, Symbol:112, Number:113, Error:114, Map:115, Promise:116, eval:117, Intl:118, Reflect:119, debug:120, describe:121, describeArray:122, print:123, printErr:124, quit:125, abort:126, gc:127, fullGC:128, edenGC:129, forceGCSlowPaths:130, gcHeapSize:131, addressOf:132, getGetterSetter:133, version:134, run:135, runString:136, load:137, loadString:138, readFile:139, read:140, checkSyntax:141, sleepSeconds:142, jscStack:143, readline:144, preciseTime:145, neverInlineFunction:146, noInline:147, noDFG:148, noFTL:149, noOSRExitFuzzing:150, numberOfDFGCompiles:151, jscOptions:152, optimizeNextInvocation:153, reoptimizationRetryCount:154, transferArrayBuffer:155, failNextNewCodeBlock:156, shadowChickenFunctionsOnStack:157, setGlobalConstRedeclarationShouldNotThrow:158, Root:159, Element:160, getElement:161, setElementRoot:162, SimpleObject:163, getHiddenValue:164, setHiddenValue:165, DFGTrue:166, OSRExit:167, isFinalTier:168, predictInt32:169, isInt32:170, fiatInt52:171, effectful42:172, makeMasquerader:173, hasCustomProperties:174, createProxy:175, createRuntimeArray:176, createImpureGetter:177, createCustomGetterObject:178, createDOMJITNodeObject:179, createDOMJITGetterObject:180, createDOMJITGetterComplexObject:181, createDOMJITFunctionObject:182, createBuiltin:183, createGlobalObject:184, setImpureGetterDelegate:185, dumpTypesForAllVariables:186, findTypeForExpression:187, returnTypeFor:188, dumpBasicBlockExecutionRanges:189, hasBasicBlockExecuted:190, basicBlockExecutionCount:191, enableExceptionFuzz:192, drainMicrotasks:193, getRandomSeed:194, setRandomSeed:195, isRope:196, callerSourceOrigin:197, globalObjectForObject:198, is32BitPlatform:199, loadModule:200, checkModuleSyntax:201, platformSupportsSamplingProfiler:202, generateHeapSnapshot:203, resetSuperSamplerState:204, ensureArrayStorage:205, startSamplingProfiler:206, samplingProfilerStackTraces:207, maxArguments:208, asyncTestStart:209, asyncTestPassed:210, console:211, $:212, waitForReport:213, heapCapacity:214, flashHeapAccess:215, Math:216, Date:217}, NonArray, Proto:0x71dc80a0, Dictionary, Leaf]
    %Ai:Array                      = 0x71df9c70:[Array, {}, ArrayWithContiguous, Proto:0x71df43c0]
    %Aq:JSGlobalLexicalEnvironment = 0x71df9180:[JSGlobalLexicalEnvironment, {}, NonArray, Leaf]
    %BU:NativeExecutable           = 0x71df83c0:[NativeExecutable, {}, NonArray, Leaf]
    %C4:Function                   = 0x57d7f700:[Function, {name:100, prototype:101, length:102, PrivateSymbol.create:103, PrivateSymbol.defineProperty:104, PrivateSymbol.getPrototypeOf:105, PrivateSymbol.getOwnPropertyNames:106, PrivateSymbol.getOwnPropertyDescriptor:107, getOwnPropertyNames:108}, NonArray, Proto:0x71de00a0, Leaf]
    %C9:Object                     = 0x71df94f0:[Object, {toString:100, toLocaleString:101, valueOf:102, hasOwnProperty:103, propertyIsEnumerable:104, isPrototypeOf:105, __defineGetter__:106, __defineSetter__:107, __lookupGetter__:108, __lookupSetter__:109, __proto__:110, constructor:111}, NonArray, Leaf]
    %DA:FunctionExecutable         = 0x71df84b0:[FunctionExecutable, {}, NonArray, Leaf]
    %Dy:Object                     = 0x71da1f90:[Object, {0foo:0, 1foo:1, 2foo:2, 3foo:3, 4foo:4, 5foo:5, 6foo:100, 7foo:101, 8foo:102, 9foo:103, 10foo:104, 11foo:105, 12foo:106, 13foo:107, 14foo:108, 15foo:109, 16foo:110, 17foo:111, 18foo:112, 19foo:113, 20foo:114, 21foo:115, 22foo:116, 23foo:117, 24foo:118, 25foo:119, 26foo:120, 27foo:121, 28foo:122, 29foo:123, 30foo:124, 31foo:125, 32foo:126, 33foo:127, 34foo:128, 35foo:129, 36foo:130, 37foo:131, 38foo:132, 39foo:133, 40foo:134, 41foo:135, 42foo:136, 43foo:137, 44foo:138, 45foo:139, 46foo:140, 47foo:141, 48foo:142, 49foo:143, 50foo:144, 51foo:145, 52foo:146, 53foo:147, 54foo:148, 55foo:149, 56foo:150, 57foo:151, 58foo:152, 59foo:153, 60foo:154, 61foo:155, 62foo:156, 63foo:157, 64foo:158, 65foo:159, 66foo:160, 67foo:161, 68foo:162, 69foo:163, 70foo:164, 71foo:165, 72foo:166, 73foo:167, 74foo:168, 75foo:169, 76foo:170, 77foo:171, 78foo:172, 79foo:173, 80foo:174, 81foo:175, 82foo:176, 83foo:177, 84foo:178, 85foo:179, 86foo:180, 87foo:181, 88foo:182, 89foo:183, 90foo:184, 91foo:185, 92foo:186, 93foo:187, 94foo:188, 95foo:189, 96foo:190, 97foo:191, 98foo:192, 99foo:193, 100foo:194, 101foo:195, 102foo:196, 103foo:197, 104foo:198, 105foo:199, 106foo:200, 107foo:201, 108foo:202, 109foo:203, 110foo:204, 111foo:205, 112foo:206, 113foo:207, 114foo:208, 115foo:209, 116foo:210, 117foo:211, 118foo:212, 119foo:213, 120foo:214, 121foo:215, 122foo:216, 123foo:217, 124foo:218, 125foo:219, 126foo:220, 127foo:221, 128foo:222, 129foo:223, 130foo:224, 131foo:225, 132foo:226, 133foo:227, 134foo:228, 135foo:229, 136foo:230, 137foo:231, 138foo:232, 139foo:233, 140foo:234, 141foo:235, 142foo:236, 143foo:237, 144foo:238, 145foo:239, 146foo:240, 147foo:241, 148foo:242, 149foo:243, 150foo:244, 151foo:245, 152foo:246, 153foo:247, 154foo:248, 155foo:249, 156foo:250, 157foo:251, 158foo:252, 159foo:253, 160foo:254, 161foo:255, 162foo:256, 163foo:257, 164foo:258, 165foo:259, 166foo:260, 167foo:261, 168foo:262, 169foo:263, 170foo:264, 171foo:265, 172foo:266, 173foo:267, 174foo:268, 175foo:269, 176foo:270, 177foo:271, 178foo:272, 179foo:273, 180foo:274, 181foo:275, 182foo:276, 183foo:277, 184foo:278, 185foo:279, 186foo:280, 187foo:281, 188foo:282, 189foo:283, 190foo:284, 191foo:285, 192foo:286, 193foo:287, 194foo:288, 195foo:289, 196foo:290, 197foo:291, 198foo:292, 199foo:293, 200foo:294, 201foo:295, 202foo:296, 203foo:297, 204foo:298, 205foo:299, 206foo:300, 207foo:301, 208foo:302, 209foo:303, 210foo:304, 211foo:305, 212foo:306, 213foo:307, 214foo:308, 215foo:309, 216foo:310, 217foo:311, 218foo:312, 219foo:313, 220foo:314, 221foo:315, 222foo:316, 223foo:317, 224foo:318, 225foo:319, 226foo:320, 227foo:321, 228foo:322, 229foo:323, 230foo:324, 231foo:325, 232foo:326, 233foo:327, 234foo:328, 235foo:329, 236foo:330, 237foo:331, 238foo:332, 239foo:333, 240foo:334, 241foo:335, 242foo:336, 243foo:337, 244foo:338, 245foo:339, 246foo:340, 247foo:341, 248foo:342, 249foo:343, 250foo:344, 251foo:345, 252foo:346, 253foo:347, 254foo:348, 255foo:349, 256foo:350, 257foo:351, 258foo:352, 259foo:353, 260foo:354, 261foo:355, 262foo:356, 263foo:357, 264foo:358, 265foo:359, 266foo:360, 267foo:361, 268foo:362, 269foo:363, 270foo:364, 271foo:365, 272foo:366, 273foo:367, 274foo:368, 275foo:369, 276foo:370, 277foo:371, 278foo:372, 279foo:373, 280foo:374, 281foo:375, 282foo:376, 283foo:377, 284foo:378, 285foo:379, 286foo:380, 287foo:381, 288foo:382, 289foo:383, 290foo:384, 291foo:385, 292foo:386, 293foo:387, 294foo:388, 295foo:389, 296foo:390, 297foo:391, 298foo:392, 299foo:393, 300foo:394, 301foo:395, 302foo:396, 303foo:397, 304foo:398, 305foo:399, 306foo:400, 307foo:401, 308foo:402, 309foo:403, 310foo:404, 311foo:405, 312foo:406, 313foo:407, 314foo:408, 315foo:409, 316foo:410, 317foo:411, 318foo:412, 319foo:413, 320foo:414, 321foo:415, 322foo:416, 323foo:417, 324foo:418, 325foo:419, 326foo:420, 327foo:421, 328foo:422, 329foo:423, 330foo:424, 331foo:425, 332foo:426, 333foo:427, 334foo:428, 335foo:429, 336foo:430, 337foo:431, 338foo:432, 339foo:433, 340foo:434, 341foo:435, 342foo:436, 343foo:437, 344foo:438, 345foo:439, 346foo:440, 347foo:441, 348foo:442, 349foo:443, 350foo:444, 351foo:445, 352foo:446, 353foo:447, 354foo:448, 355foo:449, 356foo:450, 357foo:451, 358foo:452, 359foo:453, 360foo:454, 361foo:455, 362foo:456, 363foo:457, 364foo:458, 365foo:459, 366foo:460, 367foo:461, 368foo:462, 369foo:463, 370foo:464, 371foo:465, 372foo:466, 373foo:467, 374foo:468, 375foo:469, 376foo:470, 377foo:471, 378foo:472, 379foo:473, 380foo:474, 381foo:475, 382foo:476, 383foo:477, 384foo:478, 385foo:479, 386foo:480, 387foo:481, 388foo:482, 389foo:483, 390foo:484, 391foo:485, 392foo:486, 393foo:487, 394foo:488, 395foo:489, 396foo:490, 397foo:491, 398foo:492, 399foo:493, 400foo:494, 401foo:495, 402foo:496, 403foo:497, 404foo:498, 405foo:499, 406foo:500, 407foo:501, 408foo:502, 409foo:503, 410foo:504, 411foo:505, 412foo:506, 413foo:507, 414foo:508, 415foo:509, 416foo:510, 417foo:511, 418foo:512, 419foo:513, 420foo:514, 421foo:515, 422foo:516, 423foo:517, 424foo:518, 425foo:519, 426foo:520, 427foo:521, 428foo:522, 429foo:523, 430foo:524, 431foo:525, 432foo:526, 433foo:527, 434foo:528, 435foo:529, 436foo:530, 437foo:531, 438foo:532, 439foo:533, 440foo:534, 441foo:535, 442foo:536, 443foo:537, 444foo:538, 445foo:539, 446foo:540, 447foo:541, 448foo:542, 449foo:543, 450foo:544, 451foo:545, 452foo:546, 453foo:547, 454foo:548, 455foo:549, 456foo:550, 457foo:551}, NonArray, Proto:0x71dc80a0, Has been dictionary, Leaf]
    %EG:Object                     = 0x71da1540:[Object, {0foo:0, 1foo:1, 2foo:2, 3foo:3, 4foo:4, 5foo:5, 6foo:100, 7foo:101, 8foo:102, 9foo:103, 10foo:104, 11foo:105, 12foo:106, 13foo:107, 14foo:108, 15foo:109, 16foo:110, 17foo:111, 18foo:112, 19foo:113, 20foo:114, 21foo:115, 22foo:116, 23foo:117, 24foo:118, 25foo:119, 26foo:120, 27foo:121, 28foo:122, 29foo:123, 30foo:124, 31foo:125, 32foo:126, 33foo:127, 34foo:128}, NonArray, Proto:0x71dc80a0]
    %EM:Object                     = 0x71da1fe0:[Object, {0foo:0, 1foo:1, 2foo:2, 3foo:3, 4foo:4, 5foo:5, 6foo:100, 7foo:101, 8foo:102, 9foo:103, 10foo:104, 11foo:105, 12foo:106, 13foo:107, 14foo:108, 15foo:109, 16foo:110, 17foo:111, 18foo:112, 19foo:113, 20foo:114, 21foo:115, 22foo:116, 23foo:117, 24foo:118, 25foo:119, 26foo:120, 27foo:121, 28foo:122, 29foo:123, 30foo:124, 31foo:125, 32foo:126, 33foo:127, 34foo:128, 35foo:129, 36foo:130, 37foo:131, 38foo:132, 39foo:133, 40foo:134, 41foo:135, 42foo:136, 43foo:137, 44foo:138, 45foo:139, 46foo:140, 47foo:141, 48foo:142, 49foo:143, 50foo:144, 51foo:145, 52foo:146, 53foo:147, 54foo:148, 55foo:149, 56foo:150, 57foo:151, 58foo:152, 59foo:153, 60foo:154, 61foo:155, 62foo:156, 63foo:157, 64foo:158, 65foo:159, 66foo:160, 67foo:161, 68foo:162, 69foo:163, 70foo:164, 71foo:165, 72foo:166, 73foo:167, 74foo:168, 75foo:169, 76foo:170, 77foo:171, 78foo:172, 79foo:173, 80foo:174, 81foo:175, 82foo:176, 83foo:177, 84foo:178, 85foo:179, 86foo:180, 87foo:181, 88foo:182, 89foo:183, 90foo:184, 91foo:185, 92foo:186, 93foo:187, 94foo:188, 95foo:189, 96foo:190, 97foo:191, 98foo:192, 99foo:193, 100foo:194, 101foo:195, 102foo:196, 103foo:197, 104foo:198, 105foo:199, 106foo:200, 107foo:201, 108foo:202, 109foo:203, 110foo:204, 111foo:205, 112foo:206, 113foo:207, 114foo:208, 115foo:209, 116foo:210, 117foo:211, 118foo:212, 119foo:213, 120foo:214, 121foo:215, 122foo:216, 123foo:217, 124foo:218, 125foo:219, 126foo:220, 127foo:221, 128foo:222, 129foo:223, 130foo:224, 131foo:225, 132foo:226, 133foo:227, 134foo:228, 135foo:229, 136foo:230, 137foo:231, 138foo:232, 139foo:233, 140foo:234, 141foo:235, 142foo:236, 143foo:237, 144foo:238, 145foo:239, 146foo:240, 147foo:241, 148foo:242, 149foo:243, 150foo:244, 151foo:245, 152foo:246, 153foo:247, 154foo:248, 155foo:249, 156foo:250, 157foo:251, 158foo:252, 159foo:253, 160foo:254, 161foo:255, 162foo:256, 163foo:257, 164foo:258, 165foo:259, 166foo:260, 167foo:261, 168foo:262, 169foo:263, 170foo:264, 171foo:265, 172foo:266, 173foo:267, 174foo:268, 175foo:269, 176foo:270, 177foo:271, 178foo:272, 179foo:273, 180foo:274, 181foo:275, 182foo:276, 183foo:277, 184foo:278, 185foo:279, 186foo:280, 187foo:281, 188foo:282, 189foo:283, 190foo:284, 191foo:285, 192foo:286, 193foo:287, 194foo:288, 195foo:289, 196foo:290, 197foo:291, 198foo:292, 199foo:293, 200foo:294, 201foo:295, 202foo:296, 203foo:297, 204foo:298, 205foo:299, 206foo:300, 207foo:301, 208foo:302, 209foo:303, 210foo:304, 211foo:305, 212foo:306, 213foo:307, 214foo:308, 215foo:309, 216foo:310, 217foo:311, 218foo:312, 219foo:313, 220foo:314, 221foo:315, 222foo:316, 223foo:317, 224foo:318, 225foo:319, 226foo:320, 227foo:321, 228foo:322, 229foo:323, 230foo:324, 231foo:325, 232foo:326, 233foo:327, 234foo:328, 235foo:329, 236foo:330, 237foo:331, 238foo:332, 239foo:333, 240foo:334, 241foo:335, 242foo:336, 243foo:337, 244foo:338, 245foo:339, 246foo:340, 247foo:341, 248foo:342, 249foo:343, 250foo:344, 251foo:345, 252foo:346, 253foo:347, 254foo:348, 255foo:349, 256foo:350, 257foo:351, 258foo:352, 259foo:353, 260foo:354, 261foo:355, 262foo:356, 263foo:357, 264foo:358, 265foo:359, 266foo:360, 267foo:361, 268foo:362, 269foo:363, 270foo:364, 271foo:365, 272foo:366, 273foo:367, 274foo:368, 275foo:369, 276foo:370, 277foo:371, 278foo:372, 279foo:373, 280foo:374, 281foo:375, 282foo:376, 283foo:377, 284foo:378, 285foo:379, 286foo:380, 287foo:381, 288foo:382, 289foo:383, 290foo:384, 291foo:385, 292foo:386, 293foo:387, 294foo:388, 295foo:389, 296foo:390, 297foo:391, 298foo:392, 299foo:393, 300foo:394, 301foo:395, 302foo:396, 303foo:397, 304foo:398, 305foo:399, 306foo:400, 307foo:401, 308foo:402, 309foo:403, 310foo:404, 311foo:405, 312foo:406, 313foo:407, 314foo:408, 315foo:409, 316foo:410, 317foo:411, 318foo:412, 319foo:413, 320foo:414, 321foo:415, 322foo:416, 323foo:417, 324foo:418, 325foo:419, 326foo:420, 327foo:421, 328foo:422, 329foo:423, 330foo:424, 331foo:425, 332foo:426, 333foo:427, 334foo:428, 335foo:429, 336foo:430, 337foo:431, 338foo:432, 339foo:433, 340foo:434, 341foo:435, 342foo:436, 343foo:437, 344foo:438, 345foo:439, 346foo:440, 347foo:441, 348foo:442, 349foo:443, 350foo:444, 351foo:445, 352foo:446, 353foo:447, 354foo:448, 355foo:449, 356foo:450, 357foo:451, 358foo:452, 359foo:453, 360foo:454, 361foo:455, 362foo:456, 363foo:457, 364foo:458, 365foo:459, 366foo:460, 367foo:461, 368foo:462, 369foo:463, 370foo:464, 371foo:465, 372foo:466, 373foo:467, 374foo:468, 375foo:469, 376foo:470, 377foo:471, 378foo:472, 379foo:473, 380foo:474, 381foo:475, 382foo:476, 383foo:477, 384foo:478, 385foo:479, 386foo:480, 387foo:481, 388foo:482, 389foo:483, 390foo:484, 391foo:485, 392foo:486, 393foo:487, 394foo:488, 395foo:489, 396foo:490, 397foo:491, 398foo:492, 399foo:493, 400foo:494, 401foo:495, 402foo:496, 403foo:497, 404foo:498, 405foo:499, 406foo:500, 407foo:501, 408foo:502, 409foo:503, 410foo:504, 411foo:505, 412foo:506, 413foo:507, 414foo:508, 415foo:509, 416foo:510, 417foo:511, 418foo:512, 419foo:513, 420foo:514, 421foo:515, 422foo:516, 423foo:517, 424foo:518, 425foo:519, 426foo:520, 427foo:521, 428foo:522, 429foo:523, 430foo:524, 431foo:525, 432foo:526, 433foo:527, 434foo:528, 435foo:529, 436foo:530, 437foo:531, 438foo:532, 439foo:533, 440foo:534, 441foo:535, 442foo:536, 443foo:537, 444foo:538, 445foo:539, 446foo:540, 447foo:541, 448foo:542, 449foo:543, 450foo:544, 451foo:545, 452foo:546, 453foo:547, 454foo:548, 455foo:549, 456foo:550, 457foo:551, 458foo:552, 459foo:553, 460foo:554, 461foo:555, 462foo:556, 463foo:557, 464foo:558, 465foo:559, 466foo:560, 467foo:561, 468foo:562, 469foo:563, 470foo:564, 471foo:565, 472foo:566, 473foo:567, 474foo:568, 475foo:569, 476foo:570, 477foo:571, 478foo:572, 479foo:573, 480foo:574, 481foo:575, 482foo:576, 483foo:577, 484foo:578, 485foo:579, 486foo:580, 487foo:581, 488foo:582, 489foo:583, 490foo:584, 491foo:585, 492foo:586, 493foo:587, 494foo:588, 495foo:589, 496foo:590, 497foo:591, 498foo:592, 499foo:593, 500foo:594, 501foo:595, 502foo:596, 503foo:597, 504foo:598, 505foo:599, 506foo:600, 507foo:601, 508foo:602, 509foo:603, 510foo:604, 511foo:605, 512foo:606, 513foo:607, 514foo:608, 515foo:609, 516foo:610, 517foo:611, 518foo:612, 519foo:613, 520foo:614, 521foo:615, 522foo:616, 523foo:617, 524foo:618, 525foo:619, 526foo:620, 527foo:621, 528foo:622, 529foo:623, 530foo:624, 531foo:625, 532foo:626, 533foo:627, 534foo:628, 535foo:629, 536foo:630, 537foo:631, 538foo:632, 539foo:633, 540foo:634, 541foo:635, 542foo:636, 543foo:637, 544foo:638, 545foo:639, 546foo:640, 547foo:641, 548foo:642, 549foo:643, 550foo:644, 551foo:645, 552foo:646, 553foo:647, 554foo:648, 555foo:649, 556foo:650, 557foo:651, 558foo:652, 559foo:653, 560foo:654, 561foo:655, 562foo:656, 563foo:657, 564foo:658, 565foo:659, 566foo:660, 567foo:661, 568foo:662, 569foo:663, 570foo:664, 571foo:665, 572foo:666, 573foo:667, 574foo:668, 575foo:669, 576foo:670, 577foo:671, 578foo:672, 579foo:673, 580foo:674, 581foo:675, 582foo:676, 583foo:677, 584foo:678, 585foo:679, 586foo:680, 587foo:681, 588foo:682, 589foo:683, 590foo:684, 591foo:685, 592foo:686, 593foo:687, 594foo:688, 595foo:689, 596foo:690, 597foo:691, 598foo:692, 599foo:693, 600foo:694, 601foo:695, 602foo:696, 603foo:697, 604foo:698, 605foo:699, 606foo:700, 607foo:701, 608foo:702, 609foo:703, 610foo:704, 611foo:705, 612foo:706, 613foo:707, 614foo:708, 615foo:709, 616foo:710, 617foo:711, 618foo:712, 619foo:713, 620foo:714, 621foo:715, 622foo:716, 623foo:717, 624foo:718, 625foo:719, 626foo:720, 627foo:721, 628foo:722, 629foo:723, 630foo:724, 631foo:725, 632foo:726, 633foo:727, 634foo:728, 635foo:729, 636foo:730, 637foo:731, 638foo:732, 639foo:733, 640foo:734, 641foo:735, 642foo:736, 643foo:737, 644foo:738, 645foo:739, 646foo:740, 647foo:741, 648foo:742, 649foo:743, 650foo:744, 651foo:745, 652foo:746, 653foo:747}, NonArray, Proto:0x71dc80a0, Has been dictionary, Leaf]
    %EU:Function                   = 0x71df91d0:[Function, {}, NonArray, Proto:0x71de00a0]
    %EV:Function                   = 0x71df92c0:[Function, {name:100, length:101}, NonArray, Proto:0x71de00a0]
    %Ea:Object                     = 0x71da1f40:[Object, {0foo:0, 1foo:1, 2foo:2, 3foo:3, 4foo:4, 5foo:5, 6foo:100, 7foo:101, 8foo:102, 9foo:103, 10foo:104, 11foo:105, 12foo:106, 13foo:107, 14foo:108, 15foo:109, 16foo:110, 17foo:111, 18foo:112, 19foo:113, 20foo:114, 21foo:115, 22foo:116, 23foo:117, 24foo:118, 25foo:119, 26foo:120, 27foo:121, 28foo:122, 29foo:123, 30foo:124, 31foo:125, 32foo:126, 33foo:127, 34foo:128, 35foo:129, 36foo:130, 37foo:131, 38foo:132, 39foo:133, 40foo:134, 41foo:135, 42foo:136, 43foo:137, 44foo:138, 45foo:139, 46foo:140, 47foo:141, 48foo:142, 49foo:143, 50foo:144, 51foo:145, 52foo:146, 53foo:147, 54foo:148, 55foo:149, 56foo:150, 57foo:151, 58foo:152, 59foo:153, 60foo:154, 61foo:155, 62foo:156, 63foo:157, 64foo:158, 65foo:159, 66foo:160, 67foo:161, 68foo:162, 69foo:163, 70foo:164, 71foo:165, 72foo:166, 73foo:167, 74foo:168, 75foo:169, 76foo:170, 77foo:171, 78foo:172, 79foo:173, 80foo:174, 81foo:175, 82foo:176, 83foo:177, 84foo:178, 85foo:179, 86foo:180, 87foo:181, 88foo:182, 89foo:183, 90foo:184, 91foo:185, 92foo:186, 93foo:187, 94foo:188, 95foo:189, 96foo:190, 97foo:191, 98foo:192, 99foo:193, 100foo:194, 101foo:195, 102foo:196, 103foo:197, 104foo:198, 105foo:199, 106foo:200, 107foo:201, 108foo:202, 109foo:203, 110foo:204, 111foo:205, 112foo:206, 113foo:207, 114foo:208, 115foo:209, 116foo:210, 117foo:211, 118foo:212, 119foo:213, 120foo:214, 121foo:215, 122foo:216, 123foo:217, 124foo:218, 125foo:219, 126foo:220, 127foo:221, 128foo:222, 129foo:223, 130foo:224, 131foo:225, 132foo:226, 133foo:227, 134foo:228, 135foo:229, 136foo:230, 137foo:231, 138foo:232, 139foo:233, 140foo:234, 141foo:235, 142foo:236, 143foo:237, 144foo:238, 145foo:239, 146foo:240, 147foo:241, 148foo:242, 149foo:243, 150foo:244, 151foo:245, 152foo:246, 153foo:247, 154foo:248, 155foo:249, 156foo:250, 157foo:251, 158foo:252, 159foo:253, 160foo:254, 161foo:255, 162foo:256, 163foo:257, 164foo:258, 165foo:259, 166foo:260, 167foo:261, 168foo:262, 169foo:263, 170foo:264, 171foo:265, 172foo:266, 173foo:267, 174foo:268, 175foo:269, 176foo:270, 177foo:271, 178foo:272, 179foo:273, 180foo:274, 181foo:275, 182foo:276, 183foo:277, 184foo:278, 185foo:279, 186foo:280, 187foo:281, 188foo:282, 189foo:283, 190foo:284, 191foo:285, 192foo:286, 193foo:287, 194foo:288, 195foo:289, 196foo:290, 197foo:291, 198foo:292, 199foo:293, 200foo:294, 201foo:295, 202foo:296, 203foo:297, 204foo:298, 205foo:299, 206foo:300, 207foo:301, 208foo:302, 209foo:303, 210foo:304, 211foo:305, 212foo:306, 213foo:307, 214foo:308, 215foo:309, 216foo:310, 217foo:311, 218foo:312, 219foo:313, 220foo:314, 221foo:315, 222foo:316, 223foo:317, 224foo:318, 225foo:319, 226foo:320, 227foo:321, 228foo:322, 229foo:323, 230foo:324, 231foo:325, 232foo:326, 233foo:327, 234foo:328, 235foo:329, 236foo:330, 237foo:331, 238foo:332, 239foo:333, 240foo:334, 241foo:335, 242foo:336, 243foo:337, 244foo:338, 245foo:339, 246foo:340, 247foo:341, 248foo:342, 249foo:343, 250foo:344, 251foo:345, 252foo:346, 253foo:347, 254foo:348, 255foo:349, 256foo:350, 257foo:351, 258foo:352, 259foo:353, 260foo:354, 261foo:355, 262foo:356, 263foo:357, 264foo:358, 265foo:359, 266foo:360, 267foo:361, 268foo:362, 269foo:363, 270foo:364, 271foo:365, 272foo:366, 273foo:367, 274foo:368, 275foo:369, 276foo:370, 277foo:371, 278foo:372, 279foo:373, 280foo:374, 281foo:375, 282foo:376, 283foo:377, 284foo:378, 285foo:379, 286foo:380, 287foo:381, 288foo:382, 289foo:383, 290foo:384, 291foo:385, 292foo:386, 293foo:387, 294foo:388, 295foo:389, 296foo:390, 297foo:391, 298foo:392, 299foo:393, 300foo:394, 301foo:395, 302foo:396, 303foo:397, 304foo:398, 305foo:399, 306foo:400, 307foo:401, 308foo:402, 309foo:403, 310foo:404, 311foo:405, 312foo:406, 313foo:407, 314foo:408, 315foo:409, 316foo:410, 317foo:411, 318foo:412, 319foo:413, 320foo:414, 321foo:415, 322foo:416, 323foo:417, 324foo:418, 325foo:419}, NonArray, Proto:0x71dc80a0, Has been dictionary, Leaf]


DFG ASSERTION FAILED: Edge verification error: @80->Check:String:@57 was expected to have type String but has type Top (14898167807)
../Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h(134) : void JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge(JSC::DFG::Node*, JSC::DFG::Edge) [with AbstractStateType = JSC::DFG::InPlaceAbstractState]
Bus error
#

[Yusuke Suzuki]

Could you dump the stack trace too?

[Yusuke Suzuki]

I think we should have speculation check on x86 generic version of HasOwnProperty DFG node.

[Yusuke Suzuki]

(In reply to Yusuke Suzuki from comment #4)
> Could you dump the stack trace too?

I would like to see the bt of this. I guess this AI is used from DFGSpeculativeJIT code emitting phase.

[Guillaume Emont]

(In reply to Yusuke Suzuki from comment #6)
> (In reply to Yusuke Suzuki from comment #4)
> > Could you dump the stack trace too?
> 
> I would like to see the bt of this. I guess this AI is used from
> DFGSpeculativeJIT code emitting phase.

Here you go (again, this is running on MIPS, I don't know if the issue reproduces on X86, I haven't tried):

Program received signal SIGBUS, Bus error.
0x00e65628 in WTFCrash () at ../Source/WTF/wtf/Assertions.cpp:323
323         *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt
#0  0x00e65628 in WTFCrash () at ../Source/WTF/wtf/Assertions.cpp:323
#1  0x00e65658 in WTFCrashWithSecurityImplication () at ../Source/WTF/wtf/Assertions.cpp:343
#2  0x00d3b898 in JSC::DFG::crash (graph=..., whileText=..., file=0xf19604 "../Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h", line=134, function=0xf1a0f0 <JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::verifyEdge(JSC::DFG::Node*, JSC::DFG::Edge)::__PRETTY_FUNCTION__> "void JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge(JSC::DFG::Node*, JSC::DFG::Edge) [with AbstractStateType = JSC::DFG::InPlaceAbstractState]", assertion=0x755a9260 "Edge verification error: @80->Check:String:@57 was expected to have type String but has type Top (14898167807)") at ../Source/JavaScriptCore/dfg/DFGGraph.cpp:1510
#3  0x00d3c9c4 in JSC::DFG::Graph::handleAssertionFailure (this=0x7fff5de8, node=0x71801e60, file=<optimized out>, line=<optimized out>, function=0xf1a0f0 <JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::verifyEdge(JSC::DFG::Node*, JSC::DFG::Edge)::__PRETTY_FUNCTION__> "void JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge(JSC::DFG::Node*, JSC::DFG::Edge) [with AbstractStateType = JSC::DFG::InPlaceAbstractState]", assertion=0x755a9260 "Edge verification error: @80->Check:String:@57 was expected to have type String but has type Top (14898167807)") at ../Source/JavaScriptCore/dfg/DFGGraph.cpp:1522
#4  0x00b8f33c in JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::verifyEdge (this=<optimized out>, node=0x71801e60, edge=...) at ../Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:134
#5  0x00b8f45c in JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::verifyEdges (this=0x6287f9f0, node=0x71801e60) at ../Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:140
#6  0x00b8f4e8 in JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::executeEffects (this=0x6287f9f0, clobberLimit=21, node=0x71801e60) at ../Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:176
#7  0x00de357c in JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::executeEffects (indexInBlock=<optimized out>, this=0x6287f9f0) at ../Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:3028
#8  JSC::DFG::SpeculativeJIT::compileCurrentBlock (this=0x6287f200) at ../Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:1767
#9  0x00de38f8 in JSC::DFG::SpeculativeJIT::compile (this=0x6287f200) at ../Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:1857
#10 0x00d57d3c in JSC::DFG::JITCompiler::compileFunction (this=0x7fff58c8) at ../Source/JavaScriptCore/dfg/DFGJITCompiler.cpp:438
#11 0x00b7a8f4 in JSC::DFG::Plan::compileInThreadImpl (this=0x75581000, longLivedState=...) at ../Source/JavaScriptCore/dfg/DFGPlan.cpp:392
#12 0x00b7b2b8 in JSC::DFG::Plan::compileInThread (this=0x75581000, longLivedState=..., threadData=<optimized out>) at ../Source/JavaScriptCore/dfg/DFGPlan.cpp:188
#13 0x00b75ba4 in JSC::DFG::compileImpl (callback=<optimized out>, mustHandleValues=..., osrEntryBytecodeIndex=65, mode=JSC::DFG::DFGMode, profiledDFGCodeBlock=0x0, codeBlock=0x725834e0, vm=...) at ../Source/JavaScriptCore/dfg/DFGDriver.cpp:111
#14 JSC::DFG::compile(JSC::VM&, JSC::CodeBlock*, JSC::CodeBlock*, JSC::DFG::CompilationMode, unsigned int, JSC::Operands<JSC::JSValue> const&, WTF::Ref<JSC::DeferredCompilationCallback>&&) (vm=..., codeBlock=0x725834e0, profiledDFGCodeBlock=0x0, mode=JSC::DFG::DFGMode, osrEntryBytecodeIndex=65, mustHandleValues=..., callback=<unknown type in /home/guijemont/dev/metrological/buildroot-wpe/output.dawn.hardfp/host/usr/mipsel-buildroot-linux-gnu/sysroot/usr/bin/jsc, CU 0x1914f218, DIE 0x192a3dd6>) at ../Source/JavaScriptCore/dfg/DFGDriver.cpp:130
#15 0x00704998 in JSC::operationOptimize (exec=0x7fff64e8, bytecodeIndex=65) at ../Source/JavaScriptCore/jit/JITOperations.cpp:1453
warning: GDB can't find the start of the function at 0x7341b247.

    GDB is unable to find the start of the function at 0x7341b247
and thus can't determine the size of that function's stack frame.
This means that GDB may be unable to access that stack frame, or
the frames below it.
    This problem is most likely caused by an invalid program counter or
stack pointer.
    However, if you think GDB should simply search farther back
from 0x7341b247 for code which looks like the beginning of a
function, you can increase the range of the search using the `set
heuristic-fence-post' command.
#16 0x7341b248 in ?? ()
(gdb)

[Yusuke Suzuki]

OK, I found the reason. This is not JSC bug.
You should enable DFGFixupPhase's x86 ifdef of HasOwnProperty for MIPS too.

[Guillaume Emont]

Created attachment 306343 [details]
Patch

Patch that uses the X86 version of HasOwnProperty for MIPS, this time also doing in in DFGFixupPhase.

[Yusuke Suzuki]

Comment on attachment 306343 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=306343&action=review

r=me with comment

> Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:1385
> +#if CPU(X86) && USE(JSVALUE32_64) || CPU(MIPS)

`#if (CPU(X86) || CPU(MIPS)) && USE(JSVALUE32_64)` is better.

[Guillaume Emont]

Created attachment 306385 [details]
Patch

Patch with comment addressed. Thank you for your patience.

[Yusuke Suzuki]

Comment on attachment 306385 [details]
Patch

r=me

[WebKit Commit Bot]

Comment on attachment 306385 [details]
Patch

Clearing flags on attachment: 306385

Committed r215038: <http://trac.webkit.org/changeset/215038>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.