Debug build JSC tests are failing: ** The following JSC stress test failures have been introduced: microbenchmarks/deltablue-varargs.js.ftl-eager microbenchmarks/deltablue-varargs.js.ftl-eager-no-cjit microbenchmarks/deltablue-varargs.js.ftl-eager-no-cjit-b3o1 The commit range that introduced this failure is: 219725:219732. The likely culprit (given the assertion failure) is https://trac.webkit.org/r219727.
I'm looking it now.
OK, I've reproduced it with ftl-eager-no-cjit configuration. Cool, it's no CJIT :D
In this arguments elimination phase, due to high cost of AI, we intentionally do not run AI. Instead, we use ForceOSRExit etc. (pseudo terminals) not to look into unreachable nodes. The problem is that even transforming phase also checks this pseudo terminals. BB1 1: ForceOSRExit 2: CreateDirectArguments BB2 3: GetButterfly(@2) 4: ForceOSRExit In the above case, @2 is not converted to PhantomDirectArguments. But @3 is processed. And the assertion fires.
(In reply to Yusuke Suzuki from comment #3) > In this arguments elimination phase, due to high cost of AI, we > intentionally do not run AI. > Instead, we use ForceOSRExit etc. (pseudo terminals) not to look into > unreachable nodes. > The problem is that even transforming phase also checks this pseudo > terminals. > > > BB1 > 1: ForceOSRExit > 2: CreateDirectArguments > > BB2 > 3: GetButterfly(@2) > 4: ForceOSRExit > > In the above case, @2 is not converted to PhantomDirectArguments. > But @3 is processed. And the assertion fires. I think the reasonable fix is not listing candidates after pseudo exits.
(In reply to Yusuke Suzuki from comment #4) > (In reply to Yusuke Suzuki from comment #3) > > In this arguments elimination phase, due to high cost of AI, we > > intentionally do not run AI. > > Instead, we use ForceOSRExit etc. (pseudo terminals) not to look into > > unreachable nodes. > > The problem is that even transforming phase also checks this pseudo > > terminals. > > > > > > BB1 > > 1: ForceOSRExit > > 2: CreateDirectArguments > > > > BB2 > > 3: GetButterfly(@2) > > 4: ForceOSRExit > > > > In the above case, @2 is not converted to PhantomDirectArguments. > > But @3 is processed. And the assertion fires. > > I think the reasonable fix is not listing candidates after pseudo exits. Sounds reasonable to me.
Created attachment 316556 [details] Patch
Comment on attachment 316556 [details] Patch Clearing flags on attachment: 316556 Committed r219997: <http://trac.webkit.org/changeset/219997>
All reviewed patches have been landed. Closing bug.
<rdar://problem/33601432>