Bug 174900 – ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Mark Lam]

Debug build JSC tests are failing:
** The following JSC stress test failures have been introduced:
	microbenchmarks/deltablue-varargs.js.ftl-eager
	microbenchmarks/deltablue-varargs.js.ftl-eager-no-cjit
	microbenchmarks/deltablue-varargs.js.ftl-eager-no-cjit-b3o1

The commit range that introduced this failure is: 219725:219732.
The likely culprit (given the assertion failure) is https://trac.webkit.org/r219727.

[Yusuke Suzuki]

I'm looking it now.

[Yusuke Suzuki]

OK, I've reproduced it with ftl-eager-no-cjit configuration. Cool, it's no CJIT :D

[Yusuke Suzuki]

In this arguments elimination phase, due to high cost of AI, we intentionally do not run AI.
Instead, we use ForceOSRExit etc. (pseudo terminals) not to look into unreachable nodes.
The problem is that even transforming phase also checks this pseudo terminals.


BB1
1: ForceOSRExit
2: CreateDirectArguments

BB2
3: GetButterfly(@2)
4: ForceOSRExit

In the above case, @2 is not converted to PhantomDirectArguments.
But @3 is processed. And the assertion fires.

[Yusuke Suzuki]

(In reply to Yusuke Suzuki from comment #3)
> In this arguments elimination phase, due to high cost of AI, we
> intentionally do not run AI.
> Instead, we use ForceOSRExit etc. (pseudo terminals) not to look into
> unreachable nodes.
> The problem is that even transforming phase also checks this pseudo
> terminals.
> 
> 
> BB1
> 1: ForceOSRExit
> 2: CreateDirectArguments
> 
> BB2
> 3: GetButterfly(@2)
> 4: ForceOSRExit
> 
> In the above case, @2 is not converted to PhantomDirectArguments.
> But @3 is processed. And the assertion fires.

I think the reasonable fix is not listing candidates after pseudo exits.

[Saam Barati]

(In reply to Yusuke Suzuki from comment #4)
> (In reply to Yusuke Suzuki from comment #3)
> > In this arguments elimination phase, due to high cost of AI, we
> > intentionally do not run AI.
> > Instead, we use ForceOSRExit etc. (pseudo terminals) not to look into
> > unreachable nodes.
> > The problem is that even transforming phase also checks this pseudo
> > terminals.
> > 
> > 
> > BB1
> > 1: ForceOSRExit
> > 2: CreateDirectArguments
> > 
> > BB2
> > 3: GetButterfly(@2)
> > 4: ForceOSRExit
> > 
> > In the above case, @2 is not converted to PhantomDirectArguments.
> > But @3 is processed. And the assertion fires.
> 
> I think the reasonable fix is not listing candidates after pseudo exits.

Sounds reasonable to me.

[Yusuke Suzuki]

Created attachment 316556 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 316556 [details]
Patch

Clearing flags on attachment: 316556

Committed r219997: <http://trac.webkit.org/changeset/219997>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/33601432>