Bug 224354 - DFG ASSERTION FAILED
Summary: DFG ASSERTION FAILED
Status: RESOLVED DUPLICATE of bug 221353
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Local Build
Hardware: PC Linux
: P2 Critical
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2021-04-08 19:04 PDT by rain
Modified: 2021-04-10 01:13 PDT (History)
5 users (show)

See Also:


Attachments
poc (72.10 KB, text/x-matlab)
2021-04-08 19:04 PDT, rain
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description rain 2021-04-08 19:04:43 PDT
Created attachment 425569 [details]
poc

# crash output

DFG ASSERTION FAILED: Live bytecode local not available: operand = this, availabilityMap = {locals = arg2:FlushedJSValue/Unavailable arg1:FlushedJSValue/Unavailable loc4:ConflictingFlush/D@65 loc6:ConflictingFlush/D@71 loc10:ConflictingFlush/D@195<Double>; heap = }, origin = bc#271
../../Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp(174) : bool JSC::DFG::OSRAvailabilityAnalysisPhase<(lambda at ../../Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp:193:31), (lambda at ../../Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp:194:31)>::run() [HeadFunctor = (lambda at ../../Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp:193:31), TailFunctor = (lambda at ../../Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp:194:31)]

While handling node D@131

Graph at time of failure:

       37: DFG for V15#<no-hash>:[0x7efd0e1c45f0->0x7efd0e1c4260->0x7efd0e1e5280, DFGFunctionConstruct, 389 (DidTryToEnterInLoop) (StrictMode)]:
       37:   Fixpoint state: FixpointNotConverged; Form: SSA; Unification state: GloballyUnified; Ref count state: EverythingIsLive
       37:   Argument formats for entrypoint index: 0 : FlushedJSValue, FlushedJSValue, FlushedJSValue
       37:   Argument formats for entrypoint index: 1 : FlushedJSValue, FlushedJSValue, FlushedJSValue

     0 37: Block #0 (bc#0):
     0 37:   Execution count: 1.000000
     0 37:   Predecessors:
     0 37:   Successors: #1 #10
     0 37:   Dominated by: #0
     0 37:   Dominates: #0 #1 #2 #3 #4 #5 #6 #7 #9 #10
     0 37:   Dominance Frontier: 
     0 37:   Iterated Dominance Frontier: 
     0 37:   States: StructuresAreWatched
     0 37:   Live: 
     0 37:   Values: 
  0  0 37:   D@46:< 7:->	JSConstant(JS|UseAsOther, Empty, <JSValue()>, bc#0, ExitInvalid)
  1  0 37:   D@23:< 3:->	JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x7efd0e1bc060 with butterfly (nil) (Structure %BW:JSLexicalEnvironment), StructureID: 31388, bc#0, ExitInvalid)
  2  0 37:    D@3:< 10:->	JSConstant(JS|PureInt, Other, Undefined, bc#0, ExitInvalid)
  3  0 37:  D@185:< 0:->	JSConstant(JS|PureNum|UseAsOther, NonBoolInt32, Int32: 100, bc#0, ExitInvalid)
  4  0 37:  D@193:< 1:->	JSConstant(JS|PureInt, StringIdent, Strong:String (atomic),8Bit:(1),length:(76): 
                const v39 = v38.concat();
                v39;
            , StructureID: 15293, bc#0, ExitInvalid)
  5  0 37:  D@207:< 1:->	JSConstant(JS|UseAsOther, BoolInt32, Int32: 0, bc#0, ExitInvalid)
  6  0 37:   D@22:< 1:->	JSConstant(JS|PureInt, Function, Weak:Object: 0x7efd0e1f6080 with butterfly 0x7ee0163fe168 (Structure %EN:Function), StructureID: 59661, bc#0, ExitInvalid)
  7  0 37:  D@212:< 1:->	JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x7efd0e7fa068 with butterfly 0x7ee0163e4408 (Structure %B6:global), StructureID: 53674, bc#0, ExitInvalid)
  8  0 37:  D@198:< 1:->	JSConstant(JS|UseAsOther, BoolInt32, Int32: 1, bc#0, ExitInvalid)
  9  0 37:   D@63:< 2:->	JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x7efd0e1d4240 with butterfly 0x7ee0163fe148 (Structure %Em:Function), StructureID: 58385, bc#0, ExitInvalid)
 10  0 37:  D@219:< 2:->	JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x7efd0e1d4000 with butterfly 0x7ee0163fce68 (Structure %Ak:Function), StructureID: 45983, bc#0, ExitInvalid)
 11  0 37:  D@162:< 0:->	JSConstant(Boolean|UseAsOther, Bool, True, bc#0, ExitInvalid)
 12  0 37:   D@34:< 2:->	DoubleConstant(Double|PureInt, BytecodeDouble, Double: 4636737291354636288, 100.000000, bc#0, ExitInvalid)
 13  0 37:   D@33:< 2:->	DoubleConstant(Double|PureInt, BytecodeDouble, Double: 4607182418800017408, 1.000000, bc#0, ExitInvalid)
 14  0 37:  D@209:<!0:->	EntrySwitch(MustGen, #1, #10, W:SideState, bc#0, ExitInvalid)
     0 37:   States: InvalidBranchDirection, StructuresAreWatched
     0 37:   Live: D@3, D@22, D@23, D@33<Double>, D@34<Double>, D@46, D@63, D@193, D@198, D@207, D@212, D@219
     0 37:   Values: 

     1 37: Block #1 (bc#0): (OSR target)
     1 37:   Execution count: 1.000000
     1 37:   Predecessors: #0
     1 37:   Successors:
     1 37:   Dominated by: #0 #1
     1 37:   Dominates: #1
     1 37:   Dominance Frontier: 
     1 37:   Iterated Dominance Frontier: 
     1 37:   States: StructuresAreWatched
     1 37:   Live: D@3, D@22, D@23, D@46, D@63
     1 37:   Values: 
  0  1 37:   D@83:<!0:->	ExitOK(MustGen, W:SideState, bc#0, ExitValid)
  1  1 37:  D@218:<!0:->	InitializeEntrypointArguments(MustGen, W:SideState, ClobbersExit, bc#0, ExitValid)
  2  1 37:  D@217:<!0:->	ExitOK(MustGen, W:SideState, bc#0, ExitValid)
  3  1 37:   D@97:< 4:->	GetStack(JS|PureInt, this, FlushedJSValue, R:Stack(this), bc#0, ExitValid)
  4  1 37:  D@200:< 2:->	GetStack(JS|PureInt, Other, arg1, FlushedJSValue, R:Stack(arg1), bc#0, ExitValid)
  5  1 37:   D@98:< 5:->	GetStack(JS|PureInt, Other, arg2, FlushedJSValue, R:Stack(arg2), bc#0, ExitValid)
  6  1 37:   D@82:<!0:->	KillStack(MustGen, loc0, W:Stack(loc0), ClobbersExit, bc#0, ExitValid)
  7  1 37:    D@4:<!0:->	MovHint(Check:Untyped:D@3, MustGen, loc0, W:SideState, ClobbersExit, bc#0, ExitInvalid)
  8  1 37:   D@81:<!0:->	KillStack(MustGen, loc1, W:Stack(loc1), ClobbersExit, bc#0, ExitInvalid)
  9  1 37:    D@6:<!0:->	MovHint(Check:Untyped:D@3, MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 10  1 37:   D@80:<!0:->	KillStack(MustGen, loc2, W:Stack(loc2), ClobbersExit, bc#0, ExitInvalid)
 11  1 37:    D@8:<!0:->	MovHint(Check:Untyped:D@3, MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 12  1 37:   D@79:<!0:->	KillStack(MustGen, loc3, W:Stack(loc3), ClobbersExit, bc#0, ExitInvalid)
 13  1 37:   D@10:<!0:->	MovHint(Check:Untyped:D@3, MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 14  1 37:   D@15:<!0:->	KillStack(MustGen, loc4, W:Stack(loc4), ClobbersExit, bc#0, ExitInvalid)
 15  1 37:   D@12:<!0:->	MovHint(Check:Untyped:D@3, MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 16  1 37:   D@17:<!0:->	KillStack(MustGen, loc5, W:Stack(loc5), ClobbersExit, bc#0, ExitInvalid)
 17  1 37:   D@14:<!0:->	MovHint(Check:Untyped:D@3, MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 18  1 37:   D@19:<!0:->	KillStack(MustGen, loc6, W:Stack(loc6), ClobbersExit, bc#0, ExitInvalid)
 19  1 37:   D@16:<!0:->	MovHint(Check:Untyped:D@3, MustGen, loc6, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 20  1 37:   D@21:<!0:->	KillStack(MustGen, loc7, W:Stack(loc7), ClobbersExit, bc#0, ExitInvalid)
 21  1 37:   D@18:<!0:->	MovHint(Check:Untyped:D@3, MustGen, loc7, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 22  1 37:   D@25:<!0:->	KillStack(MustGen, loc8, W:Stack(loc8), ClobbersExit, bc#0, ExitInvalid)
 23  1 37:   D@20:<!0:->	MovHint(Check:Untyped:Kill:D@3, MustGen, loc8, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 24  1 37:   D@77:<!0:->	KillStack(MustGen, loc4, W:Stack(loc4), ClobbersExit, bc#1, ExitValid)
 25  1 37:   D@24:<!0:->	MovHint(Check:Untyped:D@23, MustGen, loc4, W:SideState, ClobbersExit, bc#1, ExitInvalid)
 26  1 37:   D@67:<!0:->	KillStack(MustGen, loc5, W:Stack(loc5), ClobbersExit, bc#3, ExitValid)
 27  1 37:   D@26:<!0:->	MovHint(Check:Untyped:D@23, MustGen, loc5, W:SideState, ClobbersExit, bc#3, ExitInvalid)
 28  1 37:   D@28:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#6, ExitValid)
 29  1 37:   D@29:< 9:->	CreateActivation(KnownCell:Kill:D@23, JS|UseAsOther, OtherObj, <0x7efd0e1c02d0, SymbolTable>, R:HeapObjectCount, W:HeapObjectCount,Watchpoint_fire, ExitsForExceptions, ClobbersExit, bc#7, ExitValid)
 30  1 37:   D@66:<!0:->	KillStack(MustGen, loc6, W:Stack(loc6), ClobbersExit, bc#7, ExitInvalid)
 31  1 37:   D@30:<!0:->	MovHint(Check:Untyped:D@29, MustGen, loc6, W:SideState, ClobbersExit, bc#7, ExitInvalid)
 32  1 37:  D@160:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#7, exit: bc#12, ExitValid)
 33  1 37:  D@178:<!0:->	KillStack(MustGen, loc4, W:Stack(loc4), ClobbersExit, bc#12, ExitValid)
 34  1 37:   D@32:<!0:->	MovHint(Check:Untyped:D@29, MustGen, loc4, W:SideState, ClobbersExit, bc#12, ExitInvalid)
 35  1 37:  D@103:<!0:->	Check(Check:Other:D@200, MustGen, Exits, bc#15, ExitValid)
 36  1 37:   D@35:<!0:->	PutClosureVar(KnownCell:D@29, Check:Untyped:Kill:D@200, MustGen, scope0, W:ScopeProperties(0), ClobbersExit, bc#15, ExitValid)
 37  1 37:   D@36:<!0:->	NotifyWrite(MustGen, 0x7efd4eba8c80, W:Watchpoint_fire,SideState, ClobbersExit, bc#15, ExitInvalid)
 38  1 37:  D@165:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#23, ExitValid)
 39  1 37:  D@102:<!0:->	Check(Check:Other:D@98, MustGen, Exits, bc#23, ExitValid)
 40  1 37:   D@38:<!0:->	PutClosureVar(KnownCell:D@29, Check:Untyped:D@98, MustGen, scope1, W:ScopeProperties(1), ClobbersExit, bc#23, ExitValid)
 41  1 37:   D@39:<!0:->	NotifyWrite(MustGen, 0x7efd4eba8ca0, W:Watchpoint_fire,SideState, ClobbersExit, bc#23, ExitInvalid)
 42  1 37:  D@171:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#31, ExitValid)
 43  1 37:   D@40:< 2:->	CreateClonedArguments(JS|UseAsOther, OtherObj, R:Stack,HeapObjectCount, W:HeapObjectCount, Exits, ClobbersExit, bc#31, ExitValid)
 44  1 37:   D@62:<!0:->	KillStack(MustGen, loc7, W:Stack(loc7), ClobbersExit, bc#31, ExitInvalid)
 45  1 37:   D@41:<!0:->	MovHint(Check:Untyped:D@40, MustGen, loc7, W:SideState, ClobbersExit, bc#31, ExitInvalid)
 46  1 37:   D@52:<!0:->	KillStack(MustGen, loc8, W:Stack(loc8), ClobbersExit, bc#33, ExitValid)
 47  1 37:   D@44:<!0:->	MovHint(Check:Untyped:D@97, MustGen, loc8, W:SideState, ClobbersExit, bc#33, ExitInvalid)
 48  1 37:  D@123:<!0:->	KillStack(MustGen, this, W:Stack(this), ClobbersExit, bc#36, ExitValid)
 49  1 37:   D@47:<!0:->	MovHint(Check:Untyped:D@46, MustGen, this, W:SideState, ClobbersExit, bc#36, ExitInvalid)
 50  1 37:   D@49:<!0:->	PutClosureVar(KnownCell:D@29, Check:Untyped:Kill:D@46, MustGen, scope3, W:ScopeProperties(3), ClobbersExit, bc#39, ExitValid)
 51  1 37:   D@50:<!0:->	PutClosureVar(KnownCell:D@29, Check:Untyped:D@97, MustGen, scope4, W:ScopeProperties(4), ClobbersExit, bc#47, ExitValid)
 52  1 37:   D@51:<!0:->	NotifyWrite(MustGen, 0x7efd4eba8ce0, W:Watchpoint_fire,SideState, ClobbersExit, bc#47, ExitInvalid)
 53  1 37:  D@230:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#55, ExitValid)
 54  1 37:   D@53:<!0:->	PutClosureVar(KnownCell:D@29, Check:Untyped:Kill:D@22, MustGen, scope5, W:ScopeProperties(5), ClobbersExit, bc#55, ExitValid)
 55  1 37:   D@54:<!0:->	NotifyWrite(MustGen, 0x7efd4eba8d00, W:Watchpoint_fire,SideState, ClobbersExit, bc#55, ExitInvalid)
 56  1 37:  D@224:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#63, ExitValid)
 57  1 37:   D@55:< 2:->	CreateActivation(KnownCell:D@29, JS|PureInt, OtherObj, <0x7efd0e1c0320, SymbolTable>, R:HeapObjectCount, W:HeapObjectCount,Watchpoint_fire, ExitsForExceptions, ClobbersExit, bc#63, ExitValid)
 58  1 37:  D@122:<!0:->	KillStack(MustGen, loc9, W:Stack(loc9), ClobbersExit, bc#63, ExitInvalid)
 59  1 37:   D@56:<!0:->	MovHint(Check:Untyped:D@55, MustGen, loc9, W:SideState, ClobbersExit, bc#63, ExitInvalid)
 60  1 37:  D@220:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#63, exit: bc#68, ExitValid)
 61  1 37:  D@120:<!0:->	KillStack(MustGen, loc4, W:Stack(loc4), ClobbersExit, bc#68, ExitValid)
 62  1 37:   D@58:<!0:->	MovHint(Check:Untyped:Kill:D@55, MustGen, loc4, W:SideState, ClobbersExit, bc#68, ExitInvalid)
 63  1 37:   D@60:<!0:->	PutClosureVar(KnownCell:Kill:D@29, Check:Untyped:Kill:D@40, MustGen, scope2, W:ScopeProperties(2), ClobbersExit, bc#71, ExitValid)
 64  1 37:   D@61:<!0:->	NotifyWrite(MustGen, 0x7efd4eba8d20, W:Watchpoint_fire,SideState, ClobbersExit, bc#71, ExitInvalid)
 65  1 37:  D@183:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#79, ExitValid)
 66  1 37:  D@114:<!0:->	KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#79, ExitInvalid)
 67  1 37:   D@64:<!0:->	MovHint(Check:Untyped:D@63, MustGen, loc10, W:SideState, ClobbersExit, bc#79, ExitInvalid)
 68  1 37:  D@109:<!0:->	KillStack(MustGen, loc15, W:Stack(loc15), ClobbersExit, bc#83, ExitValid)
 69  1 37:   D@68:<!0:->	MovHint(Check:Untyped:D@98, MustGen, loc15, W:SideState, ClobbersExit, bc#83, ExitInvalid)
 70  1 37:  D@104:<!0:->	KillStack(MustGen, loc13, W:Stack(loc13), ClobbersExit, bc#91, ExitValid)
 71  1 37:   D@70:<!0:->	MovHint(Check:Untyped:D@98, MustGen, loc13, W:SideState, ClobbersExit, bc#91, ExitInvalid)
 72  1 37:  D@125:<!0:->	KillStack(MustGen, loc14, W:Stack(loc14), ClobbersExit, bc#94, ExitValid)
 73  1 37:   D@72:<!0:->	MovHint(Check:Untyped:D@97, MustGen, loc14, W:SideState, ClobbersExit, bc#94, ExitInvalid)
 74  1 37:   D@74:<!1:->	Construct(Check:Untyped:Kill:D@63, Check:Untyped:Kill:D@97, Check:Untyped:Kill:D@98, JS|MustGen|VarArgs|PureInt, Uint16Array, R:World, W:Heap, ExitsForExceptions, ClobbersExit, bc#97, ExitValid)  predicting Uint16Array
 75  1 37:  D@124:<!0:->	KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#97, ExitInvalid)
 76  1 37:   D@75:<!0:->	MovHint(Check:Untyped:Kill:D@74, MustGen, loc10, W:SideState, ClobbersExit, bc#97, ExitInvalid)
 77  1 37:  D@158:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#97, exit: bc#103, ExitValid)
 78  1 37:   D@78:<!0:->	ForceOSRExit(MustGen, W:SideState, Exits, bc#103, ExitValid)
 79  1 37:    D@0:<!0:->	Unreachable(MustGen, W:SideState, bc#103, ExitValid)
     1 37:   States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated
     1 37:   Live: 
     1 37:   Values: 

     2 37: Block #2 (bc#271):
     2 37:   Execution count: 10.000000
     2 37:   Predecessors: #4
     2 37:   Successors: #4
     2 37:   Dominated by: #0 #2 #3 #4 #10
     2 37:   Dominates: #2
     2 37:   Dominance Frontier: #4
     2 37:   Iterated Dominance Frontier: #4 #7
     2 37:   States: StructuresAreWatched
     2 37:   Live: D@33<Double>, D@34<Double>, D@46, D@71, D@189<Double>, D@193, D@198, D@207, D@212, D@219
     2 37:   Values: 
  0  2 37:  D@108:<!0:->	ExitOK(MustGen, W:SideState, bc#271, ExitValid)
  1  2 37:  D@107:< 1:->	Upsilon(DoubleRep:Kill:D@189<Double>, ^195, W:SideState, bc#271, ExitValid)
  2  2 37:  D@173:<!0:->	Jump(MustGen, T:#4, W:SideState, bc#271, ExitValid)
     2 37:   States: InvalidBranchDirection, StructuresAreWatched
     2 37:   Live: D@33<Double>, D@34<Double>, D@46, D@71, D@193, shadow(D@195<Double>), D@198, D@207, D@212, D@219
     2 37:   Values: 

     3 37: Block #3 (bc#271):
     3 37:   Execution count: 10.000000
     3 37:   Predecessors: #10
     3 37:   Successors: #4
     3 37:   Dominated by: #0 #3 #10
     3 37:   Dominates: #2 #3 #4 #5
     3 37:   Dominance Frontier: #7
     3 37:   Iterated Dominance Frontier: #7
     3 37:   States: StructuresAreWatched
     3 37:   Live: D@33<Double>, D@34<Double>, D@46, D@71, D@86<Double>, D@193, D@198, D@207, D@212, D@219
     3 37:   Values: 
  0  3 37:  D@144:<!0:->	ExitOK(MustGen, W:SideState, bc#271, ExitValid)
  1  3 37:  D@145:< 1:->	Upsilon(DoubleRep:Kill:D@86<Double>, ^195, W:SideState, bc#271, ExitValid)
  2  3 37:  D@169:<!0:->	Jump(MustGen, T:#4, W:SideState, bc#271, ExitValid)
     3 37:   States: InvalidBranchDirection, StructuresAreWatched
     3 37:   Live: D@33<Double>, D@34<Double>, D@46, D@71, D@193, shadow(D@195<Double>), D@198, D@207, D@212, D@219
     3 37:   Values: 

     4 37: Block #4 (bc#271): (OSR target)
     4 37:   Execution count: 10.000000
     4 37:   Predecessors: #3 #2
     4 37:   Successors: #2 #5
     4 37:   Dominated by: #0 #3 #4 #10
     4 37:   Dominates: #2 #4 #5
     4 37:   Dominance Frontier: #4 #7
     4 37:   Iterated Dominance Frontier: #4 #7
     4 37:   States: StructuresAreWatched
     4 37:   Live: D@33<Double>, D@34<Double>, D@46, D@71, D@193, shadow(D@195<Double>), D@198, D@207, D@212, D@219
     4 37:   Values: 
  0  4 37:  D@195:< 3:->	Phi(Double|PureInt, AnyIntAsDouble|NonIntAsDouble, W:SideState, bc#271, ExitInvalid)
  1  4 37:  D@132:<!0:->	MovHint(DoubleRep:D@195<Double>, MustGen, loc10, W:SideState, ClobbersExit, bc#271, ExitInvalid)
  2  4 37:  D@131:<!0:->	ExitOK(MustGen, W:SideState, bc#271, ExitValid)
  3  4 37:  D@181:<!0:->	LoopHint(MustGen, W:SideState, bc#271, ExitValid)
  4  4 37:  D@182:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#272, ExitValid)
  5  4 37:  D@130:<!0:->	KillStack(MustGen, loc11, W:Stack(loc11), ClobbersExit, bc#273, ExitValid)
  6  4 37:  D@184:<!0:->	MovHint(Check:Untyped:D@46, MustGen, loc11, W:SideState, ClobbersExit, bc#273, ExitInvalid)
  7  4 37:  D@129:<!0:->	KillStack(MustGen, loc12, W:Stack(loc12), ClobbersExit, bc#276, ExitValid)
  8  4 37:  D@186:<!0:->	MovHint(Check:Untyped:D@46, MustGen, loc12, W:SideState, ClobbersExit, bc#276, ExitInvalid)
  9  4 37:  D@127:<!0:->	KillStack(MustGen, loc13, W:Stack(loc13), ClobbersExit, bc#279, ExitValid)
 10  4 37:  D@188:<!0:->	MovHint(Check:Untyped:D@46, MustGen, loc13, W:SideState, ClobbersExit, bc#279, ExitInvalid)
 11  4 37:  D@190:< 23:->	NewObject(JS|UseAsOther, Final, %D0:Object, R:HeapObjectCount, W:HeapObjectCount, Exits, bc#282, ExitValid)
 12  4 37:  D@126:<!0:->	KillStack(MustGen, loc14, W:Stack(loc14), ClobbersExit, bc#282, ExitValid)
 13  4 37:  D@191:<!0:->	MovHint(Check:Untyped:D@190, MustGen, loc14, W:SideState, ClobbersExit, bc#282, ExitInvalid)
 14  4 37:  D@194:<!0:->	FilterPutByIdStatus(Check:Untyped:D@190, MustGen, (<Transition: [0x7efd0e1f9810:[0x7826, Object, {}, NonArray, Proto:0x7efd4ebbd368]] to 0x7efd0e1cd0a0:[0xf19d, Object, {a:0}, NonArray, Proto:0x7efd4ebbd368], [[]], offset = 0, >), W:SideState, bc#286, ExitValid)
 15  4 37:   D@27:< 2:->	ValueRep(DoubleRep:D@195<Double>, JS|PureInt, BytecodeDouble, bc#286, ExitValid)
 16  4 37:  D@196:<!0:->	PutByOffset(KnownCell:D@190, KnownCell:D@190, Check:Untyped:D@27, MustGen, id12{a}, 0, W:NamedProperties(12), ClobbersExit, bc#286, ExitValid)
 17  4 37:  D@197:<!0:->	PutStructure(KnownCell:D@190, MustGen, %D0:Object -> %Ap:Object, ID:61853, R:JSObject_butterfly, W:JSCell_indexingType,JSCell_structureID,JSCell_typeInfoFlags, ClobbersExit, bc#286, ExitInvalid)
 18  4 37:  D@199:<!0:->	FilterPutByIdStatus(Check:Untyped:D@190, MustGen, (<Transition: [0x7efd0e1cd0a0:[0xf19d, Object, {a:0}, NonArray, Proto:0x7efd4ebbd368]] to 0x7efd0e1cd110:[0xf20f, Object, {d:1, a:0}, NonArray, Proto:0x7efd4ebbd368], [[]], offset = 1, >), W:SideState, bc#292, ExitValid)
 19  4 37:  D@201:<!0:->	PutByOffset(KnownCell:D@190, KnownCell:D@190, Check:Untyped:D@198, MustGen, id13{d}, 1, W:NamedProperties(13), ClobbersExit, bc#292, ExitValid)
 20  4 37:  D@202:<!0:->	PutStructure(KnownCell:D@190, MustGen, %Ap:Object -> %DG:Object, ID:61967, R:JSObject_butterfly, W:JSCell_indexingType,JSCell_structureID,JSCell_typeInfoFlags, ClobbersExit, bc#292, ExitInvalid)
 21  4 37:  D@203:<!0:->	FilterPutByIdStatus(Check:Untyped:D@190, MustGen, (<Transition: [0x7efd0e1cd110:[0xf20f, Object, {d:1, a:0}, NonArray, Proto:0x7efd4ebbd368]] to 0x7efd0e1cd180:[0xf669, Object, {e:2, d:1, a:0}, NonArray, Proto:0x7efd4ebbd368], [[]], offset = 2, >), W:SideState, bc#298, ExitValid)
 22  4 37:  D@205:<!0:->	PutByOffset(KnownCell:D@190, KnownCell:D@190, Check:Untyped:Kill:D@27, MustGen, id14{e}, 2, W:NamedProperties(14), ClobbersExit, bc#298, ExitValid)
 23  4 37:  D@206:<!0:->	PutStructure(KnownCell:D@190, MustGen, %DG:Object -> %Ax:Object, ID:63081, R:JSObject_butterfly, W:JSCell_indexingType,JSCell_structureID,JSCell_typeInfoFlags, ClobbersExit, bc#298, ExitInvalid)
 24  4 37:  D@208:<!0:->	FilterPutByIdStatus(Check:Untyped:D@190, MustGen, (<Transition: [0x7efd0e1cd180:[0xf669, Object, {e:2, d:1, a:0}, NonArray, Proto:0x7efd4ebbd368]] to 0x7efd0e1cd1f0:[0xf74f, Object, {length:3, e:2, d:1, a:0}, NonArray, Proto:0x7efd4ebbd368], [[]], offset = 3, >), W:SideState, bc#304, ExitValid)
 25  4 37:  D@210:<!0:->	PutByOffset(KnownCell:D@190, KnownCell:D@190, Check:Untyped:D@207, MustGen, id15{length}, 3, W:NamedProperties(15), ClobbersExit, bc#304, ExitValid)
 26  4 37:  D@211:<!0:->	PutStructure(KnownCell:D@190, MustGen, %Ax:Object -> %AR:Object, ID:63311, R:JSObject_butterfly, W:JSCell_indexingType,JSCell_structureID,JSCell_typeInfoFlags, ClobbersExit, bc#304, ExitInvalid)
 27  4 37:  D@119:<!0:->	KillStack(MustGen, loc15, W:Stack(loc15), ClobbersExit, bc#310, ExitValid)
 28  4 37:  D@213:<!0:->	MovHint(Check:Untyped:D@212, MustGen, loc15, W:SideState, ClobbersExit, bc#310, ExitInvalid)
 29  4 37:  D@118:<!0:->	KillStack(MustGen, loc16, W:Stack(loc16), ClobbersExit, bc#317, ExitValid)
 30  4 37:  D@221:<!0:->	MovHint(Check:Untyped:D@219, MustGen, loc16, W:SideState, ClobbersExit, bc#317, ExitInvalid)
 31  4 37:  D@223:<!0:->	FilterPutByIdStatus(Check:Untyped:D@190, MustGen, (<Transition: [0x7efd0e1cd1f0:[0xf74f, Object, {length:3, e:2, d:1, a:0}, NonArray, Proto:0x7efd4ebbd368]] to 0x7efd0e1cd260:[0xf798, Object, {a:0, d:1, e:2, length:3, toString:4}, NonArray, Proto:0x7efd4ebbd368, Leaf (Watched)], [[]], offset = 4, >), W:SideState, bc#325, ExitValid)
 32  4 37:  D@225:<!0:->	PutByOffset(KnownCell:D@190, KnownCell:D@190, Check:Untyped:D@219, MustGen, id17{toString}, 4, W:NamedProperties(17), ClobbersExit, bc#325, ExitValid)
 33  4 37:  D@226:<!0:->	PutStructure(KnownCell:D@190, MustGen, %AR:Object -> %Eme:Object, ID:63384, R:JSObject_butterfly, W:JSCell_indexingType,JSCell_structureID,JSCell_typeInfoFlags, ClobbersExit, bc#325, ExitInvalid)
 34  4 37:  D@117:<!0:->	KillStack(MustGen, loc13, W:Stack(loc13), ClobbersExit, bc#331, ExitValid)
 35  4 37:  D@227:<!0:->	MovHint(Check:Untyped:D@190, MustGen, loc13, W:SideState, ClobbersExit, bc#331, ExitInvalid)
 36  4 37:  D@229:< 4:->	GetClosureVar(KnownCell:D@71, JS|UseAsOther, Uint16Array, scope3, R:ScopeProperties(3), Exits, bc#334, ExitValid)  predicting Uint16Array
 37  4 37:  D@116:<!0:->	KillStack(MustGen, this, W:Stack(this), ClobbersExit, bc#334, ExitValid)
 38  4 37:  D@228:<!0:->	MovHint(Check:Untyped:D@229, MustGen, this, W:SideState, ClobbersExit, bc#334, ExitInvalid)
 39  4 37:  D@222:<!0:->	CheckNotEmpty(Check:Untyped:D@229, MustGen, Exits, bc#342, ExitValid)
 40  4 37:  D@216:<!1:->	InByVal(Check:Cell:D@229, Check:Untyped:Kill:D@190, Boolean|MustGen|PureInt, Bool, Uint16Array+NonArray+InBounds+AsIs+Read, R:World, W:Heap, Exits, ClobbersExit, bc#344, ExitValid)
 41  4 37:  D@113:<!0:->	KillStack(MustGen, loc12, W:Stack(loc12), ClobbersExit, bc#344, ExitInvalid)
 42  4 37:  D@214:<!0:->	MovHint(Check:Untyped:Kill:D@216, MustGen, loc12, W:SideState, ClobbersExit, bc#344, ExitInvalid)
 43  4 37:  D@146:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#344, exit: bc#349, ExitValid)
 44  4 37:  D@112:<!0:->	KillStack(MustGen, loc11, W:Stack(loc11), ClobbersExit, bc#349, ExitValid)
 45  4 37:  D@192:<!0:->	MovHint(Check:Untyped:D@193, MustGen, loc11, W:SideState, ClobbersExit, bc#349, ExitInvalid)
 46  4 37:  D@189:< 3:->	ArithAdd(DoubleRep:Kill:D@195<Double>, DoubleRep:D@33<Double>, Double|UseAsOther, AnyIntAsDouble|NonIntAsDouble, Unchecked, Exits, bc#352, ExitValid)
 47  4 37:  D@111:<!0:->	KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#352, ExitInvalid)
 48  4 37:  D@187:<!0:->	MovHint(DoubleRep:D@189<Double>, MustGen, loc10, W:SideState, ClobbersExit, bc#352, ExitInvalid)
 49  4 37:  D@177:< 1:->	CompareLess(DoubleRep:D@189<Double>, DoubleRep:D@34<Double>, Boolean|UseAsOther, Bool, Exits, bc#355, ExitValid)
 50  4 37:  D@175:<!0:->	Branch(KnownBoolean:Kill:D@177, MustGen, T:#2/w:10.000000, F:#5/w:1.000000, W:SideState, bc#355, ExitInvalid)
     4 37:   States: TakeBoth, StructuresAreWatched
     4 37:   Live: D@33<Double>, D@34<Double>, D@46, D@71, D@189<Double>, D@193, D@198, D@207, D@212, D@219, D@229
     4 37:   Values: 

     5 37: Block #5 (bc#359):
     5 37:   Execution count: 1.000000
     5 37:   Predecessors: #4
     5 37:   Successors: #7
     5 37:   Dominated by: #0 #3 #4 #5 #10
     5 37:   Dominates: #5
     5 37:   Dominance Frontier: #7
     5 37:   Iterated Dominance Frontier: #7
     5 37:   States: StructuresAreWatched
     5 37:   Live: D@229
     5 37:   Values: 
  0  5 37:  D@106:<!0:->	ExitOK(MustGen, W:SideState, bc#359, ExitValid)
  1  5 37:  D@101:< 1:->	Upsilon(Check:Untyped:Kill:D@229, ^84, W:SideState, bc#359, ExitValid)
  2  5 37:    D@1:<!0:->	Jump(MustGen, T:#7, W:SideState, bc#359, ExitValid)
     5 37:   States: InvalidBranchDirection, StructuresAreWatched
     5 37:   Live: shadow(D@84)
     5 37:   Values: 

     6 37: Block #6 (bc#359):
     6 37:   Execution count: 1.000000
     6 37:   Predecessors: #10
     6 37:   Successors: #7
     6 37:   Dominated by: #0 #6 #10
     6 37:   Dominates: #6
     6 37:   Dominance Frontier: #7
     6 37:   Iterated Dominance Frontier: #7
     6 37:   States: StructuresAreWatched
     6 37:   Live: D@31
     6 37:   Values: 
  0  6 37:   D@90:<!0:->	ExitOK(MustGen, W:SideState, bc#359, ExitValid)
  1  6 37:   D@88:< 1:->	Upsilon(Check:Untyped:Kill:D@31, ^84, W:SideState, bc#359, ExitValid)
  2  6 37:  D@172:<!0:->	Jump(MustGen, T:#7, W:SideState, bc#359, ExitValid)
     6 37:   States: InvalidBranchDirection, StructuresAreWatched
     6 37:   Live: shadow(D@84)
     6 37:   Values: 

     7 37: Block #7 (bc#359):
     7 37:   Execution count: 1.000000
     7 37:   Predecessors: #5 #6
     7 37:   Successors: #9
     7 37:   Dominated by: #0 #7 #10
     7 37:   Dominates: #7 #9
     7 37:   Dominance Frontier: 
     7 37:   Iterated Dominance Frontier: 
     7 37:   States: StructuresAreWatched
     7 37:   Live: shadow(D@84)
     7 37:   Values: 
  0  7 37:   D@84:< 1:->	Phi(JS|PureInt, Uint16Array, W:SideState, bc#359, ExitInvalid)
  1  7 37:  D@100:<!0:->	MovHint(Check:Untyped:Kill:D@84, MustGen, this, W:SideState, ClobbersExit, bc#359, ExitInvalid)
  2  7 37:   D@99:<!0:->	ExitOK(MustGen, W:SideState, bc#359, ExitValid)
  3  7 37:   D@94:<!0:->	ExitOK(MustGen, W:SideState, bc#363, ExitValid)
  4  7 37:   D@87:<!0:->	Jump(MustGen, T:#9, W:SideState, bc#363, ExitValid)
     7 37:   States: InvalidBranchDirection, StructuresAreWatched
     7 37:   Live: 
     7 37:   Values: 

     9 37: Block #9 (bc#363): (OSR target)
     9 37:   Execution count: 10.000000
     9 37:   Predecessors: #7 #9
     9 37:   Successors: #9
     9 37:   Dominated by: #0 #7 #9 #10
     9 37:   Dominates: #9
     9 37:   Dominance Frontier: #9
     9 37:   Iterated Dominance Frontier: #9
     9 37:   States: StructuresAreWatched
     9 37:   Live: 
     9 37:   Values: 
  0  9 37:   D@91:<!0:->	ExitOK(MustGen, W:SideState, bc#363, ExitValid)
  1  9 37:  D@157:<!0:->	LoopHint(MustGen, W:SideState, bc#363, ExitValid)
  2  9 37:  D@154:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#364, ExitValid)
  3  9 37:  D@128:<!0:->	Jump(MustGen, T:#9, W:SideState, bc#365, ExitInvalid)
     9 37:   States: InvalidBranchDirection, StructuresAreWatched
     9 37:   Live: 
     9 37:   Values: 

    10 37: Block #10 (bc#381): (Catch Entrypoint)
    10 37:   Execution count: 1.000000
    10 37:   Predecessors: #0
    10 37:   Successors: #3 #6
    10 37:   Dominated by: #0 #10
    10 37:   Dominates: #2 #3 #4 #5 #6 #7 #9 #10
    10 37:   Dominance Frontier: 
    10 37:   Iterated Dominance Frontier: 
    10 37:   States: StructuresAreWatched
    10 37:   Live: D@3, D@33<Double>, D@34<Double>, D@46, D@193, D@198, D@207, D@212, D@219
    10 37:   Values: 
  0 10 37:  D@215:<!0:->	InitializeEntrypointArguments(MustGen, W:SideState, ClobbersExit, bc#381, ExitInvalid)
  1 10 37:   D@95:<!0:->	ExitOK(MustGen, W:SideState, bc#381, ExitInvalid)
  2 10 37:   D@71:< 3:->	ExtractCatchLocal(JS|UseAsOther, OtherObj, R:CatchLocals(0), bc#381, ExitInvalid)
  3 10 37:  D@121:<!0:->	KillStack(MustGen, loc6, W:Stack(loc6), ClobbersExit, bc#381, ExitInvalid)
  4 10 37:   D@69:<!0:->	MovHint(Check:Untyped:D@71, MustGen, loc6, W:SideState, ClobbersExit, bc#381, ExitInvalid)
  5 10 37:   D@65:< 8:->	ExtractCatchLocal(JS|UseAsOther, OtherObj, R:CatchLocals(1), bc#381, ExitInvalid)
  6 10 37:  D@115:<!0:->	KillStack(MustGen, loc9, W:Stack(loc9), ClobbersExit, bc#381, ExitInvalid)
  7 10 37:   D@59:<!0:->	MovHint(Check:Untyped:D@65, MustGen, loc9, W:SideState, ClobbersExit, bc#381, ExitInvalid)
  8 10 37:   D@57:< 2:->	ExtractCatchLocal(JS|PureNum, OtherObj, R:CatchLocals(2), bc#381, ExitInvalid)
  9 10 37:  D@110:<!0:->	KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#381, ExitInvalid)
 10 10 37:   D@48:<!0:->	MovHint(Check:Untyped:D@57, MustGen, loc10, W:SideState, ClobbersExit, bc#381, ExitInvalid)
 11 10 37:   D@45:<!0:->	ClearCatchLocals(MustGen, W:CatchLocals, ClobbersExit, bc#381, ExitInvalid)
 12 10 37:   D@43:<!0:->	ExitOK(MustGen, W:SideState, bc#381, ExitValid)
 13 10 37:   D@31:< 1:->	GetStack(JS|PureInt, Uint16Array, this, FlushedJSValue, R:Stack(this), bc#381, exit: bc#385, ExitValid)
 14 10 37:   D@96:< 0:->	GetStack(JS|PureInt, Other, arg1, FlushedJSValue, R:Stack(arg1), bc#381, exit: bc#385, ExitValid)
 15 10 37:  D@204:< 0:->	GetStack(JS|PureInt, Other, arg2, FlushedJSValue, R:Stack(arg2), bc#381, exit: bc#385, ExitValid)
 16 10 37:   D@42:<!0:->	Check(Check:Cell:D@71, MustGen, Exits, bc#381, exit: bc#385, ExitValid)
 17 10 37:   D@37:<!0:->	Check(Check:Cell:D@65, MustGen, Exits, bc#381, exit: bc#385, ExitValid)
 18 10 37:  D@105:<!0:->	KillStack(MustGen, loc4, W:Stack(loc4), ClobbersExit, bc#195, ExitValid)
 19 10 37:  D@134:<!0:->	MovHint(Check:Untyped:D@65, MustGen, loc4, W:SideState, ClobbersExit, bc#195, ExitInvalid)
 20 10 37:    D@2:<!0:->	KillStack(MustGen, loc11, W:Stack(loc11), ClobbersExit, bc#198, ExitValid)
 21 10 37:  D@137:<!0:->	MovHint(Check:Untyped:D@46, MustGen, loc11, W:SideState, ClobbersExit, bc#198, ExitInvalid)
 22 10 37:  D@136:<!0:->	KillStack(MustGen, loc11, W:Stack(loc11), ClobbersExit, bc#201, ExitValid)
 23 10 37:  D@140:<!0:->	MovHint(Check:Untyped:Kill:D@57, MustGen, loc11, W:SideState, ClobbersExit, bc#201, ExitInvalid)
 24 10 37:  D@138:<!0:->	KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#204, ExitValid)
 25 10 37:  D@143:<!0:->	MovHint(Check:Untyped:Kill:D@3, MustGen, loc10, W:SideState, ClobbersExit, bc#204, ExitInvalid)
 26 10 37:  D@147:< 2:->	NewAsyncFunction(KnownCell:D@65, JS|UseAsOther, Function, <0x7efd0e1e5b80, FunctionExecutable>, v25#<nogen>/<nogen>:[0x7efd0e1e5b80], R:HeapObjectCount, W:HeapObjectCount,Watchpoint_fire, ExitsForExceptions, ClobbersExit, bc#207, ExitValid)
 27 10 37:  D@139:<!0:->	KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#207, ExitInvalid)
 28 10 37:  D@148:<!0:->	MovHint(Check:Untyped:D@147, MustGen, loc10, W:SideState, ClobbersExit, bc#207, ExitInvalid)
 29 10 37:  D@149:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#207, exit: bc#211, ExitValid)
 30 10 37:  D@152:<!0:->	PutClosureVar(KnownCell:D@65, Check:Untyped:Kill:D@147, MustGen, scope3, W:ScopeProperties(3), ClobbersExit, bc#211, ExitValid)
 31 10 37:  D@153:<!0:->	NotifyWrite(MustGen, 0x7efd4eba8d80, W:Watchpoint_fire,SideState, ClobbersExit, bc#211, ExitInvalid)
 32 10 37:  D@150:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#219, ExitValid)
 33 10 37:  D@155:< 2:->	GetClosureVar(KnownCell:D@65, JS|UseAsOther, NonIntAsDouble, scope0, R:ScopeProperties(0), Exits, bc#219, ExitValid)  predicting NonIntAsDouble
 34 10 37:  D@141:<!0:->	KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#219, ExitValid)
 35 10 37:  D@156:<!0:->	MovHint(Check:Untyped:D@155, MustGen, loc10, W:SideState, ClobbersExit, bc#219, ExitInvalid)
 36 10 37:   D@93:< 4:->	DoubleRep(Check:RealNumber:Kill:D@155, Double|PureInt, BytecodeDouble, Exits, bc#227, ExitValid)
 37 10 37:    D@5:<!0:->	KillStack(MustGen, loc11, W:Stack(loc11), ClobbersExit, bc#227, ExitInvalid)
 38 10 37:  D@159:<!0:->	MovHint(DoubleRep:D@93<Double>, MustGen, loc11, W:SideState, ClobbersExit, bc#227, ExitInvalid)
 39 10 37:   D@92:< 4:->	ValueRep(DoubleRep:D@93<Double>, JS|PureInt, BytecodeDouble, bc#227, exit: bc#231, ExitValid)
 40 10 37:    D@7:<!0:->	KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#231, ExitValid)
 41 10 37:  D@161:<!0:->	MovHint(DoubleRep:D@93<Double>, MustGen, loc10, W:SideState, ClobbersExit, bc#231, ExitInvalid)
 42 10 37:  D@163:< 2:->	ArithAdd(DoubleRep:Kill:D@93<Double>, DoubleRep:D@33<Double>, Double|UseAsOther, AnyIntAsDouble|NonIntAsDouble, Unchecked, Exits, bc#234, ExitValid)
 43 10 37:    D@9:<!0:->	KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#234, ExitInvalid)
 44 10 37:  D@164:<!0:->	MovHint(DoubleRep:D@163<Double>, MustGen, loc10, W:SideState, ClobbersExit, bc#234, ExitInvalid)
 45 10 37:   D@89:< 1:->	ValueRep(DoubleRep:Kill:D@163<Double>, JS|PureInt, BytecodeDouble, bc#234, exit: bc#237, ExitValid)
 46 10 37:  D@166:<!0:->	PutClosureVar(KnownCell:D@65, Check:Untyped:Kill:D@89, MustGen, scope0, W:ScopeProperties(0), ClobbersExit, bc#237, ExitValid)
 47 10 37:  D@167:<!0:->	PutClosureVar(KnownCell:Kill:D@65, Check:Untyped:D@92, MustGen, scope1, W:ScopeProperties(1), ClobbersExit, bc#245, ExitValid)
 48 10 37:  D@168:<!0:->	NotifyWrite(MustGen, 0x7efd4eba8da0, W:Watchpoint_fire,SideState, ClobbersExit, bc#245, ExitInvalid)
 49 10 37:  D@151:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#253, ExitValid)
 50 10 37:   D@11:<!0:->	KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#253, ExitValid)
 51 10 37:  D@170:<!0:->	MovHint(Check:Untyped:D@46, MustGen, loc10, W:SideState, ClobbersExit, bc#253, ExitInvalid)
 52 10 37:   D@13:<!0:->	KillStack(MustGen, loc11, W:Stack(loc11), ClobbersExit, bc#256, ExitValid)
 53 10 37:  D@174:<!0:->	MovHint(Check:Untyped:D@92, MustGen, loc11, W:SideState, ClobbersExit, bc#256, ExitInvalid)
 54 10 37:  D@142:<!0:->	KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#264, ExitValid)
 55 10 37:  D@176:<!0:->	MovHint(Check:Untyped:D@92, MustGen, loc10, W:SideState, ClobbersExit, bc#264, ExitInvalid)
 56 10 37:   D@86:< 2:->	DoubleRep(RealNumber:Kill:D@92, Double|PureInt, BytecodeDouble, bc#264, exit: bc#267, ExitValid)
 57 10 37:  D@179:< 1:->	CompareLess(DoubleRep:D@86<Double>, DoubleRep:D@34<Double>, Boolean|UseAsOther, Bool, Exits, bc#267, ExitValid)
 58 10 37:  D@180:<!0:->	Branch(KnownBoolean:Kill:D@179, MustGen, T:#3/w:10.000000, F:#6/w:1.000000, W:SideState, bc#267, ExitInvalid)
    10 37:   States: TakeBoth, StructuresAreWatched
    10 37:   Live: D@31, D@33<Double>, D@34<Double>, D@46, D@71, D@86<Double>, D@193, D@198, D@207, D@212, D@219
    10 37:   Values: 

       37: GC Values:
       37:     Weak:Object: 0x7efd0e1d4240 with butterfly 0x7ee0163fe148 (Structure %Em:Function), StructureID: 58385
       37:     Strong:String (atomic),8Bit:(1),length:(76): 
                const v39 = v38.concat();
                v39;
            , StructureID: 15293
       37:     Weak:Object: 0x7efd0e1d4000 with butterfly 0x7ee0163fce68 (Structure %Ak:Function), StructureID: 45983
       37:     Weak:Object: 0x7efd0e7fa068 with butterfly 0x7ee0163e4408 (Structure %B6:global), StructureID: 53674
       37:     Strong:Cell: 0x7efd0e1e5b80 (%AG:FunctionExecutable), StructureID: 18549
       37:     Weak:Object: 0x7efd4eba9768 with butterfly 0x7ee0163e0010 (Structure %Cw:Array,ArrayWithDouble), StructureID: 35566
       37:     Weak:Object: 0x7efd4ebb6de8 with butterfly 0x7ee0163d8038 (Structure %EW:Array,ArrayWithContiguous), StructureID: 34627
       37:     Weak:Object: 0x7efd0e1b8000 with butterfly (nil) (Structure %BW:JSLexicalEnvironment), StructureID: 31388
       37:     Strong:String (atomic),8Bit:(1),length:(70): 
            const v21 = (-1914445586)[v20];
            v21;
        , StructureID: 15293
       37:     Strong:String (atomic),8Bit:(1),length:(58): 'super()' can't be called more than once in a constructor., StructureID: 15293
       37:     Strong:Cell: 0x7efd0e1c0320 (%AM:SymbolTable), StructureID: 19832
       37:     Strong:Cell: 0x7efd0e1c02d0 (%AM:SymbolTable), StructureID: 19832
       37:     Weak:Object: 0x7efd0e1bc060 with butterfly (nil) (Structure %BW:JSLexicalEnvironment), StructureID: 31388
       37:     Weak:Object: 0x7efd0e1f6080 with butterfly 0x7ee0163fe168 (Structure %EN:Function), StructureID: 59661
       37: Desired watchpoints:
       37:     Watchpoint sets: 0x7efd4eba8080, 0x7efd4eba8100, 0x7efd4ebca4c0
       37:     Inline watchpoint sets: 0x7efd0e1fb548, 0x7efd0e1ccc28, 0x7efd0e1cc9f8, 0x7efd0e1f99b8, 0x7efd0e1f84b8, 0x7efd0e1f9fd8, 0x7efd0e1f8288, 0x7efd0e1f9b78, 0x7efd4ebd40c0, 0x7efd0e1cd2b8, 0x7efd0e1f8448, 0x7efd4ebd4280, 0x7efd0e1fb008
       37:     SymbolTables: 0x7efd0e1c0000
       37:     FunctionExecutables: 0x7efd0e1e5280
       37:     Buffer views: 
       37:     Object property conditions: <Object: 0x7efd0e7fa068 with butterfly 0x7ee0163e4408 (Structure %B6:global), StructureID: 53674: Equivalence of String with Object: 0x7efd0e1d4000 with butterfly 0x7ee0163fce68 (Structure %Ak:Function), StructureID: 45983>
       37: Structures:
       37:     %AG:FunctionExecutable        = 0x7efd0e1f8230:[0x4875, FunctionExecutable, {}, NonArray, Leaf (Watched)]
       37:     %AM:SymbolTable               = 0x7efd0e1f8460:[0x4d78, SymbolTable, {}, NonArray, Leaf (Watched)]
       37:     %AR:Object                    = 0x7efd0e1cd1f0:[0xf74f, Object, {length:3, e:2, d:1, a:0}, NonArray, Proto:0x7efd4ebbd368]
       37:     %Ak:Function                  = 0x7efd0e1fafb0:[0xb39f, Function, {length:100, name:101, prototype:102}, NonArray, Proto:0x7efd4ebfc248, Leaf (Watched)]
       37:     %Ap:Object                    = 0x7efd0e1cd0a0:[0xf19d, Object, {a:0}, NonArray, Proto:0x7efd4ebbd368]
       37:     %Ax:Object                    = 0x7efd0e1cd180:[0xf669, Object, {e:2, d:1, a:0}, NonArray, Proto:0x7efd4ebbd368]
       37:     %B6:global                    = 0x7efd0e1cc000:[0xd1aa, global, {Object:100, Function:101, Array:102, RegExp:103, SharedArrayBuffer:104, Atomics:105, String:106, Promise:107, BigInt:108, WeakRef:109, FinalizationRegistry:110, Intl:111, WebAssembly:112, Symbol.toStringTag:113, debug:114, describe:115, describeArray:116, print:117, printErr:118, quit:119, gc:120, fullGC:121, edenGC:122, gcHeapSize:123, MemoryFootprint:124, resetMemoryPeak:125, addressOf:126, version:127, run:128, runString:129, load:130, loadString:131, readFile:132, read:133, checkSyntax:134, sleepSeconds:135, jscStack:136, readline:137, preciseTime:138, neverInlineFunction:139, noInline:140, noDFG:141, noFTL:142, noOSRExitFuzzing:143, numberOfDFGCompiles:144, callerIsOMGCompiled:145, jscOptions:146, optimizeNextInvocation:147, reoptimizationRetryCount:148, transferArrayBuffer:149, failNextNewCodeBlock:150, OSRExit:151, isFinalTier:152, predictInt32:153, isInt32:154, isPureNaN:155, fiatInt52:156, effectful42:157, makeMasquerader:158, hasCustomProperties:159, createGlobalObject:160, createHeapBigInt:161, useBigInt32:162, isBigInt32:163, isHeapBigInt:164, dumpTypesForAllVariables:165, drainMicrotasks:166, setTimeout:167, releaseWeakRefs:168, finalizationRegistryLiveCount:169, finalizationRegistryDeadCount:170, getRandomSeed:171, setRandomSeed:172, isRope:173, callerSourceOrigin:174, is32BitPlatform:175, checkModuleSyntax:176, platformSupportsSamplingProfiler:177, generateHeapSnapshot:178, generateHeapSnapshotForGCDebugging:179, resetSuperSamplerState:180, ensureArrayStorage:181, startSamplingProfiler:182, samplingProfilerStackTraces:183, maxArguments:184, asyncTestStart:185, asyncTestPassed:186, WebAssemblyMemoryMode:187, console:188, $:189, $262:190, waitForReport:191, heapCapacity:192, flashHeapAccess:193, disableRichSourceInfo:194, mallocInALoop:195, totalCompileTime:196, fuzzilli:197, setUnhandledRejectionCallback:198, asDoubleNumber:199, dropAllLocks:200, Uint16Array:201, Uint16Array:202}, NonArray, Proto:0x7efd4ebbd368, Dictionary, Leaf (Watched)]
       37:     %BW:JSLexicalEnvironment      = 0x7efd0e1f9960:[0x7a9c, JSLexicalEnvironment, {}, NonArray, Leaf (Watched)]
       37:     %Cw:Array,ArrayWithDouble     = 0x7efd0e1f9f80:[0x8aee, Array, {}, CopyOnWriteArrayWithDouble, Proto:0x7efd4ebbd7e8, Leaf (Watched)]
       37:     %D0:Object                    = 0x7efd0e1f9810:[0x7826, Object, {}, NonArray, Proto:0x7efd4ebbd368]
       37:     %DG:Object                    = 0x7efd0e1cd110:[0xf20f, Object, {d:1, a:0}, NonArray, Proto:0x7efd4ebbd368]
       37:     %EN:Function                  = 0x7efd0e1ccbd0:[0xe90d, Function, {homeObject:100, prototype:101}, NonArray, Proto:0x7efd0e1d4240, Leaf (Watched)]
       37:     %EW:Array,ArrayWithContiguous = 0x7efd0e1f9dc0:[0x8743, Array, {}, ArrayWithContiguous, Proto:0x7efd4ebbd7e8]
       37:     %Em:Function                  = 0x7efd0e1cc9a0:[0xe411, Function, {length:100, name:101, prototype:102, BYTES_PER_ELEMENT:103}, NonArray, Proto:0x7efd0e1d4210, Leaf (Watched)]
       37:     %Eme:Object                   = 0x7efd0e1cd260:[0xf798, Object, {a:0, d:1, e:2, length:3, toString:4}, NonArray, Proto:0x7efd4ebbd368, Leaf (Watched)]


DFG ASSERTION FAILED: Live bytecode local not available: operand = this, availabilityMap = {locals = arg2:FlushedJSValue/Unavailable arg1:FlushedJSValue/Unavailable loc4:ConflictingFlush/D@65 loc6:ConflictingFlush/D@71 loc10:ConflictingFlush/D@195<Double>; heap = }, origin = bc#271
../../Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp(174) : bool JSC::DFG::OSRAvailabilityAnalysisPhase<(lambda at ../../Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp:193:31), (lambda at ../../Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp:194:31)>::run() [HeadFunctor = (lambda at ../../Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp:193:31), TailFunctor = (lambda at ../../Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp:194:31)]
Aborted (core dumped)
Comment 1 Radar WebKit Bug Importer 2021-04-09 18:09:30 PDT
<rdar://problem/76479457>
Comment 2 Yusuke Suzuki 2021-04-10 00:45:04 PDT
Thanks for your report!
I've tried and I cannot reproduce this crash.

Can you offer

1. which revision you used
2. which command line options you added
Comment 3 Yusuke Suzuki 2021-04-10 00:45:23 PDT
Reopened.
Comment 4 rain 2021-04-10 01:00:29 PDT
I compile it with afl+asan.
Comment 5 rain 2021-04-10 01:06:06 PDT
Command:
     ./jsc poc

Enviroment:
     ubuntu18.04

Compile command:
    refer to this:https://github.com/sslab-gatech/DIE/blob/master/engines/build-jsc-cov.sh
    and set the environment variable:
        export AFL_USE_ASAN=1
Comment 6 Yusuke Suzuki 2021-04-10 01:08:06 PDT
What is the revision? Is this still reproducible with Tip-of-trunk?
Comment 7 Yusuke Suzuki 2021-04-10 01:13:19 PDT
OK, now I've found that this is dupe of bug 221353 :)

*** This bug has been marked as a duplicate of bug 221353 ***