Bug 255715 - ASSERTION FAILED: edge->hasResult() in DFG::{anonymous}::Validate::validate()
Summary: ASSERTION FAILED: edge->hasResult() in DFG::{anonymous}::Validate::validate()
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-04-20 02:22 PDT by xiangwei1895
Modified: 2023-04-23 14:34 PDT (History)
3 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description xiangwei1895 2023-04-20 02:22:01 PDT 
## JavaScriptCore Version
dd75c5c12d617264cfc1e26a70c94591e4eb67c1

## Build 
Ubuntu 20.04.2 LTS (Linux 5.15.0-67-generic x86_64)

## Testcase and  Execution steps

```
function f0() {
      for (let i = 0; i < 1e5; i++) {;}  
}
v0 = {value: 0};
function f1() {
	var v1 = Object.defineProperties([0], {0: v0});
	for ( _  in v1) {
	    f0(v1[i]);
	    ++v1[ f1 (i in v1)  ];
	    if (i === "0")
		Object.defineProperties(v1, {0: v0});
	}
}
for (var i = 0; i < 1e5; ++i)
	f1();
```
./bin/jsc  testcase.js

## Output

At D@178 -> Check:Untyped:Kill:D@76: validation failed: edge->hasResult() (/home/WebKit/Source/JavaScriptCore/dfg/DFGValidate.cpp:156).

At time of failure:

       54: DFG for f1#<no-hash>:[0x62d0000d48e0->0x62d0000d4340->0x62d000069880, DFGFunctionCall, 276 (DidTryToEnterInLoop)]:
       54:   Fixpoint state: FixpointConverged; Form: SSA; Unification state: GloballyUnified; Ref count state: ExactRefCount
       54:   Argument formats for entrypoint index: 0 : FlushedJSValue

     0 54: Block #0 (bc#0): (OSR target)
     0 54:   Execution count: 1.000000
        ……


ASSERTION FAILED: edge->hasResult()
/home/WebKit/Source/JavaScriptCore/dfg/DFGValidate.cpp(156) : void JSC::DFG::{anonymous}::Validate::validate()
Aborted
Comment 1 Radar WebKit Bug Importer 2023-04-23 14:34:07 PDT 
<rdar://problem/108430274>