Bug 304696 – Relax OSRAvailability validation around phantom arguments-like objects

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

Created attachment 477847 [details]
check out assertion failure

While fuzzying i came across this sample triggering "DFG ASSERTION FAILED: heapPair.value.hasNode()",  with said flaky.js file. i narrowed down the sample and cant seem to get it to trigger without "--validateFTLOSRExitLiveness=false --forceEagerCompilation=true" passed to jsc binary.

"turnerhackz1@turnerhackz1-Aspire-A315-24P:~/Desktop/WebKitTest$ git describe --tags
WebKit-7623.1.14.14.11
turnerhackz1@turnerhackz1-Aspire-A315-24P:~/Desktop/WebKitTest$ git rev-parse HEAD
7732a1acb12f1f24f7e32a501947a0c76d4b9492
" shows the current tag for build.


Last comments running sample as follows produces this output 

"turnerhackz1@turnerhackz1-Aspire-A315-24P:~/Desktop/fuzzilli-main$ '/home/turnerhackz1/Desktop/WebKitTest/WebKitBuild/JSCOnly/Release/bin/jsc' --validateFTLOSRExitLiveness=true --forceEagerCompilation=true /home/turnerhackz1/Desktop/ggzfuzz/crashes/program_20251225112142_3329D242-E1C5-4410-BB1A-31200A461B9B_flaky.js 
Fuzzer output channel not available, printing to stdout instead.
EXPLORE_ACTION: {"operation":"CALL_METHOD","inputs":[{"special":{"name":"exploredValue"}},{"string":{"value":"constructor"}}],"isGuarded":true,"id":"v4"}
EXPLORE_ACTION: {"operation":"BITWISE_AND","inputs":[{"special":{"name":"exploredValue"}},{"argument":{"index":1}}],"isGuarded":false,"id":"v11"}
EXPLORE_ACTION: {"operation":"GET_PROPERTY","inputs":[{"special":{"name":"exploredValue"}},{"int":{"value":1}}],"isGuarded":false,"id":"v15"}
DFG ASSERTION FAILED: heapPair.value.hasNode()
/home/turnerhackz1/Desktop/WebKitTest/Source/JavaScriptCore/dfg/DFGAvailabilityMap.cpp(109) : void JSC::DFG::AvailabilityMap::validateAvailability(Graph &, Node *) const

While handling node D@95

Graph at time of failure:

       39: DFG for apply#BWaJWD:[0x79f3e55773c0->0x79f3e54ebf20->0x79f3e5506600, DFGFunctionCall, 35 (DidTryToEnterInLoop) (StrictMode)]:
       39:   Fixpoint state: FixpointNotConverged; Form: SSA; Unification state: GloballyUnified; Ref count state: EverythingIsLive
       39:   Argument formats for entrypoint index: 0 : FlushedJSValue, FlushedCell, FlushedCell, FlushedJSValue

     0 39: Block #0 (bc#0): (OSR target)
     0 39:   Execution count: 1.000000
     0 39:   Predecessors:
     0 39:   Successors: #2 #1
     0 39:   Dominated by: #0
     0 39:   Dominates: #0 #1 #2
     0 39:   Dominance Frontier: 
     0 39:   Iterated Dominance Frontier: 
     0 39:   States: StructuresAreWatched
     0 39:   Live: 
     0 39:   Values: 
  0  0 39:    D@4:< 12:->	JSConstant(JS|PureInt, Other, Undefined, bc#0, ExitValid)
  1  0 39:   D@17:< 1:->	JSConstant(JS|PureInt, Function, Weak:Object: 0x79f3e5463d00 with butterfly (nil)(base=0xfffffffffffffff8) (Structure %CI:Function), StructureID: 16782960, bc#0, ExitValid)
  2  0 39:   D@82:< 0:->	JSConstant(JS|PureInt, Function, Weak:Object: 0x79f3e5462e20 with butterfly 0x79f3e5457d48(base=0x79f3e5457d20) (Structure %C0:Function), StructureID: 16817968, bc#0, ExitValid)
  3  0 39:   D@31:< 1:->	JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, StringIdent, Strong:String (atomic),8Bit:(1),length:(55): Reflect.apply requires the first argument be a function, StructureID: 16777808, bc#0, ExitValid)
  4  0 39:   D@18:< 1:->	JSConstant(JS|PureInt, OtherObj, Weak:Object: 0x79f3e503b088 with butterfly 0x79f3e5508968(base=0x79f3e5508160) (Structure %BK:global), StructureID: 16800240, bc#0, ExitValid)
  5  0 39:  D@101:< 1:->	JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, StringIdent, Strong:String (atomic),8Bit:(1),length:(23): must be called with new, StructureID: 16777808, bc#0, ExitValid)
  6  0 39:   D@89:< 1:->	JSConstant(JS|PureInt, Empty, <JSValue()>, bc#0, ExitValid)
  7  0 39:   D@83:< 1:->	JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, OtherObj, Weak:Object: 0x79f3e54ec130 with butterfly (nil)(base=0xfffffffffffffff8) (Structure %D2:JSLexicalEnvironment), StructureID: 16785200, bc#0, ExitValid)
  8  0 39:   D@38:< 1:->	JSConstant(Boolean|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, Bool, True, bc#0, ExitValid)
  9  0 39:   D@59:<!0:->	ExitOK(MustGen, W:SideState, bc#0, ExitValid)
 10  0 39:  D@109:<!0:->	InitializeEntrypointArguments(MustGen, W:SideState, ClobbersExit, bc#0, ExitValid)
 11  0 39:  D@121:<!0:->	ExitOK(MustGen, W:SideState, bc#0, ExitValid)
 12  0 39:  D@123:< 0:->	GetStack(JS|PureInt, OtherObj, this, FlushedJSValue, R:Stack(this), bc#0, ExitValid)
 13  0 39:  D@100:< 4:->	GetStack(JS|PureInt, Function, arg1, FlushedCell, R:Stack(arg1), bc#0, ExitValid)
 14  0 39:   D@86:< 5:->	GetStack(JS|PureInt, Final|GlobalProxy, arg2, FlushedCell, R:Stack(arg2), bc#0, ExitValid)
 15  0 39:  D@114:<!0:->	AssertNotEmpty(Check:Untyped:D@86, MustGen, W:SideState, Exits, bc#0, ExitValid)
 16  0 39:  D@115:<!0:->	CheckStructure(Cell:D@86, MustGen, [%Ae:Object], R:JSCell_structureID, Exits, bc#0, ExitValid)
 17  0 39:   D@64:< 3:->	GetStack(JS|PureInt, Array|DirectArguments, arg3, FlushedJSValue, R:Stack(arg3), bc#0, ExitValid)
 18  0 39:   D@58:<!0:->	KillStack(MustGen, loc0, W:Stack(loc0), ClobbersExit, bc#0, ExitValid)
 19  0 39:    D@5:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc0, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 20  0 39:   D@41:<!0:->	KillStack(MustGen, loc1, W:Stack(loc1), ClobbersExit, bc#0, ExitInvalid)
 21  0 39:    D@7:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 22  0 39:   D@23:<!0:->	KillStack(MustGen, loc2, W:Stack(loc2), ClobbersExit, bc#0, ExitInvalid)
 23  0 39:    D@9:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 24  0 39:  D@127:<!0:->	KillStack(MustGen, loc3, W:Stack(loc3), ClobbersExit, bc#0, ExitInvalid)
 25  0 39:   D@11:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 26  0 39:  D@126:<!0:->	KillStack(MustGen, loc4, W:Stack(loc4), ClobbersExit, bc#0, ExitInvalid)
 27  0 39:   D@13:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 28  0 39:  D@125:<!0:->	KillStack(MustGen, loc5, W:Stack(loc5), ClobbersExit, bc#0, ExitInvalid)
 29  0 39:   D@15:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 30  0 39:  D@124:<!0:->	KillStack(MustGen, loc4, W:Stack(loc4), ClobbersExit, bc#0, ExitInvalid)
 31  0 39:   D@19:<!0:->	MovHint(Check:Untyped:Kill:D@18, MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid)
 32  0 39:   D@20:<!0:->	ExitOK(MustGen, W:SideState, bc#0, ExitValid)
 33  0 39:   D@21:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#0, ExitValid)
 34  0 39:  D@110:<!0:->	KillStack(MustGen, loc5, W:Stack(loc5), ClobbersExit, bc#1, ExitValid)
 35  0 39:   D@24:<!0:->	MovHint(Check:Untyped:Kill:D@17, MustGen, loc5, W:SideState, ClobbersExit, bc#1, ExitInvalid)
 36  0 39:   D@27:< 2:->	IsCallable(Check:Untyped:D@100, Boolean|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, Bool, R:MiscFields, Exits, bc#4, ExitValid)
 37  0 39:  D@111:<!0:->	KillStack(MustGen, loc6, W:Stack(loc6), ClobbersExit, bc#4, ExitValid)
 38  0 39:   D@28:<!0:->	MovHint(Check:Untyped:D@27, MustGen, loc6, W:SideState, ClobbersExit, bc#4, ExitInvalid)
 39  0 39:   D@30:<!0:->	Branch(KnownBoolean:Kill:D@27, MustGen, T:#2/w:1.000000, F:#1/w:1.000000, W:SideState, bc#7, ExitValid)
     0 39:   States: TakeBoth, StructuresAreWatched
     0 39:   Live: D@4, D@31, D@38, D@64, D@83, D@86, D@89, D@100, D@101
     0 39:   Values: D@4=>(Other, Undefined, 1:StructuresAreWatched), D@31=>(StringIdent, NonArray, [%C2:string], String (atomic),8Bit:(1),length:(55): Reflect.apply requires the first argument be a function, StructureID: 16777808, 1:StructuresAreWatched), D@38=>(Bool, True, 1:StructuresAreWatched), D@64=>(BytecodeTop, TOP, TOP, 1:StructuresAreWatched), D@83=>(OtherObj, NonArray, [%D2:JSLexicalEnvironment], Object: 0x79f3e54ec130 with butterfly (nil)(base=0xfffffffffffffff8) (Structure %D2:JSLexicalEnvironment), StructureID: 16785200, 1:StructuresAreWatched), D@86=>(Final, NonArray, [%Ae:Object], 1:StructuresAreWatched), D@89=>(Empty, 1:StructuresAreWatched), D@100=>(Cell|Empty, TOP, TOP, 1:StructuresAreWatched), D@101=>(StringIdent, NonArray, [%C2:string], String (atomic),8Bit:(1),length:(23): must be called with new, StructureID: 16777808, 1:StructuresAreWatched)

     1 39: Block #1 (bc#10):
     1 39:   Execution count: 1.000000
     1 39:   Predecessors: #0
     1 39:   Successors:
     1 39:   Dominated by: #0 #1
     1 39:   Dominates: #1
     1 39:   Dominance Frontier: 
     1 39:   Iterated Dominance Frontier: 
     1 39:   States: StructuresAreWatched
     1 39:   Live: D@31
     1 39:   Values: D@31=>(StringIdent, NonArray, [%C2:string], String (atomic),8Bit:(1),length:(55): Reflect.apply requires the first argument be a function, StructureID: 16777808, 1:StructuresAreWatched)
  0  1 39:    D@0:<!0:->	ExitOK(MustGen, W:SideState, bc#10, ExitValid)
  1  1 39:   D@32:<!0:->	ThrowStaticError(String:Kill:D@31, MustGen, R:World, W:SideState, Exits, bc#10, ExitValid)
     1 39:   States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated
     1 39:   Live: 
     1 39:   Values: 

     2 39: Block #2 (bc#13):
     2 39:   Execution count: 1.000000
     2 39:   Predecessors: #0
     2 39:   Successors:
     2 39:   Dominated by: #0 #2
     2 39:   Dominates: #2
     2 39:   Dominance Frontier: 
     2 39:   Iterated Dominance Frontier: 
     2 39:   States: StructuresAreWatched
     2 39:   Live: D@4, D@38, D@64, D@83, D@86, D@89, D@100, D@101
     2 39:   Values: D@4=>(Other, Undefined, 1:StructuresAreWatched), D@38=>(Bool, True, 1:StructuresAreWatched), D@64=>(BytecodeTop, TOP, TOP, 1:StructuresAreWatched), D@83=>(OtherObj, NonArray, [%D2:JSLexicalEnvironment], Object: 0x79f3e54ec130 with butterfly (nil)(base=0xfffffffffffffff8) (Structure %D2:JSLexicalEnvironment), StructureID: 16785200, 1:StructuresAreWatched), D@86=>(Final, NonArray, [%Ae:Object], 1:StructuresAreWatched), D@89=>(Empty, 1:StructuresAreWatched), D@100=>(Cell|Empty, TOP, TOP, 1:StructuresAreWatched), D@101=>(StringIdent, NonArray, [%C2:string], String (atomic),8Bit:(1),length:(23): must be called with new, StructureID: 16777808, 1:StructuresAreWatched)
  0  2 39:  D@112:<!0:->	ExitOK(MustGen, W:SideState, bc#13, ExitValid)
  1  2 39:  D@119:<!0:->	Check(Check:Object:D@64, MustGen, Exits, bc#13, ExitValid)
  2  2 39:  D@113:<!0:->	KillStack(MustGen, loc6, W:Stack(loc6), ClobbersExit, bc#13, ExitValid)
  3  2 39:   D@39:<!0:->	MovHint(Check:Untyped:Kill:D@38, MustGen, loc6, W:SideState, ClobbersExit, bc#13, ExitInvalid)
  4  2 39:  D@116:<!0:->	KillStack(MustGen, loc7, W:Stack(loc7), ClobbersExit, bc#22, ExitValid)
  5  2 39:   D@49:<!0:->	MovHint(Check:Untyped:D@100, MustGen, loc7, W:SideState, ClobbersExit, bc#22, ExitInvalid)
  6  2 39:   D@55:<!0:->	FilterCallLinkStatus(Check:Untyped:D@100, MustGen, (Function: Object: 0x79f3e5462e20 with butterfly 0x79f3e5457d48(base=0x79f3e5457d20) (Structure 0x79f201009f30:[0x1009f30/16817968, Function, (0/0, 3/4){prototype:64, length:65, name:66}, NonArray, PropertyAddition, Proto:0x79f3e70185c8, Leaf]), StructureID: 16817968; Executable: F3#Besus2:[0x79f3e55741e0->0x79f3e5475900, BaselineFunctionCall, 131 (ShouldAlwaysBeInlined)]/F3#Besus3:[0x79f3e54e8e20->0x79f3e5475900, BaselineFunctionConstruct, 134]), W:SideState, bc#25, ExitValid)
  7  2 39:   D@57:<!0:->	CheckIsConstant(Cell:Kill:D@100, MustGen, <0x79f3e5462e20, Function>, F3#Besus2/Besus3:[0x79f3e5475900], Exits, bc#25, ExitValid)
  8  2 39:   D@60:<!2:->	VarargsLength(Check:Untyped:D@64, Int32|MustGen|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, start = loc9, count = loc11, offset = 0, mandatoryMinimum = 0, limit = 1, R:World, W:Heap, Exits, ClobbersExit, bc#25, ExitValid)
  9  2 39:  D@120:<!0:->	KillStack(MustGen, tmp0, W:Stack(tmp0), ClobbersExit, bc#25, ExitInvalid)
 10  2 39:   D@61:<!0:->	MovHint(Check:Untyped:D@60, MustGen, tmp0, W:SideState, ClobbersExit, bc#25, ExitInvalid)
 11  2 39:  D@118:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits, bc#25, exit: bc#25cp#1, ExitValid)
 12  2 39:   D@63:<!0:->	LoadVarargs(KnownInt32:Kill:D@60, Check:Untyped:Kill:D@64, MustGen, start = loc9, count = loc11, offset = 0, mandatoryMinimum = 0, limit = 1, R:World, W:Stack(loc11),Stack(loc9),Heap, Exits, ClobbersExit, bc#25cp#1, ExitValid)
 13  2 39:  D@122:< 0:->	GetStack(JS|PureInt, Int32, loc11, FlushedInt32, R:Stack(loc11), bc#25cp#1, ExitInvalid)
 14  2 39:  D@128:<!0:->	KillStack(MustGen, loc10, W:Stack(loc10), ClobbersExit, bc#25cp#1, ExitInvalid)
 15  2 39:   D@66:<!0:->	MovHint(Check:Untyped:D@86, MustGen, loc10, W:SideState, ClobbersExit, bc#25cp#1, ExitInvalid)
     2 39:   --> F3#Besus2:<0x79f3e55741e0, bc#25cp#1, TailCallVarargs, known callee: Object: 0x79f3e5462e20 with butterfly 0x79f3e5457d48(base=0x79f3e5457d20) (Structure %C0:Function), StructureID: 16817968, numArgs+this = 1, numFixup = 0, stackOffset = -16 (loc0 maps to loc16)>
 16  2 39:    D@117:<!0:->	InvalidationPoint(MustGen, R:Stack(loc11), W:SideState, Exits, bc#0, ExitValid)
 17  2 39:     D@68:<!0:->	ExitOK(MustGen, R:Stack(loc11), W:SideState, bc#0, ExitValid)
 18  2 39:    D@108:<!0:->	KillStack(MustGen, loc16, R:Stack(loc11), W:Stack(loc16), ClobbersExit, bc#0, ExitValid)
 19  2 39:     D@70:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc16, R:Stack(loc11), W:SideState, ClobbersExit, bc#0, ExitInvalid)
 20  2 39:    D@107:<!0:->	KillStack(MustGen, loc17, R:Stack(loc11), W:Stack(loc17), ClobbersExit, bc#0, ExitInvalid)
 21  2 39:     D@72:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc17, R:Stack(loc11), W:SideState, ClobbersExit, bc#0, ExitInvalid)
 22  2 39:    D@106:<!0:->	KillStack(MustGen, loc18, R:Stack(loc11), W:Stack(loc18), ClobbersExit, bc#0, ExitInvalid)
 23  2 39:     D@74:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc18, R:Stack(loc11), W:SideState, ClobbersExit, bc#0, ExitInvalid)
 24  2 39:    D@105:<!0:->	KillStack(MustGen, loc19, R:Stack(loc11), W:Stack(loc19), ClobbersExit, bc#0, ExitInvalid)
 25  2 39:     D@76:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc19, R:Stack(loc11), W:SideState, ClobbersExit, bc#0, ExitInvalid)
 26  2 39:    D@104:<!0:->	KillStack(MustGen, loc20, R:Stack(loc11), W:Stack(loc20), ClobbersExit, bc#0, ExitInvalid)
 27  2 39:     D@78:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc20, R:Stack(loc11), W:SideState, ClobbersExit, bc#0, ExitInvalid)
 28  2 39:    D@103:<!0:->	KillStack(MustGen, loc21, R:Stack(loc11), W:Stack(loc21), ClobbersExit, bc#0, ExitInvalid)
 29  2 39:     D@80:<!0:->	MovHint(Check:Untyped:Kill:D@4, MustGen, loc21, R:Stack(loc11), W:SideState, ClobbersExit, bc#0, ExitInvalid)
 30  2 39:     D@99:<!0:->	KillStack(MustGen, loc20, R:Stack(loc11), W:Stack(loc20), ClobbersExit, bc#0, ExitInvalid)
 31  2 39:     D@84:<!0:->	MovHint(Check:Untyped:Kill:D@83, MustGen, loc20, R:Stack(loc11), W:SideState, ClobbersExit, bc#0, ExitInvalid)
 32  2 39:     D@85:<!0:->	ExitOK(MustGen, R:Stack(loc11), W:SideState, bc#0, ExitValid)
 33  2 39:     D@88:<!0:->	CheckStructure(Cell:D@86, MustGen, [%Ae:Object], R:Stack(loc11),JSCell_structureID, Exits, bc#1, ExitValid)
 34  2 39:     D@97:<!0:->	KillStack(MustGen, loc22, R:Stack(loc11), W:Stack(loc22), ClobbersExit, bc#6, ExitValid)
 35  2 39:     D@90:<!0:->	MovHint(Check:Untyped:Kill:D@89, MustGen, loc22, R:Stack(loc11), W:SideState, ClobbersExit, bc#6, ExitInvalid)
 36  2 39:     D@69:<!0:->	PutStack(Check:Untyped:Kill:D@86, MustGen, loc10, FlushedJSValue, R:Stack(loc11), W:Stack(loc10), bc#9, ExitValid)
 37  2 39:     D@92:< 1:->	GetRestLength(Int32|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, Int32, numberOfArgumentsToSkip = 0, R:Stack,Stack(loc11), bc#9, ExitValid)
 38  2 39:      D@3:<!0:->	KillStack(MustGen, loc25, R:Stack(loc11), W:Stack(loc25), ClobbersExit, bc#9, ExitValid)
 39  2 39:     D@93:<!0:->	MovHint(Check:Untyped:Kill:D@92, MustGen, loc25, R:Stack(loc11), W:SideState, ClobbersExit, bc#9, ExitInvalid)
 40  2 39:     D@95:<!2:->	PhantomCreateRest(JS|MustGen|PureInt, Array, numberOfArgumentsToSkip = 0, R:Stack(loc11),HeapObjectCount, W:HeapObjectCount, Exits, bc#12, ExitValid)
 41  2 39:      D@2:<!0:->	KillStack(MustGen, loc24, R:Stack(loc11), W:Stack(loc24), ClobbersExit, bc#12, ExitValid)
 42  2 39:     D@96:<!0:->	MovHint(Check:Untyped:D@95, MustGen, loc24, R:Stack(loc11), W:SideState, ClobbersExit, bc#12, ExitInvalid)
 43  2 39:      D@1:<!0:->	KillStack(MustGen, loc22, R:Stack(loc11), W:Stack(loc22), ClobbersExit, bc#16, ExitValid)
 44  2 39:     D@98:<!0:->	MovHint(Check:Untyped:Kill:D@95, MustGen, loc22, R:Stack(loc11), W:SideState, ClobbersExit, bc#16, ExitInvalid)
 45  2 39:    D@102:<!0:->	Throw(Check:Untyped:Kill:D@101, MustGen, R:World,Stack(loc11), W:SideState, Exits, bc#22, ExitValid)
     2 39:   States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated
     2 39:   Live: 
     2 39:   Values: 

       39: GC Values:
       39:     Strong:Cell: 0x79f3e5506600 (%Bd:FunctionExecutable), StructureID: 16778928
       39:     Weak:Object: 0x79f3e5463d00 with butterfly (nil)(base=0xfffffffffffffff8) (Structure %CI:Function), StructureID: 16782960
       39:     Weak:Object: 0x79f3e503b088 with butterfly 0x79f3e5508968(base=0x79f3e5508160) (Structure %BK:global), StructureID: 16800240
       39:     Strong:String (atomic),8Bit:(1),length:(55): Reflect.apply requires the first argument be a function, StructureID: 16777808
       39:     Strong:String (atomic),8Bit:(1),length:(54): Reflect.apply requires the third argument be an object, StructureID: 16777808
       39:     Weak:Object: 0x79f3e5462e20 with butterfly 0x79f3e5457d48(base=0x79f3e5457d20) (Structure %C0:Function), StructureID: 16817968
       39:     Weak:Object: 0x79f3e54ec130 with butterfly (nil)(base=0xfffffffffffffff8) (Structure %D2:JSLexicalEnvironment), StructureID: 16785200
       39:     Strong:String (atomic),8Bit:(1),length:(23): must be called with new, StructureID: 16777808
       39:     Weak:Object: 0x79f3e7040408 with butterfly (nil)(base=0xfffffffffffffff8) (Structure %Eo:JSGlobalLexicalEnvironment), StructureID: 16782624
       39:     Weak:Object: 0x79f3e5463be0 with butterfly (nil)(base=0xfffffffffffffff8) (Structure %BY:Function), StructureID: 16783744
       39:     Strong:String (atomic),8Bit:(1),length:(2): v4, StructureID: 16777808
       39:     Weak:Object: 0x79f3e5488370 with butterfly 0x79f3e5456d08(base=0x79f3e5456ce0) (Structure %BD:Function), StructureID: 16803712
       39:     Weak:Object: 0x79f3e701ac08 with butterfly (nil)(base=0xfffffffffffffff8) (Structure %Ae0:Uint32Array), StructureID: 16803488
       39:     Weak:Cell: 0x79f3e5504b00 (%Bd:FunctionExecutable), StructureID: 16778928
       39: Desired watchpoints:
       39:     Watchpoint sets: 0x79f3e7077600, 0x79f3e7059a80, 0x79f3e7077260, 0x79f3e7077500
       39:     Inline watchpoint sets: 0x79f2010001d8, 0x79f2010008d8, 0x79f201000718, 0x79f2010002b8, 0x79f201001f98, 0x79f2010067e8, 0x79f201001588, 0x79f2010016d8, 0x79f201006708
       39:     SymbolTables: 
       39:     FunctionExecutables: 0x79f3e5506600
       39:     Buffer views: 
       39:     Object property conditions: <Object: 0x79f3e503b088 with butterfly 0x79f3e5508968(base=0x79f3e5508160) (Structure %BK:global), StructureID: 16800240: Equivalence of Uint32Array with Object: 0x79f3e5488370 with butterfly 0x79f3e5456d08(base=0x79f3e5456ce0) (Structure %BD:Function), StructureID: 16803712>
       39: Structures:
       39:     %Ae:Object                     = 0x79f201009910:[0x1009910/16816400, Object, (0/2, 0/0){}, NonArray, Unknown, Proto:0x79f3e547c240, Shady leaf]
       39:     %Ae0:Uint32Array               = 0x79f2010066a0:[0x10066a0/16803488, Uint32Array, (0/0, 0/0){}, NonArray, Unknown, Proto:0x79f3e5484280, Leaf]
       39:     %BD:Function                   = 0x79f201006780:[0x1006780/16803712, Function, (0/0, 4/4){length:64, name:65, prototype:66, BYTES_PER_ELEMENT:67}, NonArray, Unknown, Proto:0x79f3e5488340, Leaf]
       39:     %BK:global                     = 0x79f2010059f0:[0x10059f0/16800240, global, (0/0, 130/256){Object:64, Function:65, Array:66, RegExp:67, Iterator:68, SharedArrayBuffer:69, String:70, Promise:71, BigInt:72, Symbol:73, WeakRef:74, FinalizationRegistry:75, Intl:76, WebAssembly:77, Symbol.toStringTag:78, testLoopCount:79, wasmTestLoopCount:80, atob:81, btoa:82, disassembleBase64:83, debug:84, describe:85, describeArray:86, print:87, printErr:88, prettyPrint:89, quit:90, gc:91, fullGC:92, edenGC:93, gcHeapSize:94, memoryUsageStatistics:95, MemoryFootprint:96, resetMemoryPeak:97, addressOf:98, version:99, run:100, runString:101, load:102, loadString:103, readFile:104, read:105, writeFile:106, write:107, checkSyntax:108, sleepSeconds:109, jscStack:110, openFile:111, readline:112, preciseTime:113, neverInlineFunction:114, noInline:115, noDFG:116, noFTL:117, noOSRExitFuzzing:118, numberOfDFGCompiles:119, callerIsBBQOrOMGCompiled:120, jscOptions:121, optimizeNextInvocation:122, reoptimizationRetryCount:123, transferArrayBuffer:124, failNextNewCodeBlock:125, OSRExit:126, isFinalTier:127, predictInt32:128, isInt32:129, isPureNaN:130, fiatInt52:131, effectful42:132, makeMasquerader:133, hasCustomProperties:134, createGlobalObject:135, createHeapBigInt:136, useBigInt32:137, isBigInt32:138, isHeapBigInt:139, createNonRopeNonAtomString:140, dumpTypesForAllVariables:141, drainMicrotasks:142, setTimeout:143, releaseWeakRefs:144, finalizationRegistryLiveCount:145, finalizationRegistryDeadCount:146, getRandomSeed:147, setRandomSeed:148, isRope:149, callerSourceOrigin:150, is32BitPlatform:151, checkModuleSyntax:152, checkScriptSyntax:153, platformSupportsSamplingProfiler:154, generateHeapSnapshot:155, generateHeapSnapshotForGCDebugging:156, resetSuperSamplerState:157, ensureArrayStorage:158, startSamplingProfiler:159, samplingProfilerStackTraces:160, maxArguments:161, asyncTestStart:162, asyncTestPassed:163, WebAssemblyMemoryMode:164, createWebAssemblyMemoryWithMode:165, console:166, $:167, $262:168, waiterListSize:169, waitForReport:170, heapCapacity:171, flashHeapAccess:172, disableRichSourceInfo:173, mallocInALoop:174, totalCompileTime:175, setUnhandledRejectionCallback:176, asDoubleNumber:177, dropAllLocks:178, performance:179, fuzzilli:180, Uint32Array:181, Float64Array:182, Uint8ClampedArray:183, WeakSet:184, Int8Array:185, Map:186, Proxy:187, Set:188, JSON:189, parseInt:190, Number:191, Math:192, Reflect:193}, NonArray, ChangePrototype, Proto:0x79f3e70083d8, Dictionary, Leaf (Watched)]
       39:     %BY:Function                   = 0x79f201001980:[0x1001980/16783744, Function, (0/0, 0/0){}, NonArray, Unknown, Proto:0x79f3e70185c8, Shady leaf]
       39:     %Bd:FunctionExecutable         = 0x79f2010006b0:[0x10006b0/16778928, FunctionExecutable, (0/0, 0/0){}, NonArray, Unknown, Leaf (Watched)]
       39:     %C0:Function                   = 0x79f201009f30:[0x1009f30/16817968, Function, (0/0, 3/4){prototype:64, length:65, name:66}, NonArray, PropertyAddition, Proto:0x79f3e70185c8, Leaf]
       39:     %C2:string                     = 0x79f201000250:[0x1000250/16777808, string, (0/0, 0/0){}, NonArray, Unknown, Leaf (Watched)]
       39:     %CI:Function                   = 0x79f201001670:[0x1001670/16782960, Function, (0/0, 0/0){}, NonArray, Unknown, Proto:0x79f3e70185c8, Leaf (Watched)]
       39:     %D2:JSLexicalEnvironment       = 0x79f201001f30:[0x1001f30/16785200, JSLexicalEnvironment, (0/0, 0/0){}, NonArray, Unknown, Leaf (Watched)]
       39:     %Eo:JSGlobalLexicalEnvironment = 0x79f201001520:[0x1001520/16782624, JSGlobalLexicalEnvironment, (0/0, 0/0){}, NonArray, Unknown, Leaf]


DFG ASSERTION FAILED: heapPair.value.hasNode()
/home/turnerhackz1/Desktop/WebKitTest/Source/JavaScriptCore/dfg/DFGAvailabilityMap.cpp(109) : void JSC::DFG::AvailabilityMap::validateAvailability(Graph &, Node *) const
Aborted (core dumped)
"

[Radar WebKit Bug Importer]

<rdar://problem/167179244>

A more simpler POC to trigger assertion failure is "
function F0(a2, ...a3) {
    if (!new.target) { throw 'must be called with new'; }
}
class C4 extends F0 {
}
const v5 = new C4();
const v6 = new C4();
const v7 = new C4();
const v8 = new C4();
"

(In reply to bigsean123 from comment #0)
> Created attachment 477847 [details]
> check out assertion failure
> 
> While fuzzying i came across this sample triggering "DFG ASSERTION FAILED:
> heapPair.value.hasNode()",  with said flaky.js file. i narrowed down the
> sample and cant seem to get it to trigger without
> "--validateFTLOSRExitLiveness=false --forceEagerCompilation=true" passed to
> jsc binary.
> 
> "turnerhackz1@turnerhackz1-Aspire-A315-24P:~/Desktop/WebKitTest$ git
> describe --tags
> WebKit-7623.1.14.14.11
> turnerhackz1@turnerhackz1-Aspire-A315-24P:~/Desktop/WebKitTest$ git
> rev-parse HEAD
> 7732a1acb12f1f24f7e32a501947a0c76d4b9492
> " shows the current tag for build.
> 
> 
> Last comments running sample as follows produces this output 
> 
> "turnerhackz1@turnerhackz1-Aspire-A315-24P:~/Desktop/fuzzilli-main$
> '/home/turnerhackz1/Desktop/WebKitTest/WebKitBuild/JSCOnly/Release/bin/jsc'
> --validateFTLOSRExitLiveness=true --forceEagerCompilation=true
> /home/turnerhackz1/Desktop/ggzfuzz/crashes/program_20251225112142_3329D242-
> E1C5-4410-BB1A-31200A461B9B_flaky.js 
> Fuzzer output channel not available, printing to stdout instead.
> EXPLORE_ACTION:
> {"operation":"CALL_METHOD","inputs":[{"special":{"name":"exploredValue"}},
> {"string":{"value":"constructor"}}],"isGuarded":true,"id":"v4"}
> EXPLORE_ACTION:
> {"operation":"BITWISE_AND","inputs":[{"special":{"name":"exploredValue"}},
> {"argument":{"index":1}}],"isGuarded":false,"id":"v11"}
> EXPLORE_ACTION:
> {"operation":"GET_PROPERTY","inputs":[{"special":{"name":"exploredValue"}},
> {"int":{"value":1}}],"isGuarded":false,"id":"v15"}
> DFG ASSERTION FAILED: heapPair.value.hasNode()
> /home/turnerhackz1/Desktop/WebKitTest/Source/JavaScriptCore/dfg/
> DFGAvailabilityMap.cpp(109) : void
> JSC::DFG::AvailabilityMap::validateAvailability(Graph &, Node *) const
> 
> While handling node D@95
> 
> Graph at time of failure:
> 
>        39: DFG for
> apply#BWaJWD:[0x79f3e55773c0->0x79f3e54ebf20->0x79f3e5506600,
> DFGFunctionCall, 35 (DidTryToEnterInLoop) (StrictMode)]:
>        39:   Fixpoint state: FixpointNotConverged; Form: SSA; Unification
> state: GloballyUnified; Ref count state: EverythingIsLive
>        39:   Argument formats for entrypoint index: 0 : FlushedJSValue,
> FlushedCell, FlushedCell, FlushedJSValue
> 
>      0 39: Block #0 (bc#0): (OSR target)
>      0 39:   Execution count: 1.000000
>      0 39:   Predecessors:
>      0 39:   Successors: #2 #1
>      0 39:   Dominated by: #0
>      0 39:   Dominates: #0 #1 #2
>      0 39:   Dominance Frontier: 
>      0 39:   Iterated Dominance Frontier: 
>      0 39:   States: StructuresAreWatched
>      0 39:   Live: 
>      0 39:   Values: 
>   0  0 39:    D@4:< 12:->	JSConstant(JS|PureInt, Other, Undefined, bc#0,
> ExitValid)
>   1  0 39:   D@17:< 1:->	JSConstant(JS|PureInt, Function, Weak:Object:
> 0x79f3e5463d00 with butterfly (nil)(base=0xfffffffffffffff8) (Structure
> %CI:Function), StructureID: 16782960, bc#0, ExitValid)
>   2  0 39:   D@82:< 0:->	JSConstant(JS|PureInt, Function, Weak:Object:
> 0x79f3e5462e20 with butterfly 0x79f3e5457d48(base=0x79f3e5457d20) (Structure
> %C0:Function), StructureID: 16817968, bc#0, ExitValid)
>   3  0 39:   D@31:< 1:->
> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther,
> StringIdent, Strong:String (atomic),8Bit:(1),length:(55): Reflect.apply
> requires the first argument be a function, StructureID: 16777808, bc#0,
> ExitValid)
>   4  0 39:   D@18:< 1:->	JSConstant(JS|PureInt, OtherObj, Weak:Object:
> 0x79f3e503b088 with butterfly 0x79f3e5508968(base=0x79f3e5508160) (Structure
> %BK:global), StructureID: 16800240, bc#0, ExitValid)
>   5  0 39:  D@101:< 1:->
> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther,
> StringIdent, Strong:String (atomic),8Bit:(1),length:(23): must be called
> with new, StructureID: 16777808, bc#0, ExitValid)
>   6  0 39:   D@89:< 1:->	JSConstant(JS|PureInt, Empty, <JSValue()>, bc#0,
> ExitValid)
>   7  0 39:   D@83:< 1:->
> JSConstant(JS|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, OtherObj,
> Weak:Object: 0x79f3e54ec130 with butterfly (nil)(base=0xfffffffffffffff8)
> (Structure %D2:JSLexicalEnvironment), StructureID: 16785200, bc#0, ExitValid)
>   8  0 39:   D@38:< 1:->
> JSConstant(Boolean|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, Bool,
> True, bc#0, ExitValid)
>   9  0 39:   D@59:<!0:->	ExitOK(MustGen, W:SideState, bc#0, ExitValid)
>  10  0 39:  D@109:<!0:->	InitializeEntrypointArguments(MustGen, W:SideState,
> ClobbersExit, bc#0, ExitValid)
>  11  0 39:  D@121:<!0:->	ExitOK(MustGen, W:SideState, bc#0, ExitValid)
>  12  0 39:  D@123:< 0:->	GetStack(JS|PureInt, OtherObj, this,
> FlushedJSValue, R:Stack(this), bc#0, ExitValid)
>  13  0 39:  D@100:< 4:->	GetStack(JS|PureInt, Function, arg1, FlushedCell,
> R:Stack(arg1), bc#0, ExitValid)
>  14  0 39:   D@86:< 5:->	GetStack(JS|PureInt, Final|GlobalProxy, arg2,
> FlushedCell, R:Stack(arg2), bc#0, ExitValid)
>  15  0 39:  D@114:<!0:->	AssertNotEmpty(Check:Untyped:D@86, MustGen,
> W:SideState, Exits, bc#0, ExitValid)
>  16  0 39:  D@115:<!0:->	CheckStructure(Cell:D@86, MustGen, [%Ae:Object],
> R:JSCell_structureID, Exits, bc#0, ExitValid)
>  17  0 39:   D@64:< 3:->	GetStack(JS|PureInt, Array|DirectArguments, arg3,
> FlushedJSValue, R:Stack(arg3), bc#0, ExitValid)
>  18  0 39:   D@58:<!0:->	KillStack(MustGen, loc0, W:Stack(loc0),
> ClobbersExit, bc#0, ExitValid)
>  19  0 39:    D@5:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc0,
> W:SideState, ClobbersExit, bc#0, ExitInvalid)
>  20  0 39:   D@41:<!0:->	KillStack(MustGen, loc1, W:Stack(loc1),
> ClobbersExit, bc#0, ExitInvalid)
>  21  0 39:    D@7:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc1,
> W:SideState, ClobbersExit, bc#0, ExitInvalid)
>  22  0 39:   D@23:<!0:->	KillStack(MustGen, loc2, W:Stack(loc2),
> ClobbersExit, bc#0, ExitInvalid)
>  23  0 39:    D@9:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc2,
> W:SideState, ClobbersExit, bc#0, ExitInvalid)
>  24  0 39:  D@127:<!0:->	KillStack(MustGen, loc3, W:Stack(loc3),
> ClobbersExit, bc#0, ExitInvalid)
>  25  0 39:   D@11:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc3,
> W:SideState, ClobbersExit, bc#0, ExitInvalid)
>  26  0 39:  D@126:<!0:->	KillStack(MustGen, loc4, W:Stack(loc4),
> ClobbersExit, bc#0, ExitInvalid)
>  27  0 39:   D@13:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc4,
> W:SideState, ClobbersExit, bc#0, ExitInvalid)
>  28  0 39:  D@125:<!0:->	KillStack(MustGen, loc5, W:Stack(loc5),
> ClobbersExit, bc#0, ExitInvalid)
>  29  0 39:   D@15:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc5,
> W:SideState, ClobbersExit, bc#0, ExitInvalid)
>  30  0 39:  D@124:<!0:->	KillStack(MustGen, loc4, W:Stack(loc4),
> ClobbersExit, bc#0, ExitInvalid)
>  31  0 39:   D@19:<!0:->	MovHint(Check:Untyped:Kill:D@18, MustGen, loc4,
> W:SideState, ClobbersExit, bc#0, ExitInvalid)
>  32  0 39:   D@20:<!0:->	ExitOK(MustGen, W:SideState, bc#0, ExitValid)
>  33  0 39:   D@21:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits,
> bc#0, ExitValid)
>  34  0 39:  D@110:<!0:->	KillStack(MustGen, loc5, W:Stack(loc5),
> ClobbersExit, bc#1, ExitValid)
>  35  0 39:   D@24:<!0:->	MovHint(Check:Untyped:Kill:D@17, MustGen, loc5,
> W:SideState, ClobbersExit, bc#1, ExitInvalid)
>  36  0 39:   D@27:< 2:->	IsCallable(Check:Untyped:D@100,
> Boolean|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, Bool,
> R:MiscFields, Exits, bc#4, ExitValid)
>  37  0 39:  D@111:<!0:->	KillStack(MustGen, loc6, W:Stack(loc6),
> ClobbersExit, bc#4, ExitValid)
>  38  0 39:   D@28:<!0:->	MovHint(Check:Untyped:D@27, MustGen, loc6,
> W:SideState, ClobbersExit, bc#4, ExitInvalid)
>  39  0 39:   D@30:<!0:->	Branch(KnownBoolean:Kill:D@27, MustGen,
> T:#2/w:1.000000, F:#1/w:1.000000, W:SideState, bc#7, ExitValid)
>      0 39:   States: TakeBoth, StructuresAreWatched
>      0 39:   Live: D@4, D@31, D@38, D@64, D@83, D@86, D@89, D@100, D@101
>      0 39:   Values: D@4=>(Other, Undefined, 1:StructuresAreWatched),
> D@31=>(StringIdent, NonArray, [%C2:string], String
> (atomic),8Bit:(1),length:(55): Reflect.apply requires the first argument be
> a function, StructureID: 16777808, 1:StructuresAreWatched), D@38=>(Bool,
> True, 1:StructuresAreWatched), D@64=>(BytecodeTop, TOP, TOP,
> 1:StructuresAreWatched), D@83=>(OtherObj, NonArray,
> [%D2:JSLexicalEnvironment], Object: 0x79f3e54ec130 with butterfly
> (nil)(base=0xfffffffffffffff8) (Structure %D2:JSLexicalEnvironment),
> StructureID: 16785200, 1:StructuresAreWatched), D@86=>(Final, NonArray,
> [%Ae:Object], 1:StructuresAreWatched), D@89=>(Empty,
> 1:StructuresAreWatched), D@100=>(Cell|Empty, TOP, TOP,
> 1:StructuresAreWatched), D@101=>(StringIdent, NonArray, [%C2:string], String
> (atomic),8Bit:(1),length:(23): must be called with new, StructureID:
> 16777808, 1:StructuresAreWatched)
> 
>      1 39: Block #1 (bc#10):
>      1 39:   Execution count: 1.000000
>      1 39:   Predecessors: #0
>      1 39:   Successors:
>      1 39:   Dominated by: #0 #1
>      1 39:   Dominates: #1
>      1 39:   Dominance Frontier: 
>      1 39:   Iterated Dominance Frontier: 
>      1 39:   States: StructuresAreWatched
>      1 39:   Live: D@31
>      1 39:   Values: D@31=>(StringIdent, NonArray, [%C2:string], String
> (atomic),8Bit:(1),length:(55): Reflect.apply requires the first argument be
> a function, StructureID: 16777808, 1:StructuresAreWatched)
>   0  1 39:    D@0:<!0:->	ExitOK(MustGen, W:SideState, bc#10, ExitValid)
>   1  1 39:   D@32:<!0:->	ThrowStaticError(String:Kill:D@31, MustGen,
> R:World, W:SideState, Exits, bc#10, ExitValid)
>      1 39:   States: InvalidBranchDirection, StructuresAreWatched,
> CFAInvalidated
>      1 39:   Live: 
>      1 39:   Values: 
> 
>      2 39: Block #2 (bc#13):
>      2 39:   Execution count: 1.000000
>      2 39:   Predecessors: #0
>      2 39:   Successors:
>      2 39:   Dominated by: #0 #2
>      2 39:   Dominates: #2
>      2 39:   Dominance Frontier: 
>      2 39:   Iterated Dominance Frontier: 
>      2 39:   States: StructuresAreWatched
>      2 39:   Live: D@4, D@38, D@64, D@83, D@86, D@89, D@100, D@101
>      2 39:   Values: D@4=>(Other, Undefined, 1:StructuresAreWatched),
> D@38=>(Bool, True, 1:StructuresAreWatched), D@64=>(BytecodeTop, TOP, TOP,
> 1:StructuresAreWatched), D@83=>(OtherObj, NonArray,
> [%D2:JSLexicalEnvironment], Object: 0x79f3e54ec130 with butterfly
> (nil)(base=0xfffffffffffffff8) (Structure %D2:JSLexicalEnvironment),
> StructureID: 16785200, 1:StructuresAreWatched), D@86=>(Final, NonArray,
> [%Ae:Object], 1:StructuresAreWatched), D@89=>(Empty,
> 1:StructuresAreWatched), D@100=>(Cell|Empty, TOP, TOP,
> 1:StructuresAreWatched), D@101=>(StringIdent, NonArray, [%C2:string], String
> (atomic),8Bit:(1),length:(23): must be called with new, StructureID:
> 16777808, 1:StructuresAreWatched)
>   0  2 39:  D@112:<!0:->	ExitOK(MustGen, W:SideState, bc#13, ExitValid)
>   1  2 39:  D@119:<!0:->	Check(Check:Object:D@64, MustGen, Exits, bc#13,
> ExitValid)
>   2  2 39:  D@113:<!0:->	KillStack(MustGen, loc6, W:Stack(loc6),
> ClobbersExit, bc#13, ExitValid)
>   3  2 39:   D@39:<!0:->	MovHint(Check:Untyped:Kill:D@38, MustGen, loc6,
> W:SideState, ClobbersExit, bc#13, ExitInvalid)
>   4  2 39:  D@116:<!0:->	KillStack(MustGen, loc7, W:Stack(loc7),
> ClobbersExit, bc#22, ExitValid)
>   5  2 39:   D@49:<!0:->	MovHint(Check:Untyped:D@100, MustGen, loc7,
> W:SideState, ClobbersExit, bc#22, ExitInvalid)
>   6  2 39:   D@55:<!0:->	FilterCallLinkStatus(Check:Untyped:D@100, MustGen,
> (Function: Object: 0x79f3e5462e20 with butterfly
> 0x79f3e5457d48(base=0x79f3e5457d20) (Structure
> 0x79f201009f30:[0x1009f30/16817968, Function, (0/0, 3/4){prototype:64,
> length:65, name:66}, NonArray, PropertyAddition, Proto:0x79f3e70185c8,
> Leaf]), StructureID: 16817968; Executable:
> F3#Besus2:[0x79f3e55741e0->0x79f3e5475900, BaselineFunctionCall, 131
> (ShouldAlwaysBeInlined)]/F3#Besus3:[0x79f3e54e8e20->0x79f3e5475900,
> BaselineFunctionConstruct, 134]), W:SideState, bc#25, ExitValid)
>   7  2 39:   D@57:<!0:->	CheckIsConstant(Cell:Kill:D@100, MustGen,
> <0x79f3e5462e20, Function>, F3#Besus2/Besus3:[0x79f3e5475900], Exits, bc#25,
> ExitValid)
>   8  2 39:   D@60:<!2:->	VarargsLength(Check:Untyped:D@64,
> Int32|MustGen|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther, start =
> loc9, count = loc11, offset = 0, mandatoryMinimum = 0, limit = 1, R:World,
> W:Heap, Exits, ClobbersExit, bc#25, ExitValid)
>   9  2 39:  D@120:<!0:->	KillStack(MustGen, tmp0, W:Stack(tmp0),
> ClobbersExit, bc#25, ExitInvalid)
>  10  2 39:   D@61:<!0:->	MovHint(Check:Untyped:D@60, MustGen, tmp0,
> W:SideState, ClobbersExit, bc#25, ExitInvalid)
>  11  2 39:  D@118:<!0:->	InvalidationPoint(MustGen, W:SideState, Exits,
> bc#25, exit: bc#25cp#1, ExitValid)
>  12  2 39:   D@63:<!0:->	LoadVarargs(KnownInt32:Kill:D@60,
> Check:Untyped:Kill:D@64, MustGen, start = loc9, count = loc11, offset = 0,
> mandatoryMinimum = 0, limit = 1, R:World, W:Stack(loc11),Stack(loc9),Heap,
> Exits, ClobbersExit, bc#25cp#1, ExitValid)
>  13  2 39:  D@122:< 0:->	GetStack(JS|PureInt, Int32, loc11, FlushedInt32,
> R:Stack(loc11), bc#25cp#1, ExitInvalid)
>  14  2 39:  D@128:<!0:->	KillStack(MustGen, loc10, W:Stack(loc10),
> ClobbersExit, bc#25cp#1, ExitInvalid)
>  15  2 39:   D@66:<!0:->	MovHint(Check:Untyped:D@86, MustGen, loc10,
> W:SideState, ClobbersExit, bc#25cp#1, ExitInvalid)
>      2 39:   --> F3#Besus2:<0x79f3e55741e0, bc#25cp#1, TailCallVarargs,
> known callee: Object: 0x79f3e5462e20 with butterfly
> 0x79f3e5457d48(base=0x79f3e5457d20) (Structure %C0:Function), StructureID:
> 16817968, numArgs+this = 1, numFixup = 0, stackOffset = -16 (loc0 maps to
> loc16)>
>  16  2 39:    D@117:<!0:->	InvalidationPoint(MustGen, R:Stack(loc11),
> W:SideState, Exits, bc#0, ExitValid)
>  17  2 39:     D@68:<!0:->	ExitOK(MustGen, R:Stack(loc11), W:SideState,
> bc#0, ExitValid)
>  18  2 39:    D@108:<!0:->	KillStack(MustGen, loc16, R:Stack(loc11),
> W:Stack(loc16), ClobbersExit, bc#0, ExitValid)
>  19  2 39:     D@70:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc16,
> R:Stack(loc11), W:SideState, ClobbersExit, bc#0, ExitInvalid)
>  20  2 39:    D@107:<!0:->	KillStack(MustGen, loc17, R:Stack(loc11),
> W:Stack(loc17), ClobbersExit, bc#0, ExitInvalid)
>  21  2 39:     D@72:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc17,
> R:Stack(loc11), W:SideState, ClobbersExit, bc#0, ExitInvalid)
>  22  2 39:    D@106:<!0:->	KillStack(MustGen, loc18, R:Stack(loc11),
> W:Stack(loc18), ClobbersExit, bc#0, ExitInvalid)
>  23  2 39:     D@74:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc18,
> R:Stack(loc11), W:SideState, ClobbersExit, bc#0, ExitInvalid)
>  24  2 39:    D@105:<!0:->	KillStack(MustGen, loc19, R:Stack(loc11),
> W:Stack(loc19), ClobbersExit, bc#0, ExitInvalid)
>  25  2 39:     D@76:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc19,
> R:Stack(loc11), W:SideState, ClobbersExit, bc#0, ExitInvalid)
>  26  2 39:    D@104:<!0:->	KillStack(MustGen, loc20, R:Stack(loc11),
> W:Stack(loc20), ClobbersExit, bc#0, ExitInvalid)
>  27  2 39:     D@78:<!0:->	MovHint(Check:Untyped:D@4, MustGen, loc20,
> R:Stack(loc11), W:SideState, ClobbersExit, bc#0, ExitInvalid)
>  28  2 39:    D@103:<!0:->	KillStack(MustGen, loc21, R:Stack(loc11),
> W:Stack(loc21), ClobbersExit, bc#0, ExitInvalid)
>  29  2 39:     D@80:<!0:->	MovHint(Check:Untyped:Kill:D@4, MustGen, loc21,
> R:Stack(loc11), W:SideState, ClobbersExit, bc#0, ExitInvalid)
>  30  2 39:     D@99:<!0:->	KillStack(MustGen, loc20, R:Stack(loc11),
> W:Stack(loc20), ClobbersExit, bc#0, ExitInvalid)
>  31  2 39:     D@84:<!0:->	MovHint(Check:Untyped:Kill:D@83, MustGen, loc20,
> R:Stack(loc11), W:SideState, ClobbersExit, bc#0, ExitInvalid)
>  32  2 39:     D@85:<!0:->	ExitOK(MustGen, R:Stack(loc11), W:SideState,
> bc#0, ExitValid)
>  33  2 39:     D@88:<!0:->	CheckStructure(Cell:D@86, MustGen, [%Ae:Object],
> R:Stack(loc11),JSCell_structureID, Exits, bc#1, ExitValid)
>  34  2 39:     D@97:<!0:->	KillStack(MustGen, loc22, R:Stack(loc11),
> W:Stack(loc22), ClobbersExit, bc#6, ExitValid)
>  35  2 39:     D@90:<!0:->	MovHint(Check:Untyped:Kill:D@89, MustGen, loc22,
> R:Stack(loc11), W:SideState, ClobbersExit, bc#6, ExitInvalid)
>  36  2 39:     D@69:<!0:->	PutStack(Check:Untyped:Kill:D@86, MustGen, loc10,
> FlushedJSValue, R:Stack(loc11), W:Stack(loc10), bc#9, ExitValid)
>  37  2 39:     D@92:< 1:->
> GetRestLength(Int32|PureNum|NeedsNegZero|NeedsNaNOrInfinity|UseAsOther,
> Int32, numberOfArgumentsToSkip = 0, R:Stack,Stack(loc11), bc#9, ExitValid)
>  38  2 39:      D@3:<!0:->	KillStack(MustGen, loc25, R:Stack(loc11),
> W:Stack(loc25), ClobbersExit, bc#9, ExitValid)
>  39  2 39:     D@93:<!0:->	MovHint(Check:Untyped:Kill:D@92, MustGen, loc25,
> R:Stack(loc11), W:SideState, ClobbersExit, bc#9, ExitInvalid)
>  40  2 39:     D@95:<!2:->	PhantomCreateRest(JS|MustGen|PureInt, Array,
> numberOfArgumentsToSkip = 0, R:Stack(loc11),HeapObjectCount,
> W:HeapObjectCount, Exits, bc#12, ExitValid)
>  41  2 39:      D@2:<!0:->	KillStack(MustGen, loc24, R:Stack(loc11),
> W:Stack(loc24), ClobbersExit, bc#12, ExitValid)
>  42  2 39:     D@96:<!0:->	MovHint(Check:Untyped:D@95, MustGen, loc24,
> R:Stack(loc11), W:SideState, ClobbersExit, bc#12, ExitInvalid)
>  43  2 39:      D@1:<!0:->	KillStack(MustGen, loc22, R:Stack(loc11),
> W:Stack(loc22), ClobbersExit, bc#16, ExitValid)
>  44  2 39:     D@98:<!0:->	MovHint(Check:Untyped:Kill:D@95, MustGen, loc22,
> R:Stack(loc11), W:SideState, ClobbersExit, bc#16, ExitInvalid)
>  45  2 39:    D@102:<!0:->	Throw(Check:Untyped:Kill:D@101, MustGen,
> R:World,Stack(loc11), W:SideState, Exits, bc#22, ExitValid)
>      2 39:   States: InvalidBranchDirection, StructuresAreWatched,
> CFAInvalidated
>      2 39:   Live: 
>      2 39:   Values: 
> 
>        39: GC Values:
>        39:     Strong:Cell: 0x79f3e5506600 (%Bd:FunctionExecutable),
> StructureID: 16778928
>        39:     Weak:Object: 0x79f3e5463d00 with butterfly
> (nil)(base=0xfffffffffffffff8) (Structure %CI:Function), StructureID:
> 16782960
>        39:     Weak:Object: 0x79f3e503b088 with butterfly
> 0x79f3e5508968(base=0x79f3e5508160) (Structure %BK:global), StructureID:
> 16800240
>        39:     Strong:String (atomic),8Bit:(1),length:(55): Reflect.apply
> requires the first argument be a function, StructureID: 16777808
>        39:     Strong:String (atomic),8Bit:(1),length:(54): Reflect.apply
> requires the third argument be an object, StructureID: 16777808
>        39:     Weak:Object: 0x79f3e5462e20 with butterfly
> 0x79f3e5457d48(base=0x79f3e5457d20) (Structure %C0:Function), StructureID:
> 16817968
>        39:     Weak:Object: 0x79f3e54ec130 with butterfly
> (nil)(base=0xfffffffffffffff8) (Structure %D2:JSLexicalEnvironment),
> StructureID: 16785200
>        39:     Strong:String (atomic),8Bit:(1),length:(23): must be called
> with new, StructureID: 16777808
>        39:     Weak:Object: 0x79f3e7040408 with butterfly
> (nil)(base=0xfffffffffffffff8) (Structure %Eo:JSGlobalLexicalEnvironment),
> StructureID: 16782624
>        39:     Weak:Object: 0x79f3e5463be0 with butterfly
> (nil)(base=0xfffffffffffffff8) (Structure %BY:Function), StructureID:
> 16783744
>        39:     Strong:String (atomic),8Bit:(1),length:(2): v4, StructureID:
> 16777808
>        39:     Weak:Object: 0x79f3e5488370 with butterfly
> 0x79f3e5456d08(base=0x79f3e5456ce0) (Structure %BD:Function), StructureID:
> 16803712
>        39:     Weak:Object: 0x79f3e701ac08 with butterfly
> (nil)(base=0xfffffffffffffff8) (Structure %Ae0:Uint32Array), StructureID:
> 16803488
>        39:     Weak:Cell: 0x79f3e5504b00 (%Bd:FunctionExecutable),
> StructureID: 16778928
>        39: Desired watchpoints:
>        39:     Watchpoint sets: 0x79f3e7077600, 0x79f3e7059a80,
> 0x79f3e7077260, 0x79f3e7077500
>        39:     Inline watchpoint sets: 0x79f2010001d8, 0x79f2010008d8,
> 0x79f201000718, 0x79f2010002b8, 0x79f201001f98, 0x79f2010067e8,
> 0x79f201001588, 0x79f2010016d8, 0x79f201006708
>        39:     SymbolTables: 
>        39:     FunctionExecutables: 0x79f3e5506600
>        39:     Buffer views: 
>        39:     Object property conditions: <Object: 0x79f3e503b088 with
> butterfly 0x79f3e5508968(base=0x79f3e5508160) (Structure %BK:global),
> StructureID: 16800240: Equivalence of Uint32Array with Object:
> 0x79f3e5488370 with butterfly 0x79f3e5456d08(base=0x79f3e5456ce0) (Structure
> %BD:Function), StructureID: 16803712>
>        39: Structures:
>        39:     %Ae:Object                     =
> 0x79f201009910:[0x1009910/16816400, Object, (0/2, 0/0){}, NonArray, Unknown,
> Proto:0x79f3e547c240, Shady leaf]
>        39:     %Ae0:Uint32Array               =
> 0x79f2010066a0:[0x10066a0/16803488, Uint32Array, (0/0, 0/0){}, NonArray,
> Unknown, Proto:0x79f3e5484280, Leaf]
>        39:     %BD:Function                   =
> 0x79f201006780:[0x1006780/16803712, Function, (0/0, 4/4){length:64, name:65,
> prototype:66, BYTES_PER_ELEMENT:67}, NonArray, Unknown,
> Proto:0x79f3e5488340, Leaf]
>        39:     %BK:global                     =
> 0x79f2010059f0:[0x10059f0/16800240, global, (0/0, 130/256){Object:64,
> Function:65, Array:66, RegExp:67, Iterator:68, SharedArrayBuffer:69,
> String:70, Promise:71, BigInt:72, Symbol:73, WeakRef:74,
> FinalizationRegistry:75, Intl:76, WebAssembly:77, Symbol.toStringTag:78,
> testLoopCount:79, wasmTestLoopCount:80, atob:81, btoa:82,
> disassembleBase64:83, debug:84, describe:85, describeArray:86, print:87,
> printErr:88, prettyPrint:89, quit:90, gc:91, fullGC:92, edenGC:93,
> gcHeapSize:94, memoryUsageStatistics:95, MemoryFootprint:96,
> resetMemoryPeak:97, addressOf:98, version:99, run:100, runString:101,
> load:102, loadString:103, readFile:104, read:105, writeFile:106, write:107,
> checkSyntax:108, sleepSeconds:109, jscStack:110, openFile:111, readline:112,
> preciseTime:113, neverInlineFunction:114, noInline:115, noDFG:116,
> noFTL:117, noOSRExitFuzzing:118, numberOfDFGCompiles:119,
> callerIsBBQOrOMGCompiled:120, jscOptions:121, optimizeNextInvocation:122,
> reoptimizationRetryCount:123, transferArrayBuffer:124,
> failNextNewCodeBlock:125, OSRExit:126, isFinalTier:127, predictInt32:128,
> isInt32:129, isPureNaN:130, fiatInt52:131, effectful42:132,
> makeMasquerader:133, hasCustomProperties:134, createGlobalObject:135,
> createHeapBigInt:136, useBigInt32:137, isBigInt32:138, isHeapBigInt:139,
> createNonRopeNonAtomString:140, dumpTypesForAllVariables:141,
> drainMicrotasks:142, setTimeout:143, releaseWeakRefs:144,
> finalizationRegistryLiveCount:145, finalizationRegistryDeadCount:146,
> getRandomSeed:147, setRandomSeed:148, isRope:149, callerSourceOrigin:150,
> is32BitPlatform:151, checkModuleSyntax:152, checkScriptSyntax:153,
> platformSupportsSamplingProfiler:154, generateHeapSnapshot:155,
> generateHeapSnapshotForGCDebugging:156, resetSuperSamplerState:157,
> ensureArrayStorage:158, startSamplingProfiler:159,
> samplingProfilerStackTraces:160, maxArguments:161, asyncTestStart:162,
> asyncTestPassed:163, WebAssemblyMemoryMode:164,
> createWebAssemblyMemoryWithMode:165, console:166, $:167, $262:168,
> waiterListSize:169, waitForReport:170, heapCapacity:171,
> flashHeapAccess:172, disableRichSourceInfo:173, mallocInALoop:174,
> totalCompileTime:175, setUnhandledRejectionCallback:176, asDoubleNumber:177,
> dropAllLocks:178, performance:179, fuzzilli:180, Uint32Array:181,
> Float64Array:182, Uint8ClampedArray:183, WeakSet:184, Int8Array:185,
> Map:186, Proxy:187, Set:188, JSON:189, parseInt:190, Number:191, Math:192,
> Reflect:193}, NonArray, ChangePrototype, Proto:0x79f3e70083d8, Dictionary,
> Leaf (Watched)]
>        39:     %BY:Function                   =
> 0x79f201001980:[0x1001980/16783744, Function, (0/0, 0/0){}, NonArray,
> Unknown, Proto:0x79f3e70185c8, Shady leaf]
>        39:     %Bd:FunctionExecutable         =
> 0x79f2010006b0:[0x10006b0/16778928, FunctionExecutable, (0/0, 0/0){},
> NonArray, Unknown, Leaf (Watched)]
>        39:     %C0:Function                   =
> 0x79f201009f30:[0x1009f30/16817968, Function, (0/0, 3/4){prototype:64,
> length:65, name:66}, NonArray, PropertyAddition, Proto:0x79f3e70185c8, Leaf]
>        39:     %C2:string                     =
> 0x79f201000250:[0x1000250/16777808, string, (0/0, 0/0){}, NonArray, Unknown,
> Leaf (Watched)]
>        39:     %CI:Function                   =
> 0x79f201001670:[0x1001670/16782960, Function, (0/0, 0/0){}, NonArray,
> Unknown, Proto:0x79f3e70185c8, Leaf (Watched)]
>        39:     %D2:JSLexicalEnvironment       =
> 0x79f201001f30:[0x1001f30/16785200, JSLexicalEnvironment, (0/0, 0/0){},
> NonArray, Unknown, Leaf (Watched)]
>        39:     %Eo:JSGlobalLexicalEnvironment =
> 0x79f201001520:[0x1001520/16782624, JSGlobalLexicalEnvironment, (0/0,
> 0/0){}, NonArray, Unknown, Leaf]
> 
> 
> DFG ASSERTION FAILED: heapPair.value.hasNode()
> /home/turnerhackz1/Desktop/WebKitTest/Source/JavaScriptCore/dfg/
> DFGAvailabilityMap.cpp(109) : void
> JSC::DFG::AvailabilityMap::validateAvailability(Graph &, Node *) const
> Aborted (core dumped)
> "

[Keith Miller]

Pull request: https://github.com/WebKit/WebKit/pull/57053

[EWS]

Committed 306033@main (77c9af245a2e): <https://commits.webkit.org/306033@main>

Reviewed commits have been landed. Closing PR #57053 and removing active labels.