[Webkit-unassigned] [Bug 87994] ASSERTION FAILED: m_refCount in DFG::Node:deref with patch from 87158

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=87994





--- Comment #4 from Andy Wingo <wingo at igalia.com>  2012-06-05 07:46:35 PST ---
For the record, the dataflow dump output for block 10.

Block #10 (bc#185):  (skipped) (OSR target)
  Predecessors:
  Phi Nodes:
 123:           < 1:->    Phi(, r4(HK<Array>))  predicting Array, double ratio 0.000000
 126:           < 1:->    Phi(, r5(VC<Int32>))  predicting Int, double ratio 0.000000
 129:           < 1:->    Phi(, r1(HG<Int32>))  predicting Int, double ratio 0.000000
 133:           < 1:->    Phi(, r3(BL<Int32>))  predicting Int, double ratio 0.000000
 138:           < 1:->    Phi(, r0(KI<Array>))  predicting Array, double ratio 0.000000
 864:  skipped  < 0:->    Phi(@864, , r2(CB<Int32>))
 897:           < 1:->    Phi(@897, , arg0(GL<Final>))  predicting Final, double ratio 0.000000
 159:  skipped  < 0:->    Phi(@126, , r5(VC<Int32>))
 164:  skipped  < 0:->    Phi(@133, , r3(BL<Int32>))
 813:  skipped  < 0:->    Phi(@138, , r0(KI<Array>))
 846:  skipped  < 0:->    Phi(@129, , r1(HG<Int32>))
 856:  skipped  < 0:->    Phi(@123, , r4(HK<Array>))
 863:  skipped  < 0:->    Phi(@864, , r2(CB<Int32>))
 896:  skipped  < 0:->    Phi(@897, , arg0(GL<Final>))
  vars before: <empty>
  var links: @897 : @139 @130 @864 @134 @124 @127 - - - - - - - - - - - - - - - - - - - - - - - - -
 122:           <!0:->    Phantom(MustGenerate)
 124:           < 2:->    GetLocal(@123, ResultJS|UsedAsNum|NeedsNegZero|CanExit, r4(HK<Array>))  predicting Array, double ratio 0.000000
 125:  skipped  < 0:->    SetLocal(@124<Array>, r16(GC))
 127:           < 6:->    GetLocal(@126, ResultJS|UsedAsNum|NeedsNegZero|UsedAsInt|CanExit, r5(VC<Int32>))  predicting Int, double ratio 0.000000
 128:  skipped  < 0:->    SetLocal(@127<Int32>, r17(IC))
 130:           < 2:->    GetLocal(@129, ResultJS|UsedAsNum|NeedsNegZero|UsedAsInt|CanExit, r1(HG<Int32>))  predicting Int, double ratio 0.000000
 131:           <!1:->    ValueAdd(@127<Int32>, @130<Int32>, ResultJS|MustGenerate|MightClobber|UsedAsNum|NeedsNegZero|UsedAsInt|CanExit)
 132:  skipped  < 0:->    SetLocal(@131<Int32>, r18(KC))
 134:           < 3:->    GetLocal(@133, ResultJS|UsedAsNum|NeedsNegZero|UsedAsInt|CanExit, r3(BL<Int32>))  predicting Int, double ratio 0.000000
 135:           <!2:->    ArithSub(@131<Int32>, @134<Int32>, ResultNumber|MustGenerate|UsedAsNum|NeedsNegZero|UsedAsInt|CanExit)
 136:  skipped  < 0:->    SetLocal(@135<Int32>, r18(MC))
 137:           <!0:->    ForceOSRExit(MustGenerate|CanExit)
 139:           < 4:->    GetLocal(@138, ResultJS|UsedAsNum|NeedsNegZero|CanExit, r0(KI<Array>))  predicting Array, double ratio 0.000000
 140:           <!1:->    GetIndexedPropertyStorage(@139<Array>, @135<Int32>, ResultStorage|MustGenerate|CanExit)
 141:           <!1:->    GetByVal(@139<Array>, @135<Int32>, @140<Other>, ResultJS|MustGenerate|MightClobber|UsedAsNum|NeedsNegZero|CanExit)  predicting None
 142:  skipped  < 0:->    SetLocal(@141, r18(OC))
 143:           <!1:->    GetById(@141, ResultJS|MustGenerate|ClobbersWorld|UsedAsNum|NeedsNegZero|CanExit, id4{_point})  predicting None
 144:  skipped  < 0:->    SetLocal(@143, r18(PC))
 145:           <!0:->    PutByVal(@124<Array>, @127<Int32>, @143, MustGenerate|ClobbersWorld|CanExit)
 146:  skipped  < 0:->    SetLocal(@124<Array>, r16(QC))
 147:           <!1:->    ValueAdd(@127<Int32>, @130<Int32>, ResultJS|MustGenerate|MightClobber|UsedAsNum|UsedAsInt|CanExit)
 148:  skipped  < 0:->    SetLocal(@147<Int32>, r18(RC))
 149:           <!1:->    ValueAdd(@147<Int32>, @134<Int32>, ResultJS|MustGenerate|MightClobber|UsedAsNum|UsedAsInt|CanExit)
 150:  skipped  < 0:->    SetLocal(@149<Int32>, r17(SC))
 151:           <!0:->    ForceOSRExit(MustGenerate|CanExit)
 152:           <!1:->    GetIndexedPropertyStorage(@139<Array>, @127<Int32>, ResultStorage|MustGenerate|CanExit)
 153:           <!1:->    GetByVal(@139<Array>, @127<Int32>, @152<Other>, ResultJS|MustGenerate|MightClobber|UsedAsNum|NeedsNegZero|CanExit)  predicting None
 154:  skipped  < 0:->    SetLocal(@153, r18(TC))
 155:           <!1:->    GetById(@153, ResultJS|MustGenerate|ClobbersWorld|UsedAsNum|NeedsNegZero|CanExit, id4{_point})  predicting None
 156:  skipped  < 0:->    SetLocal(@155, r18(UC))
 157:           <!0:->    PutByVal(@124<Array>, @149<Int32>, @155, MustGenerate|ClobbersWorld|CanExit)
 158:           <!0:->    Phantom(MustGenerate)
 160:  skipped  < 0:->    GetLocal(@126, ResultJS|UsedAsNum|NeedsNegZero|UsedAsInt|CanExit, r5(VC<Int32>))
 161:           < 1:->    JSConstant(ResultJS|UsedAsNum|NeedsNegZero|UsedAsInt, $4 = Int32: 1)
 162:           <!1:->    ArithAdd(@127<Int32>, @161<Int32>, ResultNumber|MustGenerate|UsedAsNum|NeedsNegZero|UsedAsInt|CanExit)
 163:  skipped  < 0:->    SetLocal(@162<Int32>, r5(VC<Int32>))
 165:  skipped  < 0:->    GetLocal(@133, ResultJS|UsedAsNum|NeedsNegZero|CanExit, r3(BL<Int32>))
 166:           <!1:->    CompareLess(@162<Int32>, @134<Int32>, ResultBoolean|MustGenerate|MightClobber|UsedAsNum|NeedsNegZero|CanExit)
 167:           <!0:->    Branch(@166<Boolean>, MustGenerate|CanExit, T:#10, F:#12)
  vars after: <empty>
  var links: @897 : @139 @130 @864 @134 @124 @163 - - - - - - - - - - @146 @150 @156 - - - - - - - - - - - -

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.