[Webkit-unassigned] [Bug 130066] REGRESSION(r165407): DoYouEvenBench crashes in DRT

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=130066





--- Comment #7 from Filip Pizlo <fpizlo at apple.com>  2014-03-10 22:09:36 PST ---
I'd like to see the IR at the point of this crash.  Any chance you could convert the assertion so that if it fails, it dumps the graph (m_graph.dump()) and the node (dataLog("node = ", node, "\n"))?

(In reply to comment #4)
> (In reply to comment #3)
> > In the debug build, we're hitting the following assertion:
> > 
> > ASSERTION FAILED: node->op() == Phi || node->op() == SetArgument
> > /Volumes/Data/webkit/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp(262) : void JSC::DFG::DCEPhase::cleanVariables(VariablesVectorType &) [VariablesVectorType = JSC::Operands<JSC::DFG::Node *, JSC::DFG::NodePointerTraits>]
> > 1   0x1067dc750 WTFCrash
> > 2   0x1062728e1 void JSC::DFG::DCEPhase::cleanVariables<JSC::Operands<JSC::DFG::Node*, JSC::DFG::NodePointerTraits> >(JSC::Operands<JSC::DFG::Node*, JSC::DFG::NodePointerTraits>&)
> > 3   0x1062722d0 JSC::DFG::DCEPhase::fixupBlock(JSC::DFG::BasicBlock*)
> > 4   0x106271e2e JSC::DFG::DCEPhase::run()
> > 5   0x106271005 bool JSC::DFG::runAndLog<JSC::DFG::DCEPhase>(JSC::DFG::DCEPhase&)
> > 6   0x106270f8e bool JSC::DFG::runPhase<JSC::DFG::DCEPhase>(JSC::DFG::Graph&)
> > 7   0x106270f48 JSC::DFG::performDCE(JSC::DFG::Graph&)
> > 8   0x106326f40 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&)
> > 9   0x106326674 JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*)
> > 10  0x1063c9ac0 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*)
> > 11  0x1063c8714 JSC::DFG::Worklist::threadFunction(void*)
> > 12  0x10682bf70 WTF::threadEntryPoint(void*)
> > 13  0x10682cbf8 WTF::wtfThreadEntryPoint(void*)
> > 14  0x7fff8f8d4899 _pthread_body
> > 15  0x7fff8f8d472a _pthread_struct_init
> > 16  0x7fff8f8d8fc9 thread_start
> 
> Yep, that's what I'm seeing.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.