[Webkit-unassigned] [Bug 130069] ASSERTION FAILED: node->op() == Phi || node->op() == SetArgument
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Mon Mar 10 22:47:59 PDT 2014
https://bugs.webkit.org/show_bug.cgi?id=130069
--- Comment #1 from Ryosuke Niwa <rniwa at webkit.org> 2014-03-10 22:44:56 PST ---
I've added instrumentation suggested in https://bugs.webkit.org/show_bug.cgi?id=130066#c7
as
Index: Source/JavaScriptCore/dfg/DFGDCEPhase.cpp
===================================================================
--- Source/JavaScriptCore/dfg/DFGDCEPhase.cpp (revision 165407)
+++ Source/JavaScriptCore/dfg/DFGDCEPhase.cpp (working copy)
@@ -259,6 +259,11 @@
continue;
if (node->op() == GetLocal) {
node = node->child1().node();
+ if (!(node->op() == Phi || node->op() == SetArgument)) {
+ m_graph.dump();
+ fputs("\n\n\n\n\n", stderr);
+ dataLog("node = ", node, "\n");
+ }
ASSERT(node->op() == Phi || node->op() == SetArgument);
if (node->shouldGenerate()) {
variables[i] = node;
but Graph::dump itself crashes hitting another assertion:
DFG for adapterDidCommit#<no-hash>:[0x7fe40a014860->0x7fe4064996a0->0x113b19470, DFGFunctionCall, 192]:
Fixpoint state: FixpointConverged; Form: ThreadedCPS; Unification state: GloballyUnified; Ref count state: EverythingIsLive
Block #0 (bc#0): (OSR target)
Predecessors:
Dominated by: #0
Dominates: #0 #1 #2 #6 #7 #8 #9 #10 #14 #15 #16
vars before: arg1:(Top, TOP, TOP, TOP) arg0:(Top, TOP, TOP, TOP)
var links: arg1:@1 arg0:@0
0: < 1:-> SetArgument(arg0(a), W:SideState, bc#0) predicting Final
1: < 3:-> SetArgument(arg1(B~<Other>/FlushedJSValue), W:SideState, bc#0) predicting Other
2: < 3:-> GetLocal(@0, JS|UseAsOther, Final, arg0(a), R:Variables(6), bc#1) predicting Final
3: <!0:-> Phantom(Check:FinalObject:@2<Final>, MustGen|CanExit, Final, bc#1)
4: skipped < 0:-> MovHint(@2<Final>, arg0, W:SideState, bc#1)
5: < 2:-> SetLocal(Cell:@2<Final>, arg0(C<Final>/FlushedCell), W:Variables(6), bc#4) predicting Final
6: <!0:-> FunctionReentryWatchpoint(MustGen, R:Watchpoint_fire, bc#4)
7: < 2:-> WeakJSConstant(JS|UseAsOther, Otherobj, 0x1131b8930 (%DE:JSActivation), bc#4)
8: skipped < 0:-> MovHint(@7<Object>, loc5, W:SideState, bc#4)
9: <!0:-> Phantom(MustGen|CanExit, bc#10)
10: <!0:-> Phantom(@7<Object>, MustGen, bc#10)
11: <!0:-> VariableWatchpoint(MustGen|CanExit, 0x7fe4062d6b80, R:Watchpoint_fire, W:SideState, bc#10)
12: < 1:-> WeakJSConstant(JS|UseAsOther, Function, 0x113048030 (%Ct:Function), bc#10)
13: skipped < 0:-> MovHint(@12<Function>, loc0, W:SideState, bc#10)
14: <!0:-> Phantom(MustGen|CanExit, bc#18)
15: skipped < 0:-> MovHint(@2<Final>, loc4, W:SideState, bc#18)
16: <!0:-> Phantom(MustGen|CanExit, bc#21)
17: < 1:-> JSConstant(JS|UseAsOther, Stringident, $0 = String (identifier): isError, ID: 5, bc#21)
18: skipped < 0:-> MovHint(@17<StringIdent>, loc3, W:SideState, bc#21)
19: <!0:-> Phantom(MustGen|CanExit, bc#24)
20: < 1:-> JSConstant(JS|UseAsOther, Bool, $1 = False, bc#24)
21: skipped < 0:-> MovHint(@20<Boolean>, loc2, W:SideState, bc#24)
22: <!0:-> Phantom(MustGen|CanExit, bc#27)
23: <!0:-> Call(@12<Function>, @7<Object>, @2<Final>, @17<StringIdent>, @20<Boolean>, JS|MustGen|VarArgs|Clobbers|PureInt|CanExit, Bool, R:World, W:World, bc#27) predicting Bool
24: skipped < 0:-> MovHint(@23<Boolean>, loc0, W:SideState, bc#27)
364: <!0:-> InvalidationPoint(MustGen|CanExit, W:SideState, bc#36)
25: <!0:-> Phantom(MustGen|CanExit, bc#36)
26: < 1:-> GetLocal(@1, JS|UseAsOther, Other, arg1(B~<Other>/FlushedJSValue), R:Variables(7), bc#36) predicting Other
27: <!0:-> Branch(Check:ObjectOrOther:@26<Other>, MustGen|CanExit, T:#1, F:#2, W:SideState, bc#36)
vars after: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP) loc0:(Top, TOP, TOP, TOP) loc2:(Bool, False) loc3:(Stringident, TOP, TOP, [%Ch:string], String (identifier): isError, ID: 5) loc4:(Final, TOP, TOP, TOP) loc5:(Otherobj, TOP, TOP, [%DE:JSActivation], Cell: 0x1131b8930 (%DE:JSActivation), ID: 489)
var links: arg1:@26<Other> arg0:@5
Block #1 (bc#39):
Predecessors: #0
Dominated by: #0 #1
Dominates: #1
Phi Nodes: @449<2>->(@1), @470<2>->(@5)
vars before: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP)
var links: arg1:@449 arg0:@470
28: < 1:-> GetLocal(@449, JS|UseAsOther, Other, arg1(B~<Other>/FlushedJSValue), R:Variables(7), bc#39) predicting Other
29: < 2:-> GetLocal(@470, JS|UseAsOther, Final, arg0(C<Final>/FlushedCell), R:Variables(6), bc#39) predicting Final
30: <!0:-> ForceOSRExit(MustGen|CanExit, W:SideState, bc#39)
489: <!0:-> StoreBarrier(Check:Cell:@29<Final>, MustGen|CanExit, R:BarrierState, W:BarrierState, bc#39)
31: <!0:-> PutById(Check:Cell:@29<Final>, @28<Other>, MustGen|Clobbers|CanExit, id1{_data}, R:World, W:World, bc#39)
510: <!0:-> InvalidationPoint(MustGen|CanExit, W:SideState, bc#48)
32: <!0:-> Jump(MustGen|CanExit, T:#6, W:SideState, bc#48)
vars after:
var links: arg1:@28<Other> arg0:@29<Final>
Block #2 (bc#50):
Predecessors: #0
Dominated by: #0 #2
Dominates: #2
Phi Nodes: @448<2>->(@5), @457<1>->(@1)
vars before: arg1:(ObjectOther, TOP, TOP, TOP) arg0:(Final, TOP, TOP, TOP)
var links: arg1:@457 arg0:@448
33: < 4:-> WeakJSConstant(JS|UseAsOther, Otherobj, 0x11212e870 (%CR:Window), bc#50)
34: skipped < 0:-> MovHint(@33<Object>, loc3, W:SideState, bc#50)
35: skipped < 0:-> SetLocal(@33<Object>, loc3(L~<Object>/FlushedJSValue), W:Variables(-4), bc#56)
36: <!0:-> StructureTransitionWatchpoint(Cell:@33<Object>, MustGen|CanExit, %CR:Window, R:JSCell_structureID, bc#56)
37: <!0:-> Phantom(@33<Object>, MustGen, bc#56)
38: < 1:-> GetButterfly(Cell:@33<Object>, Storage|UseAsOther, Other, R:JSObject_butterfly, bc#56)
39: < 4:-> GetByOffset(@38<Other>, KnownCell:@33<Object>, JS|UseAsOther, Final, id2{Ember}, 152, R:NamedProperties(2), bc#56) predicting Final
40: skipped < 0:-> MovHint(@39<Final>, loc3, W:SideState, bc#56)
41: skipped < 0:-> SetLocal(@39<Final>, loc3(M~<Final>/FlushedJSValue), W:Variables(-4), bc#64)
42: <!0:-> CheckStructure(Check:Cell:@39<Final>, MustGen|CanExit, [%BN:Object], R:JSCell_structureID, bc#64)
43: < 1:-> GetButterfly(Cell:@39<Final>, Storage|UseAsOther, Other, R:JSObject_butterfly, bc#64)
44: < 1:-> GetByOffset(@43<Other>, KnownCell:@39<Final>, JS|UseAsOther, Function, id3{mixin}, 218, R:NamedProperties(3), bc#64) predicting Function
45: skipped < 0:-> MovHint(@44<Function>, loc0, W:SideState, bc#64)
46: skipped < 0:-> SetLocal(@44<Function>, loc0(N~<Function>/FlushedJSValue), W:Variables(-1), bc#73)
47: < 2:-> GetLocal(@448, JS|UseAsOther, Final, arg0(C<Final>/FlushedCell), R:Variables(6), bc#73) predicting Final
48: <!1:-> GetById(Cell:@47<Final>, JS|MustGen|Clobbers|UseAsOther|CanExit, Final, id1{_data}, R:World, W:World, bc#73) predicting Final
49: skipped < 0:-> MovHint(@48<Final>, loc2, W:SideState, bc#73)
508: <!0:-> InvalidationPoint(MustGen|CanExit, W:SideState, bc#82)
50: < 2:-> SetLocal(@48<Final>, loc2(P*<Final>/FlushedJSValue), W:Variables(-3), bc#82) predicting Final
51: <!1:-> GetById(Cell:@47<Final>, JS|MustGen|Clobbers|UseAsOther|CanExit, Final, id4{_inFlightAttributes}, R:World, W:World, bc#82) predicting Final
52: skipped < 0:-> MovHint(@51<Final>, loc1, W:SideState, bc#82)
509: <!0:-> InvalidationPoint(MustGen|CanExit, W:SideState, bc#91)
53: < 1:-> SetLocal(@51<Final>, loc1(Q*<Final>/FlushedJSValue), W:Variables(-2), bc#91) predicting Final
54: <!0:-> CheckFunction(Check:Cell:@44<Function>, @39<Final>, MustGen|CanExit, function(0x113044430, mixin#ASSERTION FAILED: isSafeToComputeHash()
/Volumes/Data/webkit3/Source/JavaScriptCore/bytecode/CodeBlock.cpp(102) : JSC::CodeBlockHash JSC::CodeBlock::hash() const
1 0x1018e34b0 WTFCrash
2 0x101247a97 JSC::CodeBlock::hash() const
3 0x1014ef4fe JSC::FunctionExecutableDump::dump(WTF::PrintStream&) const
4 0x1013b683d void WTF::printInternal<JSC::FunctionExecutableDump>(WTF::PrintStream&, JSC::FunctionExecutableDump const&)
5 0x1013aab3d void WTF::PrintStream::print<JSC::FunctionExecutableDump>(JSC::FunctionExecutableDump const&)
6 0x1013a5d16 JSC::DFG::Graph::dump(WTF::PrintStream&, char const*, JSC::DFG::Node*, JSC::DumpContext*)
7 0x1013a80a4 JSC::DFG::Graph::dump(WTF::PrintStream&, JSC::DumpContext*)
8 0x1013795bb void JSC::DFG::DCEPhase::cleanVariables<JSC::Operands<JSC::DFG::Node*, JSC::DFG::NodePointerTraits> >(JSC::Operands<JSC::DFG::Node*, JSC::DFG::NodePointerTraits>&)
9 0x101378e40 JSC::DFG::DCEPhase::fixupBlock(JSC::DFG::BasicBlock*)
10 0x10137899e JSC::DFG::DCEPhase::run()
11 0x101377b75 bool JSC::DFG::runAndLog<JSC::DFG::DCEPhase>(JSC::DFG::DCEPhase&)
12 0x101377afe bool JSC::DFG::runPhase<JSC::DFG::DCEPhase>(JSC::DFG::Graph&)
13 0x101377ab8 JSC::DFG::performDCE(JSC::DFG::Graph&)
14 0x10142dca0 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&)
15 0x10142d3d4 JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*)
16 0x1014d0820 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*)
17 0x1014cf474 JSC::DFG::Worklist::threadFunction(void*)
18 0x101932cd0 WTF::threadEntryPoint(void*)
19 0x101933958 WTF::wtfThreadEntryPoint(void*)
20 0x7fff8f8d4899 _pthread_body
21 0x7fff8f8d472a _pthread_struct_init
22 0x7fff8f8d8fc9 thread_start
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list