[Webkit-unassigned] [Bug 215639] New: DFG ASSERTION FAILED: AI-clobberize disagreement; AI says FoldedClobber while clobberize says (Direct:[], Super:[])
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Tue Aug 18 21:28:28 PDT 2020
https://bugs.webkit.org/show_bug.cgi?id=215639
Bug ID: 215639
Summary: DFG ASSERTION FAILED: AI-clobberize disagreement; AI
says FoldedClobber while clobberize says (Direct:[],
Super:[])
Product: WebKit
Version: Other
Hardware: Unspecified
OS: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: JavaScriptCore
Assignee: webkit-unassigned at lists.webkit.org
Reporter: ryanhaddad at apple.com
Seeing the following assertion failure on the debug JSC bot:
DFG ASSERTION FAILED: AI-clobberize disagreement; AI says FoldedClobber while clobberize says (Direct:[], Super:[])
./dfg/DFGCFAPhase.cpp(240) : void JSC::DFG::CFAPhase::performBlockCFA(JSC::DFG::BasicBlock *)
While handling node D at 30
Graph at time of failure:
12: DFG for test3#<no-hash>:[0x10d7bcab0->0x10d7bc5f0->0x10d7e5300, DFGFunctionCall, 29 (NeverInline)]:
12: Fixpoint state: FixpointNotConverged; Form: ThreadedCPS; Unification state: GloballyUnified; Ref count state: EverythingIsLive
12: Arguments for block#0: D at 0
0 12: Block #0 (bc#0): (OSR target)
0 12: Execution count: 1.000000
0 12: Predecessors:
0 12: Successors:
0 12: Dominated by: #root #0
0 12: Dominates: #0
0 12: Dominance Frontier:
0 12: Iterated Dominance Frontier:
0 12: States: StructuresAreWatched
0 12: Vars Before: arg0:(BytecodeTop, TOP, TOP, none:StructuresAreClobbered)
0 12: Intersected Vars Before: arg0:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc0:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc1:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc2:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc3:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc4:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc5:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc6:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc7:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc8:(FullTop, TOP, TOP, none:StructuresAreClobbered) loc9:(FullTop, TOP, TOP, none:StructuresAreClobbered)
0 12: Var Links: arg0:D at 0
0 0 12: D at 0:< 1:-> SetArgumentDefinitely(IsFlushed, this(a), W:SideState, bc#0, ExitValid) predicting OtherObj
1 0 12: D at 1:< 1:-> JSConstant(JS|PureInt, Other, Undefined, bc#0, ExitValid)
2 0 12: D at 2:<!0:-> MovHint(Check:Untyped:D at 1, MustGen, loc0, W:SideState, ClobbersExit, bc#0, ExitValid)
3 0 12: D at 3:< 1:-> SetLocal(Check:Untyped:D at 1, loc0(B~<Other>/FlushedJSValue), W:Stack(loc0), bc#0, ExitInvalid) predicting Other
4 0 12: D at 4:<!0:-> MovHint(Check:Untyped:D at 1, MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid)
5 0 12: D at 5:< 1:-> SetLocal(Check:Untyped:D at 1, loc1(C~<Other>/FlushedJSValue), W:Stack(loc1), bc#0, ExitInvalid) predicting Other
6 0 12: D at 6:<!0:-> MovHint(Check:Untyped:D at 1, MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid)
7 0 12: D at 7:< 1:-> SetLocal(Check:Untyped:D at 1, loc2(D~<Other>/FlushedJSValue), W:Stack(loc2), bc#0, ExitInvalid) predicting Other
8 0 12: D at 8:<!0:-> MovHint(Check:Untyped:D at 1, MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid)
9 0 12: D at 9:< 1:-> SetLocal(Check:Untyped:D at 1, loc3(E~<Other>/FlushedJSValue), W:Stack(loc3), bc#0, ExitInvalid) predicting Other
10 0 12: D at 10:<!0:-> MovHint(Check:Untyped:D at 1, MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid)
11 0 12: D at 11:< 1:-> SetLocal(Check:Untyped:D at 1, loc4(F~<Other>/FlushedJSValue), W:Stack(loc4), bc#0, ExitInvalid) predicting Other
12 0 12: D at 12:<!0:-> MovHint(Check:Untyped:D at 1, MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid)
13 0 12: D at 13:< 1:-> SetLocal(Check:Untyped:D at 1, loc5(G~<Other>/FlushedJSValue), W:Stack(loc5), bc#0, ExitInvalid) predicting Other
14 0 12: D at 14:< 1:-> JSConstant(JS|PureInt, Function, Weak:Object: 0x10d7f65e0 with butterfly 0x0 (Structure %BO:Function), StructureID: 37855, bc#1, ExitValid)
15 0 12: D at 15:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10d2b4068 with butterfly 0x0 (Structure %BG:JSGlobalLexicalEnvironment), StructureID: 39390, bc#1, ExitValid)
16 0 12: D at 16:<!0:-> MovHint(Check:Untyped:D at 15, MustGen, loc4, W:SideState, ClobbersExit, bc#1, ExitValid)
17 0 12: D at 17:< 1:-> SetLocal(Check:Untyped:D at 15, loc4(H~<Object>/FlushedJSValue), W:Stack(loc4), bc#1, exit: bc#3, ExitValid) predicting OtherObj
18 0 12: D at 18:<!0:-> MovHint(Check:Untyped:D at 15, MustGen, loc5, W:SideState, ClobbersExit, bc#3, ExitValid)
19 0 12: D at 19:< 1:-> SetLocal(Check:Untyped:D at 15, loc5(I~<Object>/FlushedJSValue), W:Stack(loc5), bc#3, exit: bc#6, ExitValid) predicting OtherObj
20 0 12: D at 20:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#6, ExitValid)
21 0 12: D at 21:< 1:-> JSConstant(JS|UseAsOther, OtherObj, Weak:Object: 0x10d5fa068 with butterfly 0x18078e88d8 (Structure %B2:global), StructureID: 32425, bc#7, ExitValid)
22 0 12: D at 22:<!0:-> MovHint(Check:Untyped:D at 21, MustGen, loc7, W:SideState, ClobbersExit, bc#7, ExitValid)
23 0 12: D at 23:<!0:-> Check(MustGen, bc#7, ExitInvalid)
24 0 12: D at 24:< 1:-> SetLocal(Check:Untyped:D at 21, loc7(J~<Object>/FlushedJSValue), W:Stack(loc7), bc#7, exit: bc#14, ExitValid) predicting OtherObj
25 0 12: D at 25:<!0:-> Check(MustGen, bc#14, ExitValid)
26 0 12: D at 26:< 1:-> JSConstant(JS|UseAsOther, Array, Weak:Object: 0x10d2979e8 with butterfly 0x18078e40d0 (Structure %EO:Array,ArrayWithContiguous), StructureID: 3285, bc#14, ExitValid)
27 0 12: D at 27:<!0:-> MovHint(Check:Untyped:D at 26, MustGen, loc8, W:SideState, ClobbersExit, bc#14, ExitValid)
28 0 12: D at 28:< 1:-> SetLocal(Check:Untyped:D at 26, loc8(K~<Array>/FlushedJSValue), W:Stack(loc8), bc#14, exit: bc#22, ExitValid) predicting Array
29 0 12: D at 29:< 1:-> JSConstant(JS|PureNum|UseAsOther|UseAsInt|ReallyWantsInt, NonBoolInt32, Int32: 5, bc#22, ExitValid)
30 0 12: D at 35:<!0:-> CheckStructure(Cell:D at 26, MustGen, [%EO:Array,ArrayWithContiguous], R:JSCell_structureID, Exits, bc#22, ExitValid)
31 0 12: D at 36:< 1:-> GetButterfly(Cell:D at 26, Storage|PureInt, R:JSObject_butterfly, Exits, bc#22, ExitValid)
32 0 12: D at 30:< 1:-> GetByVal(KnownCell:D at 26, Int32:D at 29, Check:Untyped:D at 36, JS|VarArgs|UseAsOther, Other, Contiguous+OriginalCopyOnWriteArray+OutOfBoundsSaneChain+AsIs+Read, R:Butterfly_publicLength,IndexedContiguousProperties, Exits, bc#22, ExitValid) predicting Other
33 0 12: D at 31:<!0:-> MovHint(Check:Untyped:D at 30, MustGen, loc6, W:SideState, ClobbersExit, bc#22, ExitInvalid)
34 0 12: D at 32:< 1:-> SetLocal(Check:Untyped:D at 30, loc6(L~<Other>/FlushedJSValue), W:Stack(loc6), bc#22, exit: bc#27, ExitValid) predicting Other
35 0 12: D at 33:<!0:-> Return(Check:Untyped:D at 30, MustGen, W:SideState, Exits, bc#27, ExitValid)
36 0 12: D at 34:<!0:-> Flush(Check:Untyped:D at 0, MustGen|IsFlushed, this(a), R:Stack(this), W:SideState, bc#27, ExitValid) predicting OtherObj
0 12: States: InvalidBranchDirection, StructuresAreWatched
0 12: Vars After:
0 12: Var Links: arg0:D at 0 loc0:D at 3 loc1:D at 5 loc2:D at 7 loc3:D at 9 loc4:D at 17 loc5:D at 19 loc6:D at 32 loc7:D at 24 loc8:D at 28
12: GC Values:
12: Weak:Object: 0x10d2979e8 with butterfly 0x18078e40d0 (Structure %EO:Array,ArrayWithContiguous), StructureID: 3285
12: Weak:Object: 0x10d5fa068 with butterfly 0x18078e88d8 (Structure %B2:global), StructureID: 32425
12: Weak:Object: 0x10d2b4068 with butterfly 0x0 (Structure %BG:JSGlobalLexicalEnvironment), StructureID: 39390
12: Weak:Object: 0x10d7f65e0 with butterfly 0x0 (Structure %BO:Function), StructureID: 37855
12: Desired watchpoints:
12: Watchpoint sets: 0x10d29a680
12: Inline watchpoint sets: 0x10d7f9b08, 0x10d2cd0c0, 0x10d7f9788, 0x10d2cd280, 0x10d7f8448, 0x10d7f9478, 0x10d7f91d8, 0x10d7f9f68
12: SymbolTables:
12: FunctionExecutables: 0x10d7e5300
12: Buffer views:
12: Object property conditions:
12: Structures:
12: %B2:global = 0x10d7cd810:[0x7ea9, global, {Object:100, Function:101, Array:102, RegExp:103, String:104, Promise:105, BigInt:106, Intl:107, $vm:108, WebAssembly:109, Symbol.toStringTag:110, debug:111, describe:112, describeArray:113, print:114, printErr:115, quit:116, gc:117, fullGC:118, edenGC:119, gcHeapSize:120, MemoryFootprint:121, resetMemoryPeak:122, addressOf:123, version:124, run:125, runString:126, load:127, loadString:128, readFile:129, read:130, checkSyntax:131, sleepSeconds:132, jscStack:133, readline:134, preciseTime:135, neverInlineFunction:136, noInline:137, noDFG:138, noFTL:139, noOSRExitFuzzing:140, numberOfDFGCompiles:141, callerIsOMGCompiled:142, jscOptions:143, optimizeNextInvocation:144, reoptimizationRetryCount:145, transferArrayBuffer:146, failNextNewCodeBlock:147, OSRExit:148, isFinalTier:149, predictInt32:150, isInt32:151, isPureNaN:152, fiatInt52:153, effectful42:154, makeMasquerader:155, hasCustomProperties:156, createGlobalObject:157, createHeapBigInt:158, useBigInt32:159, isBigInt32:160, isHeapBigInt:161, dumpTypesForAllVariables:162, drainMicrotasks:163, setTimeout:164, releaseWeakRefs:165, finalizationRegistryLiveCount:166, finalizationRegistryDeadCount:167, getRandomSeed:168, setRandomSeed:169, isRope:170, callerSourceOrigin:171, is32BitPlatform:172, checkModuleSyntax:173, platformSupportsSamplingProfiler:174, generateHeapSnapshot:175, generateHeapSnapshotForGCDebugging:176, resetSuperSamplerState:177, ensureArrayStorage:178, startSamplingProfiler:179, samplingProfilerStackTraces:180, stress/folding-get-by-val-with-immutable-butterfly-out-of-bounds-foldable.js.mini-mode: DFG ASSERTION FAILED: AI-clobberize disagreement; AI says FoldedClobber while clobberize says (Direct:[], Super:[])
stress/folding-get-by-val-with-immutable-butterfly-out-of-bounds-foldable.js.mini-mode: ./dfg/DFGCFAPhase.cpp(240) : void JSC::DFG::CFAPhase::performBlockCFA(JSC::DFG::BasicBlock *)
stress/folding-get-by-val-with-immutable-butterfly-out-of-bounds-foldable.js.mini-mode:
https://build.webkit.org/builders/Apple-Catalina-Debug-JSC-Tests/builds/1366
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200819/deb9de46/attachment.htm>
More information about the webkit-unassigned
mailing list