[Webkit-unassigned] [Bug 227119] DFG ASSERTION FAILED Edge verification error: NeitherDoubleNorHeapBigIntNorString with --jitPolicyScale=0
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Thu Jun 17 06:11:31 PDT 2021
https://bugs.webkit.org/show_bug.cgi?id=227119
--- Comment #1 from Frédéric Wang (:fredw) <fred.wang at free.fr> ---
~ % DYLD_FRAMEWORK_PATH=~/WebKit/WebKitBuild/Release $HOME/WebKit/WebKitBuild/Release/jsc --jitPolicyScale=0 ~/dfg-assert-NeitherDoubleNorHeapBigIntNorString.js
DFG ASSERTION FAILED: Edge verification error: D at 44->Check:NeitherDoubleNorHeapBigIntNorString:D at 33 was expected to have type Object|Symbol|BoolInt32|NonBoolInt32|Bool|Other|Empty|Int52Any but has type BoolInt32|NonBoolInt32|BigInt (8808977924096)
/Users/fred/WebKit/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h(173) : void JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::verifyEdge(JSC::DFG::Node *, JSC::DFG::Edge) [AbstractStateType = JSC::DFG::InPlaceAbstractState]
While handling node D at 44
Graph at time of failure:
27: DFG for #<no-hash>:[0x10e5e8ee0->0x10e5e8aa0->0x10e57d280, DFGFunctionCall, 34]:
27: Fixpoint state: FixpointConverged; Form: ThreadedCPS; Unification state: GloballyUnified; Ref count state: ExactRefCount
27: Arguments for block#0: D at 0
0 27: Block #0 (bc#0): (OSR target)
0 27: Execution count: 1.000000
0 27: Predecessors:
0 27: Successors:
0 27: Dominated by: #root #0
0 27: Dominates: #0
0 27: Dominance Frontier:
0 27: Iterated Dominance Frontier:
0 27: States: StructuresAreWatched
0 27: Vars Before: arg0:(BytecodeTop, TOP, TOP, none:StructuresAreClobbered)
0 27: Intersected Vars Before: arg0:(BytecodeTop, TOP, TOP, none:StructuresAreClobbered)
0 27: Var Links: arg0:D at 0
0 0 27: D at 0:< 1:-> SetArgumentDefinitely(IsFlushed, this(A~<Other>/FlushedJSValue), machine:this, W:SideState, bc#0, ExitValid) predicting Other
1 0 27: D at 1:< 6:loc2> JSConstant(JS|PureInt, Other, Undefined, bc#0, ExitValid)
2 0 27: D at 2:<!0:-> MovHint(Check:Untyped:D at 1, MustGen, loc0, W:SideState, ClobbersExit, bc#0, ExitValid)
3 0 27: D at 4:<!0:-> MovHint(Check:Untyped:D at 1, MustGen, loc1, W:SideState, ClobbersExit, bc#0, ExitInvalid)
4 0 27: D at 6:<!0:-> MovHint(Check:Untyped:D at 1, MustGen, loc2, W:SideState, ClobbersExit, bc#0, ExitInvalid)
5 0 27: D at 8:<!0:-> MovHint(Check:Untyped:D at 1, MustGen, loc3, W:SideState, ClobbersExit, bc#0, ExitInvalid)
6 0 27: D at 10:<!0:-> MovHint(Check:Untyped:D at 1, MustGen, loc4, W:SideState, ClobbersExit, bc#0, ExitInvalid)
7 0 27: D at 12:<!0:-> MovHint(Check:Untyped:D at 1, MustGen, loc5, W:SideState, ClobbersExit, bc#0, ExitInvalid)
8 0 27: D at 14:< 1:loc2> GetCallee(JS|UseAsOther, Function, R:Stack(callee), bc#1, ExitValid)
9 0 27: D at 15:< 3:loc2> GetScope(KnownCell:D at 14, JS|UseAsOther, OtherObj, bc#1, ExitValid)
10 0 27: D at 16:<!0:-> MovHint(Check:Untyped:D at 15, MustGen, loc4, W:SideState, ClobbersExit, bc#1, ExitValid)
11 0 27: D at 18:<!0:-> MovHint(Check:Untyped:D at 15, MustGen, loc5, W:SideState, ClobbersExit, bc#3, ExitValid)
12 0 27: D at 20:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#6, ExitValid)
13 0 27: D at 21:< 7:loc3> NewObject(JS|UseAsOther|UseAsInt, Final, %CL:Object, R:HeapObjectCount, W:HeapObjectCount, Exits, bc#7, ExitValid)
14 0 27: D at 22:<!0:-> MovHint(Check:Untyped:D at 21, MustGen, loc6, W:SideState, ClobbersExit, bc#7, ExitValid)
15 0 27: D at 24:< 2:loc2> NewFunction(KnownCell:D at 15, JS|UseAsOther, Function, <0x10e57d300, FunctionExecutable>, valueOf#<no-hash>/<nogen>:[0x10e57d300], R:HeapObjectCount, W:HeapObjectCount, ExitsForExceptions, bc#11, ExitValid)
16 0 27: D at 25:<!0:-> MovHint(Check:Untyped:D at 24, MustGen, loc7, W:SideState, ClobbersExit, bc#11, ExitValid)
17 0 27: D at 28:<!0:-> FilterPutByIdStatus(Check:Untyped:D at 21, MustGen, (<Transition: [0x10e5c0cb0:[0xa1c6, Object, {}, NonArray, Proto:0x10d108b68]] to 0x10e5c0d20:[0xa39f, Object, {valueOf:0}, NonArray, Proto:0x10d108b68, Leaf], [[]], offset = 0, >), W:SideState, bc#15, ExitValid)
18 0 27: D at 30:<!0:-> PutByOffset(KnownCell:D at 21, KnownCell:D at 21, Check:Untyped:D at 24, MustGen, id0{valueOf}, 0, W:NamedProperties(0), ClobbersExit, bc#15, ExitValid)
19 0 27: D at 31:<!0:-> PutStructure(KnownCell:D at 21, MustGen, %CL:Object -> %EQ:Object, ID:41887, R:JSObject_butterfly, W:JSCell_indexingType,JSCell_structureID,JSCell_typeInfoFlags, ClobbersExit, bc#15, ExitInvalid)
20 0 27: D at 48:<!0:-> FencedStoreBarrier(KnownCell:D at 21, MustGen, R:Heap, W:JSCell_cellState, bc#15, ExitInvalid)
21 0 27: D at 32:< 1:loc2> JSConstant(JS|PureInt|UseAsInt, BoolInt32, Int32: 0, bc#21, ExitValid)
22 0 27: D at 33:<!2:loc2> ValueBitLShift(Check:Untyped:D at 21, Check:Untyped:D at 32, JS|MustGen|PureNum|UseAsOther, BoolInt32, R:World, W:Heap, Exits, ClobbersExit, bc#21, ExitValid) predicting BoolInt32
23 0 27: D at 34:<!0:-> MovHint(Check:Untyped:D at 33, MustGen, loc6, W:SideState, ClobbersExit, bc#21, ExitInvalid)
24 0 27: D at 45:<!0:-> InvalidationPoint(MustGen, W:SideState, Exits, bc#21, exit: bc#26, ExitValid)
25 0 27: D at 44:<!0:-> Check(Check:NeitherDoubleNorHeapBigIntNorString:D at 33, MustGen, Exits, bc#26, ExitValid)
26 0 27: D at 38:< 2:loc2> JSConstant(Boolean|UseAsOther, Bool, True, bc#26, ExitValid)
27 0 27: D at 39:<!0:-> MovHint(Check:Untyped:D at 38, MustGen, loc6, W:SideState, ClobbersExit, bc#26, ExitValid)
28 0 27: D at 43:<!0:-> CheckTierUpAtReturn(MustGen, W:SideState, Exits, bc#30, ExitValid)
29 0 27: D at 41:<!0:-> Return(Check:Untyped:D at 38, MustGen, W:SideState, Exits, bc#30, ExitValid)
30 0 27: D at 42:<!0:-> Flush(Check:Untyped:D at 0, MustGen|IsFlushed, this(A~<Other>/FlushedJSValue), machine:this, R:Stack(this), W:SideState, bc#30, ExitValid) predicting Other
0 27: States: InvalidBranchDirection, StructuresAreWatched, CFAInvalidated
0 27: Vars After:
0 27: Var Links: arg0:D at 0
27: GC Values:
27: Strong:BigInt[heap-allocated]: addr=0x10dc03bf8, length=0, sign=false, StructureID: 6847
27: Strong:Cell: 0x10e57d300 (%Ec:FunctionExecutable), StructureID: 50472
27: Desired watchpoints:
27: Watchpoint sets:
27: Inline watchpoint sets: 0x10e518218, 0x10e5c0d78, 0x10e518ec8, 0x10e5183d8, 0x10d2022c0, 0x10e519478, 0x10d202540
27: SymbolTables:
27: FunctionExecutables:
27: Buffer views:
27: Object property conditions:
27: Structures:
27: %CL:Object = 0x10e5c0cb0:[0xa1c6, Object, {}, NonArray, Proto:0x10d108b68]
27: %EQ:Object = 0x10e5c0d20:[0xa39f, Object, {valueOf:0}, NonArray, Proto:0x10d108b68, Leaf]
27: %Ec:FunctionExecutable = 0x10e5181c0:[0xc528, FunctionExecutable, {}, NonArray, Leaf (Watched)]
DFG ASSERTION FAILED: Edge verification error: D at 44->Check:NeitherDoubleNorHeapBigIntNorString:D at 33 was expected to have type Object|Symbol|BoolInt32|NonBoolInt32|Bool|Other|Empty|Int52Any but has type BoolInt32|NonBoolInt32|BigInt (8808977924096)
/Users/fred/WebKit/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h(173) : void JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::verifyEdge(JSC::DFG::Node *, JSC::DFG::Edge) [AbstractStateType = JSC::DFG::InPlaceAbstractState]
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210617/3fe99d44/attachment-0001.htm>
More information about the webkit-unassigned
mailing list