Bug 209658

Summary:	REGRESSION: 40+ JSC tests have started to crash with an assertion failure: !m_needExceptionCheck
Product:	WebKit	Reporter:	Jacob Uphoff <jacob_uphoff>
Component:	JavaScriptCore	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED DUPLICATE
Severity:	Normal	CC:	keith_miller, webkit-bot-watchers-bugzilla, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Description Jacob Uphoff 2020-03-27 09:30:24 PDT

Failing JSC Tests:

jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout
	jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout-dfg-eager-no-cjit
	jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout-ftl-eager-no-cjit
	jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout-ftl-no-cjit
	jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout-no-cjit
	jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout-no-ftl
	jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout-no-llint
	microbenchmarks/DataView-custom-properties.js.no-ftl
	stress/array-message-passing.js.bytecode-cache
	stress/array-message-passing.js.default
	stress/array-message-passing.js.dfg-eager
	stress/array-message-passing.js.dfg-eager-no-cjit-validate
	stress/array-message-passing.js.eager-jettison-no-cjit
	stress/array-message-passing.js.ftl-eager
	stress/array-message-passing.js.ftl-eager-no-cjit
	stress/array-message-passing.js.ftl-eager-no-cjit-b3o1
	stress/array-message-passing.js.ftl-no-cjit-b3o0
	stress/array-message-passing.js.ftl-no-cjit-no-inline-validate
	stress/array-message-passing.js.ftl-no-cjit-no-put-stack-validate
	stress/array-message-passing.js.ftl-no-cjit-small-pool
	stress/array-message-passing.js.ftl-no-cjit-validate-sampling-profiler
	stress/array-message-passing.js.mini-mode
	stress/array-message-passing.js.no-cjit-validate-phases
	stress/array-message-passing.js.no-ftl
	stress/array-message-passing.js.no-llint
	stress/dataview-prototype-accessors.js.bytecode-cache
	stress/dataview-prototype-accessors.js.default
	stress/dataview-prototype-accessors.js.dfg-eager
	stress/dataview-prototype-accessors.js.dfg-eager-no-cjit-validate
	stress/dataview-prototype-accessors.js.eager-jettison-no-cjit
	stress/dataview-prototype-accessors.js.ftl-eager
	stress/dataview-prototype-accessors.js.ftl-eager-no-cjit
	stress/dataview-prototype-accessors.js.ftl-eager-no-cjit-b3o1
	stress/dataview-prototype-accessors.js.ftl-no-cjit-b3o0
	stress/dataview-prototype-accessors.js.ftl-no-cjit-no-inline-validate
	stress/dataview-prototype-accessors.js.ftl-no-cjit-no-put-stack-validate
	stress/dataview-prototype-accessors.js.ftl-no-cjit-small-pool
	stress/dataview-prototype-accessors.js.ftl-no-cjit-validate-sampling-profiler
	stress/dataview-prototype-accessors.js.mini-mode
	stress/dataview-prototype-accessors.js.no-cjit-validate-phases
	stress/dataview-prototype-accessors.js.no-ftl
	stress/dataview-prototype-accessors.js.no-llint

https://build.webkit.org/builders/Apple-Catalina-Debug-JSC-Tests/builds/570/steps/jscore-test/logs/stdio

 ASSERTION FAILED: !m_needExceptionCheck
stress/array-message-passing.js.no-llint: ./runtime/VM.cpp(1387) : void JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation &)
stress/array-message-passing.js.no-llint: 1   0x1104bbdb9 WTFCrash
stress/array-message-passing.js.no-llint: 2   0x110c1541b WTFCrashWithInfo(int, char const*, char const*, int)
stress/array-message-passing.js.no-llint: 3   0x111eb1a08 JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation&)
stress/array-message-passing.js.no-llint: 4   0x111e8a45d JSC::ThrowScope::~ThrowScope()
stress/array-message-passing.js.no-llint: 5   0x111e8a665 JSC::ThrowScope::~ThrowScope()
stress/array-message-passing.js.no-llint: 6   0x111c4af7b JSC::dataViewProtoGetterBuffer(JSC::JSGlobalObject*, JSC::CallFrame*)
stress/array-message-passing.js.no-llint: 7   0x1109c72dd vmEntryToNative
stress/array-message-passing.js.no-llint: 8   0x1117d49cc JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
stress/array-message-passing.js.no-llint: 9   0x111afa21c JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
stress/array-message-passing.js.no-llint: 10  0x111bc50c2 JSC::callGetter(JSC::JSGlobalObject*, JSC::JSValue, JSC::JSValue)
stress/array-message-passing.js.no-llint: 11  0x111de4c12 JSC::PropertySlot::functionGetter(JSC::JSGlobalObject*) const
stress/array-message-passing.js.no-llint: 12  0x111cf9f5c JSC::PropertySlot::getValue(JSC::JSGlobalObject*, JSC::PropertyName) const
stress/array-message-passing.js.no-llint: 13  0x1118a8fff operationGetByIdOptimize::$_1::operator()(bool, JSC::PropertySlot&) const
stress/array-message-passing.js.no-llint: 14  0x1118a8d9d std::__1::result_of<operationGetByIdOptimize::$_1 (bool, JSC::PropertySlot&)>::type JSC::JSValue::getPropertySlot<operationGetByIdOptimize::$_1>(JSC::JSGlobalObject*, JSC::PropertyName, JSC::PropertySlot&, operationGetByIdOptimize::$_1) const
stress/array-message-passing.js.no-llint: 15  0x111871e00 std::__1::result_of<operationGetByIdOptimize::$_1 (bool, JSC::PropertySlot&)>::type JSC::JSValue::getPropertySlot<operationGetByIdOptimize::$_1>(JSC::JSGlobalObject*, JSC::PropertyName, operationGetByIdOptimize::$_1) const
stress/array-message-passing.js.no-llint: 16  0x111871cd7 operationGetByIdOptimize
stress/array-message-passing.js.no-llint: 17  0x28e50d41a103
stress/array-message-passing.js.no-llint: 18  0x28e50d418e46
stress/array-message-passing.js.no-llint: 19  0x28e50d4134ed
stress/array-message-passing.js.no-llint: 20  0x28e50d411b1d
stress/array-message-passing.js.no-llint: 21  0x28e54d400ed3
stress/array-message-passing.js.no-llint: 22  0x1109c7133 vmEntryToJavaScript
stress/array-message-passing.js.no-llint: 23  0x1117d4227 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
stress/array-message-passing.js.no-llint: 24  0x1117d37eb JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*)
stress/array-message-passing.js.no-llint: 25  0x111b5b7ac JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
stress/array-message-passing.js.no-llint: 26  0x109c1462f runWithOptions(GlobalObject*, CommandLine&, bool&)
stress/array-message-passing.js.no-llint: 27  0x109be5a4a jscmain(int, char**)::$_6::operator()(JSC::VM&, GlobalObject*, bool&) const
stress/array-message-passing.js.no-llint: 28  0x109bc027b int runJSC<jscmain(int, char**)::$_6>(CommandLine const&, bool, jscmain(int, char**)::$_6 const&)
stress/array-message-passing.js.no-llint: 29  0x109bbed08 jscmain(int, char**)
stress/array-message-passing.js.no-llint: 30  0x109bbeade main
stress/array-message-passing.js.no-llint: 31  0x7fff704facc9 start

Comment 1 Radar WebKit Bug Importer 2020-03-27 09:30:52 PDT

<rdar://problem/60970920>

Comment 2 Keith Miller 2020-03-27 11:39:01 PDT

Fixed this in a different bugzilla... >.>

*** This bug has been marked as a duplicate of bug 209663 ***