Bug 244649

Description:
imported/w3c/web-platform-tests/css/css-align/baseline-rules/synthesized-baseline-flexbox-001.html

After consistently passing the first instance of a flaky crash was at 253855@main.  Then at 253866@main there was a fix and the test consistently passed again until at 253946@main where it began to flaky crash again.

REPRODUCTION STEPS
I can reproduce this on 253946@main but cannot reproduce it on 253945@main or earlier.

Command: 
run-webkit-tests --debug -1 --exit-after-n-crashes-or-timeouts 1 -f --no-retry --child-processes 1 --test-list <test-list attached>

Result: 
Regressions: Unexpected crashes (1)
  media/modern-media-controls/pip-support/pip-support-click.html [ Crash ]

History:
https://results.webkit.org/?suite=layout-tests&test=imported%2Fw3c%2Fweb-platform-tests%2Fcss%2Fcss-align%2Fbaseline-rules%2Fsynthesized-baseline-flexbox-001.html&platform=mac&flavor=wk1&style=debug

Crash Log:
No crash log found for DumpRenderTree:38254.

stdout:

PASS .wrapper 1
PASS .wrapper 2
PASS .wrapper 3
PASS .wrapper 4
PASS .wrapper 5
PASS .wrapper 6
PASS .wrapper 7


stderr:
ASSERTION FAILED: !needsSlowPutIndexing()
runtime/JSObject.cpp(1794) : JSC::ArrayStorage *JSC::JSObject::ensureArrayStorageSlow(JSC::VM &)
1   0x1029f4610 WTFCrash
2   0x103030bf0 JSC::AbstractSlotVisitor::ReferrerToken::ReferrerToken(JSC::HeapCell*)
3   0x1047c57c4 JSC::JSObject::ensureArrayStorageSlow(JSC::VM&)
4   0x1047cb434 JSC::JSObject::enterDictionaryIndexingMode(JSC::VM&)
5   0x1047ce954 JSC::JSObject::switchToSlowPutArrayStorage(JSC::VM&)
6   0x1047174c0 JSC::JSGlobalObject::haveABadTime(JSC::VM&)
7   0x1047cec48 JSC::JSObject::setPrototypeDirect(JSC::VM&, JSC::JSValue)
8   0x1047fc164 JSC::JSProxy::setTarget(JSC::VM&, JSC::JSGlobalObject*)
9   0x12e08cae8 WebCore::JSWindowProxy::setWindow(JSC::VM&, WebCore::JSDOMGlobalObject&)
10  0x12e08c7c4 WebCore::JSWindowProxy::setWindow(WebCore::AbstractDOMWindow&)
11  0x12e0b2f7c WebCore::WindowProxy::setDOMWindow(WebCore::AbstractDOMWindow*)
12  0x12f5fdc34 WebCore::FrameLoader::clear(WTF::RefPtr<WebCore::Document, WTF::RawPtrTraits<WebCore::Document>, WTF::DefaultRefDerefTraits<WebCore::Document> >&&, bool, bool, bool, WTF::Function<void ()>&&)
13  0x12f57f3b4 WebCore::DocumentWriter::begin(WTF::URL const&, bool, WebCore::Document*, WebCore::ProcessQualified<WTF::UUID>)
14  0x12f578d00 WebCore::DocumentLoader::commitData(WebCore::SharedBuffer const&)
15  0x12f5787a0 WebCore::DocumentLoader::finishedLoading()
16  0x12f5842ac WebCore::DocumentLoader::maybeLoadEmpty()
17  0x12f5844f0 WebCore::DocumentLoader::startLoadingMainResource()
18  0x12f63425c WebCore::FrameLoader::continueLoadAfterNavigationPolicy(WebCore::ResourceRequest const&, WebCore::FormState*, WebCore::NavigationPolicyDecision, WebCore::AllowNavigationToInvalidURL)::$_11::operator()()
19  0x12f633df4 WTF::Detail::CallableWrapper<WebCore::FrameLoader::continueLoadAfterNavigationPolicy(WebCore::ResourceRequest const&, WebCore::FormState*, WebCore::NavigationPolicyDecision, WebCore::AllowNavigationToInvalidURL)::$_11, void>::call()
20  0x12aff7a9c WTF::Function<void ()>::operator()() const
21  0x12b05911c WTF::CompletionHandler<void ()>::operator()()
22  0x12f607d6c WebCore::FrameLoader::continueLoadAfterNavigationPolicy(WebCore::ResourceRequest const&, WebCore::FormState*, WebCore::NavigationPolicyDecision, WebCore::AllowNavigationToInvalidURL)
23  0x12f630264 WebCore::FrameLoader::loadWithDocumentLoader(WebCore::DocumentLoader*, WebCore::FrameLoadType, WTF::RefPtr<WebCore::FormState, WTF::RawPtrTraits<WebCore::FormState>, WTF::DefaultRefDerefTraits<WebCore::FormState> >&&, WebCore::AllowNavigationToInvalidURL, WTF::CompletionHandler<void ()>&&)::$_8::operator()(WebCore::ResourceRequest const&, WTF::WeakPtr<WebCore::FormState, WTF::EmptyCounter>&&, WebCore::NavigationPolicyDecision)
24  0x12f630104 WTF::Detail::CallableWrapper<WebCore::FrameLoader::loadWithDocumentLoader(WebCore::DocumentLoader*, WebCore::FrameLoadType, WTF::RefPtr<WebCore::FormState, WTF::RawPtrTraits<WebCore::FormState>, WTF::DefaultRefDerefTraits<WebCore::FormState> >&&, WebCore::AllowNavigationToInvalidURL, WTF::CompletionHandler<void ()>&&)::$_8, void, WebCore::ResourceRequest&&, WTF::WeakPtr<WebCore::FormState, WTF::EmptyCounter>&&, WebCore::NavigationPolicyDecision>::call(WebCore::ResourceRequest&&, WTF::WeakPtr<WebCore::FormState, WTF::EmptyCounter>&&, WebCore::NavigationPolicyDecision)
25  0x12f686b98 WTF::Function<void (WebCore::ResourceRequest&&, WTF::WeakPtr<WebCore::FormState, WTF::EmptyCounter>&&, WebCore::NavigationPolicyDecision)>::operator()(WebCore::ResourceRequest&&, WTF::WeakPtr<WebCore::FormState, WTF::EmptyCounter>&&, WebCore::NavigationPolicyDecision) const
26  0x12f664ac4 WTF::CompletionHandler<void (WebCore::ResourceRequest&&, WTF::WeakPtr<WebCore::FormState, WTF::EmptyCounter>&&, WebCore::NavigationPolicyDecision)>::operator()(WebCore::ResourceRequest&&, WTF::WeakPtr<WebCore::FormState, WTF::EmptyCounter>&&, WebCore::NavigationPolicyDecision)
27  0x12f6638f0 WebCore::FrameLoader::PolicyChecker::checkNavigationPolicy(WebCore::ResourceRequest&&, WebCore::ResourceResponse const&, WebCore::DocumentLoader*, WTF::RefPtr<WebCore::FormState, WTF::RawPtrTraits<WebCore::FormState>, WTF::DefaultRefDerefTraits<WebCore::FormState> >&&, WTF::CompletionHandler<void (WebCore::ResourceRequest&&, WTF::WeakPtr<WebCore::FormState, WTF::EmptyCounter>&&, WebCore::NavigationPolicyDecision)>&&, WebCore::PolicyDecisionMode)
28  0x12f606f3c WebCore::FrameLoader::loadWithDocumentLoader(WebCore::DocumentLoader*, WebCore::FrameLoadType, WTF::RefPtr<WebCore::FormState, WTF::RawPtrTraits<WebCore::FormState>, WTF::DefaultRefDerefTraits<WebCore::FormState> >&&, WebCore::AllowNavigationToInvalidURL, WTF::CompletionHandler<void ()>&&)
29  0x12f601fdc WebCore::FrameLoader::load(WebCore::DocumentLoader&)
30  0x12f605cc8 WebCore::FrameLoader::load(WebCore::FrameLoadRequest&&)
31  0x14c7d4414 -[WebFrame loadRequest:]