Bug 245887

Description: ** The following JSC stress test failures have been introduced: stress/stale-check-for-define-own-property-with-index.js.bytecode-cache stress/stale-check-for-define-own-property-with-index.js.default stress/stale-check-for-define-own-property-with-index.js.dfg-eager stress/stale-check-for-define-own-property-with-index.js.dfg-eager-no-cjit-validate stress/stale-check-for-define-own-property-with-index.js.eager-jettison-no-cjit stress/stale-check-for-define-own-property-with-index.js.ftl-eager stress/stale-check-for-define-own-property-with-index.js.ftl-eager-no-cjit-b3o1 stress/stale-check-for-define-own-property-with-index.js.ftl-no-cjit-b3o0 stress/stale-check-for-define-own-property-with-index.js.ftl-no-cjit-no-inline-validate stress/stale-check-for-define-own-property-with-index.js.ftl-no-cjit-no-put-stack-validate stress/stale-check-for-define-own-property-with-index.js.ftl-no-cjit-small-pool stress/stale-check-for-define-own-property-with-index.js.ftl-no-cjit-validate-sampling-profiler stress/stale-check-for-define-own-property-with-index.js.mini-mode stress/stale-check-for-define-own-property-with-index.js.no-cjit-validate-phases stress/stale-check-for-define-own-property-with-index.js.no-ftl stress/stale-check-for-define-own-property-with-index.js.no-llint Build: https://build.webkit.org/#/builders/378/builds/1751/steps/12/logs/stdio History: https://build.webkit.org/#/builders/Apple-Monterey-AppleSilicon-Debug-JSC-Tests?numbuilds=50 ASSERTION FAILED: currentDescriptor.attributes() == emptyAttributesDescriptor.attributes() runtime/JSObject.cpp(2767) : bool JSC::JSObject::defineOwnIndexedProperty(JSC::JSGlobalObject *, unsigned int, const JSC::PropertyDescriptor &, bool) 1 0x16b8a1a90 (null) 2 0x1195734bd (null) 3 0x11170071e8 (null) 4 0x16b8a1a90 (null) 5 0x16b8a1a48 (null) 6 0x16b8a1a60 (null) 7 0x117007384 WTFPrintBacktrace 8 0x16b8a1a48 (null) 9 0x119f09738 vtable for CrashLogPrintStream 10 0x116b8a1a7c (null) 11 0x16b8a1a90 (null) 12 0x16b8a1ba0 (null) 13 0x11700731c WTFReportBacktrace 14 0x16b8a1a80 (null) 15 0x136b8a1e30 (null) 16 0x1170e576c WTFGetBacktrace 17 0x117007308 WTFReportBacktrace test_script_31640: line 2: 5426 Segmentation fault: 11 ( "$@" ../../.vm/JavaScriptCore.framework/Helpers/jsc --useFTLJIT\=false --useFunctionDotArguments\=true --validateExceptionChecks\=true --useDollarVM\=true --maxPerThreadStackUsage\=1572864 --useArrayAllocationProfiling\=false --forcePolyProto\=true --useRandomizingExecutableIslandAllocation\=true --useFTLJIT\=true --useConcurrentJIT\=false --thresholdForJITAfterWarmUp\=100 --scribbleFreeCells\=true --maxDFGNodesInBasicBlockForPreciseAnalysis\=100 --defaultB3OptLevel\=0 --forceOSRExitToLLInt\=true stale-check-for-define-own-property-with-index.js )