In IndexSparseSet::validate() (that I just added), there is an assertion that m_values.size() < m_map.size(). It should be <= instead.
Created attachment 406177 [details] Patch
Committed r265378: <https://trac.webkit.org/changeset/265378> All reviewed patches have been landed. Closing bug and clearing flags on attachment 406177 [details].
<rdar://problem/66685769>
Comment on attachment 406177 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=406177&action=review > Source/WTF/ChangeLog:8 > + No new tests, as it was caught by our testing infrastructure (not sure why it only got caught after landing). As determined in a Slack discussion, the explanation is that the landed patch was different from what went through EWS.