Bug 245887 - REGRESSION (255003@main): ASSERTION FAILED: currentDescriptor.attributes() == emptyAttributesDescriptor.attributes()
Summary: REGRESSION (255003@main): ASSERTION FAILED: currentDescriptor.attributes() ==...
Status: RESOLVED DUPLICATE of bug 245819
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2022-09-30 08:55 PDT by Karl Rackler
Modified: 2022-09-30 10:47 PDT (History)
3 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Karl Rackler 2022-09-30 08:55:06 PDT
Description:
** The following JSC stress test failures have been introduced:
	stress/stale-check-for-define-own-property-with-index.js.bytecode-cache
	stress/stale-check-for-define-own-property-with-index.js.default
	stress/stale-check-for-define-own-property-with-index.js.dfg-eager
	stress/stale-check-for-define-own-property-with-index.js.dfg-eager-no-cjit-validate
	stress/stale-check-for-define-own-property-with-index.js.eager-jettison-no-cjit
	stress/stale-check-for-define-own-property-with-index.js.ftl-eager
	stress/stale-check-for-define-own-property-with-index.js.ftl-eager-no-cjit-b3o1
	stress/stale-check-for-define-own-property-with-index.js.ftl-no-cjit-b3o0
	stress/stale-check-for-define-own-property-with-index.js.ftl-no-cjit-no-inline-validate
	stress/stale-check-for-define-own-property-with-index.js.ftl-no-cjit-no-put-stack-validate
	stress/stale-check-for-define-own-property-with-index.js.ftl-no-cjit-small-pool
	stress/stale-check-for-define-own-property-with-index.js.ftl-no-cjit-validate-sampling-profiler
	stress/stale-check-for-define-own-property-with-index.js.mini-mode
	stress/stale-check-for-define-own-property-with-index.js.no-cjit-validate-phases
	stress/stale-check-for-define-own-property-with-index.js.no-ftl
	stress/stale-check-for-define-own-property-with-index.js.no-llint

Build:
https://build.webkit.org/#/builders/378/builds/1751/steps/12/logs/stdio

History:
https://build.webkit.org/#/builders/Apple-Monterey-AppleSilicon-Debug-JSC-Tests?numbuilds=50

ASSERTION FAILED: currentDescriptor.attributes() == emptyAttributesDescriptor.attributes()
runtime/JSObject.cpp(2767) : bool JSC::JSObject::defineOwnIndexedProperty(JSC::JSGlobalObject *, unsigned int, const JSC::PropertyDescriptor &, bool)
1   0x16b8a1a90 (null)
2   0x1195734bd (null)
3   0x11170071e8 (null)
4   0x16b8a1a90 (null)
5   0x16b8a1a48 (null)
6   0x16b8a1a60 (null)
7   0x117007384 WTFPrintBacktrace
8   0x16b8a1a48 (null)
9   0x119f09738 vtable for CrashLogPrintStream
10  0x116b8a1a7c (null)
11  0x16b8a1a90 (null)
12  0x16b8a1ba0 (null)
13  0x11700731c WTFReportBacktrace
14  0x16b8a1a80 (null)
15  0x136b8a1e30 (null)
16  0x1170e576c WTFGetBacktrace
17  0x117007308 WTFReportBacktrace
test_script_31640: line 2:  5426 Segmentation fault: 11  ( "$@" ../../.vm/JavaScriptCore.framework/Helpers/jsc --useFTLJIT\=false --useFunctionDotArguments\=true --validateExceptionChecks\=true --useDollarVM\=true --maxPerThreadStackUsage\=1572864 --useArrayAllocationProfiling\=false --forcePolyProto\=true --useRandomizingExecutableIslandAllocation\=true --useFTLJIT\=true --useConcurrentJIT\=false --thresholdForJITAfterWarmUp\=100 --scribbleFreeCells\=true --maxDFGNodesInBasicBlockForPreciseAnalysis\=100 --defaultB3OptLevel\=0 --forceOSRExitToLLInt\=true stale-check-for-define-own-property-with-index.js )
Comment 1 Radar WebKit Bug Importer 2022-09-30 08:55:28 PDT
<rdar://problem/100624366>
Comment 2 Karl Rackler 2022-09-30 10:47:28 PDT

*** This bug has been marked as a duplicate of bug 245819 ***