[Webkit-unassigned] [Bug 162986] New: [mac-wk1 debug] ASSERTION FAILED: thisObject->m_propertyTableUnsafe

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=162986

            Bug ID: 162986
           Summary: [mac-wk1 debug] ASSERTION FAILED:
                    thisObject->m_propertyTableUnsafe
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: New Bugs
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: ryanhaddad at apple.com

LayoutTest inspector/formatting/formatting-javascript.html is a flaky crash

https://build.webkit.org/builders/Apple%20Sierra%20Debug%20WK1%20(Tests)/builds/314

https://webkit-test-results.webkit.org/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=inspector%2Fformatting%2Fformatting-javascript.html

ASSERTION FAILED: thisObject->m_propertyTableUnsafe
/Volumes/Data/slave/sierra-debug/build/Source/JavaScriptCore/runtime/Structure.cpp(1127) : static void JSC::Structure::visitChildren(JSC::JSCell *, JSC::SlotVisitor &)
1   0x10ef71acd WTFCrash
2   0x10eda6bb2 JSC::Structure::visitChildren(JSC::JSCell*, JSC::SlotVisitor&)
3   0x10ed84496 JSC::SlotVisitor::visitChildren(JSC::JSCell const*)
4   0x10ed84280 JSC::SlotVisitor::drain()
5   0x10ed85172 JSC::SlotVisitor::donateAndDrain()
6   0x10e7dfc8a JSC::Heap::visitConservativeRoots(JSC::ConservativeRoots&)
7   0x10e7df5be JSC::Heap::markRoots(double, void*, void*, int (&) [37])
8   0x10e7e32fc JSC::Heap::collectImpl(JSC::HeapOperation, void*, void*, int (&) [37])
9   0x10e7e2bdd JSC::Heap::collectWithoutAnySweep(JSC::HeapOperation)
10  0x10e7e2d50 JSC::Heap::collect(JSC::HeapOperation)
11  0x10dfcb637 JSC::Heap::collectIfNecessaryOrDefer(JSC::GCDeferralContext*)
12  0x10dfcb4af JSC::Heap::decrementDeferralDepthAndGCIfNeeded()
13  0x10dfcb458 JSC::DeferGC::~DeferGC()
14  0x10dfcafc5 JSC::DeferGC::~DeferGC()
15  0x10eda9471 JSC::Structure::takePropertyTableOrCloneIfPinned(JSC::VM&)
16  0x10eda8e7a JSC::Structure::addNewPropertyTransition(JSC::VM&, JSC::Structure*, JSC::PropertyName, unsigned int, int&, JSC::PutPropertySlot::Context, JSC::DeferredStructureTransitionWatchpointFire*)
17  0x10e1f882b bool JSC::JSObject::putDirectInternal<(JSC::JSObject::PutMode)0>(JSC::VM&, JSC::PropertyName, JSC::JSValue, unsigned int, JSC::PutPropertySlot&)
18  0x10e1f7a95 JSC::JSObject::putInline(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&)
19  0x10e1f2ff4 JSC::JSValue::putInline(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&)
20  0x10e949dc3 operationPutByIdStrict
21  0x452ccf0481cf
22  0x452ccf0a8242
23  0x452ccf096126
24  0x452ccf047e73
25  0x452ccf0963dd
26  0x452ccf047e73
27  0x452ccf09ad93
28  0x452ccf047e73
29  0x452ccf096699
30  0x452ccf047e73
31  0x452ccf0a8242

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20161005/85dcacd6/attachment.html>