[Webkit-unassigned] [Bug 187057] New: JSC Assertion Failures

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=187057

            Bug ID: 187057
           Summary: JSC Assertion Failures
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Tools / Tests
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: tsavell at apple.com
                CC: lforschler at apple.com

I am seeing around 100 JSC accretion failures after a new accretion was added. 

Log: 

https://build.webkit.org/builders/Apple%20High%20Sierra%20Debug%20JSC%20%28Tests%29/builds/1180/steps/jscore-test/logs/stdio

Example of Error:

stress/dfg-put-getter-by-val-class.js.default: ASSERTION FAILED: !getDirect(offset) || !JSValue::encode(getDirect(offset))
stress/dfg-put-getter-by-val-class.js.default: /Volumes/Data/slave/highsierra-debug/build/Source/JavaScriptCore/runtime/JSObjectInlines.h(335) : bool JSC::JSObject::putDirectInternal(JSC::VM &, JSC::PropertyName, JSC::JSValue, unsigned int, JSC::PutPropertySlot &)
1   0x10ed66a69 WTFCrash
2   0x10eea5766 bool JSC::JSObject::putDirectInternal<(JSC::JSObject::PutMode)1>(JSC::VM&, JSC::PropertyName, JSC::JSValue, unsigned int, JSC::PutPropertySlot&)
3   0x10eea4580 JSC::JSObject::putDirect(JSC::VM&, JSC::PropertyName, JSC::JSValue, unsigned int)
4   0x110008bf2 JSC::JSFunction::reifyName(JSC::VM&, JSC::ExecState*, WTF::String)
5   0x1100088b9 JSC::JSFunction::setFunctionName(JSC::ExecState*, JSC::JSValue)
6   0x10fd17395 operationSetFunctionName
7   0x547d9a5f728
8   0x10ee58ddc llint_entry
9   0x10ee50842 vmEntryToJavaScript
10  0x10fcacfaa JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
11  0x10fcac551 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*)
12  0x10ff63947 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
13  0x10ec9fd00 runWithOptions(GlobalObject*, CommandLine&, bool&)
14  0x10ec7748c jscmain(int, char**)::$_3::operator()(JSC::VM&, GlobalObject*, bool&) const
15  0x10ec5ecb4 int runJSC<jscmain(int, char**)::$_3>(CommandLine, bool, jscmain(int, char**)::$_3 const&)
16  0x10ec5d79f jscmain(int, char**)
17  0x10ec5d6fe main
18  0x7fff6e830015 start
stress/dfg-put-getter-by-val-class.js.default: test_script_7860: line 2: 10510 Segmentation fault: 11  ( "$@" ../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --useFunctionDotArguments\=true --validateExceptionChecks\=true --useDollarVM\=true --maxPerThreadStackUsage\=1572864 --useFTLJIT\=true dfg-put-getter-by-val-class.js )
stress/dfg-put-getter-by-val-class.js.default: ERROR: Unexpected exit code: 139
FAIL: stress/dfg-put-getter-by-val-class.js.default

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180626/e1b8aad2/attachment-0001.html>