[Webkit-unassigned] [Bug 210731] New: 2 IndexedDB tests are crashing in JSC::reportZappedCellAndCrash

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=210731

            Bug ID: 210731
           Summary: 2 IndexedDB tests are crashing in
                    JSC::reportZappedCellAndCrash
           Product: WebKit
           Version: Safari Technology Preview
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: DOM
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: simon.fraser at apple.com

https://ews-build.webkit.org/results/macOS-Mojave-Debug-WK1-Tests-EWS/r396938-7951/results.html

Thread 8 Crashed:: IndexedDB
0   com.apple.JavaScriptCore            0x000000010e77ecca WTFCrashWithInfoImpl(int, char const*, char const*, int, unsigned long long, unsigned long long, unsigned long long, unsigned long long, unsigned long long, unsigned long long, unsigned long long) + 186 (Assertions.cpp:649)
1   com.apple.JavaScriptCore            0x000000010ff66c4a void WTFCrashWithInfo<unsigned long, unsigned long long, unsigned long long, unsigned int, unsigned long, JSC::MarkedBlock*, unsigned long long>(int, char const*, char const*, int, unsigned long, unsigned long long, unsigned long long, unsigned int, unsigned long, JSC::MarkedBlock*, unsigned long long) + 298
2   com.apple.JavaScriptCore            0x000000010ff66988 JSC::reportZappedCellAndCrash(JSC::Heap&, JSC::JSCell const*) + 920
3   com.apple.WebCore                   0x00000001258b4211 WebCore::JSDOMGlobalObject* JSC::jsCast<WebCore::JSDOMGlobalObject*, JSC::JSGlobalObject>(JSC::JSGlobalObject*) + 97
4   com.apple.WebCore                   0x0000000127ac5705 JSC::JSValue WebCore::CloneDeserializer::readDOMMatrix<WebCore::DOMMatrix>() + 373
5   com.apple.WebCore                   0x0000000127a9ec51 WebCore::CloneDeserializer::readTerminal() + 6497
6   com.apple.WebCore                   0x0000000127a9cf83 WebCore::CloneDeserializer::deserialize() + 2883
7   com.apple.WebCore                   0x0000000127aa2264 WebCore::CloneDeserializer::deserialize(JSC::JSGlobalObject*, JSC::JSGlobalObject*, WTF::Vector<WTF::RefPtr<WebCore::MessagePort, WTF::DumbPtrTraits<WebCore::MessagePort> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WTF::Vector<std::__1::pair<std::__1::unique_ptr<WebCore::ImageBuffer, std::__1::default_delete<WebCore::ImageBuffer> >, bool>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&&, WTF::Vector<JSC::ArrayBufferContents, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>*, WTF::Vector<unsigned char, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WTF::Vector<JSC::ArrayBufferContents, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>*, WTF::Vector<WTF::RefPtr<JSC::Wasm::Module, WTF::DumbPtrTraits<JSC::Wasm::Module> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>*) + 468
8   com.apple.WebCore                   0x0000000127aa202f WebCore::SerializedScriptValue::deserialize(JSC::JSGlobalObject&, JSC::JSGlobalObject*, WTF::Vector<WTF::RefPtr<WebCore::MessagePort, WTF::DumbPtrTraits<WebCore::MessagePort> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WebCore::SerializationErrorMode) + 271
9   com.apple.WebCore                   0x00000001279e1f1c WebCore::deserializeIDBValueToJSValue(JSC::JSGlobalObject&, JSC::JSGlobalObject&, WebCore::IDBValue const&) + 284
10  com.apple.WebCore                   0x00000001279e1df1 WebCore::deserializeIDBValueToJSValue(JSC::JSGlobalObject&, WebCore::IDBValue const&) + 33
11  com.apple.WebCore                   0x00000001272bf05e WebCore::IDBServer::SQLiteIDBBackingStore::updateAllIndexesForAddRecord(WebCore::IDBObjectStoreInfo const&, WebCore::IDBKeyData const&, WebCore::ThreadSafeDataBuffer const&, long long) + 206
12  com.apple.WebCore                   0x00000001272bfef6 WebCore::IDBServer::SQLiteIDBBackingStore::addRecord(WebCore::IDBResourceIdentifier const&, WebCore::IDBObjectStoreInfo const&, WebCore::IDBKeyData const&, WebCore::IDBValue const&) + 1862
13  com.apple.WebCore                   0x00000001272d4e89 WebCore::IDBServer::UniqueIDBDatabase::putOrAdd(WebCore::IDBRequestData const&, WebCore::IDBKeyData const&, WebCore::IDBValue const&, WebCore::IndexedDB::ObjectStoreOverwriteMode, WTF::Function<void (WebCore::IDBError const&, WebCore::IDBKeyData const&)>) + 2265
14  com.apple.WebCore                   0x00000001272dc3c5 WebCore::IDBServer::UniqueIDBDatabaseTransaction::putOrAdd(WebCore::IDBRequestData const&, WebCore::IDBKeyData const&, WebCore::IDBValue const&, WebCore::IndexedDB::ObjectStoreOverwriteMode) + 581
15  com.apple.WebCore                   0x00000001271d274a WebCore::IDBServer::IDBServer::putOrAdd(WebCore::IDBRequestData const&, WebCore::IDBKeyData const&, WebCore::IDBValue const&, WebCore::IndexedDB::ObjectStoreOverwriteMode) + 346
16  com.apple.WebKitLegacy              0x000000013e9585f2 InProcessIDBServer::putOrAdd(WebCore::IDBRequestData const&, WebCore::IDBKeyData const&, WebCore::IDBValue const&, WebCore::IndexedDB::ObjectStoreOverwriteMode)::$_33::operator()() const + 146
17  com.apple.WebKitLegacy              0x000000013e956f49 WTF::Detail::CallableWrapper<InProcessIDBServer::putOrAdd(WebCore::IDBRequestData const&, WebCore::IDBKeyData const&, WebCore::IDBValue const&, WebCore::IndexedDB::ObjectStoreOverwriteMode)::$_33, void>::call() + 25
18  com.apple.WebKitLegacy              0x000000013e98e04a WTF::Function<void ()>::operator()() const + 138

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200420/999a4289/attachment.htm>