[Webkit-unassigned] [Bug 209658] New: REGRESSION: 40+ JSC tests have started to crash with an assertion failure: !m_needExceptionCheck

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Fri Mar 27 09:30:24 PDT 2020 

https://bugs.webkit.org/show_bug.cgi?id=209658

            Bug ID: 209658
           Summary: REGRESSION: 40+ JSC tests have started to crash with
                    an assertion failure: !m_needExceptionCheck
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: jacob_uphoff at apple.com

Failing JSC Tests:

jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout
        jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout-dfg-eager-no-cjit
        jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout-ftl-eager-no-cjit
        jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout-ftl-no-cjit
        jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout-no-cjit
        jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout-no-ftl
        jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout-no-llint
        microbenchmarks/DataView-custom-properties.js.no-ftl
        stress/array-message-passing.js.bytecode-cache
        stress/array-message-passing.js.default
        stress/array-message-passing.js.dfg-eager
        stress/array-message-passing.js.dfg-eager-no-cjit-validate
        stress/array-message-passing.js.eager-jettison-no-cjit
        stress/array-message-passing.js.ftl-eager
        stress/array-message-passing.js.ftl-eager-no-cjit
        stress/array-message-passing.js.ftl-eager-no-cjit-b3o1
        stress/array-message-passing.js.ftl-no-cjit-b3o0
        stress/array-message-passing.js.ftl-no-cjit-no-inline-validate
        stress/array-message-passing.js.ftl-no-cjit-no-put-stack-validate
        stress/array-message-passing.js.ftl-no-cjit-small-pool
        stress/array-message-passing.js.ftl-no-cjit-validate-sampling-profiler
        stress/array-message-passing.js.mini-mode
        stress/array-message-passing.js.no-cjit-validate-phases
        stress/array-message-passing.js.no-ftl
        stress/array-message-passing.js.no-llint
        stress/dataview-prototype-accessors.js.bytecode-cache
        stress/dataview-prototype-accessors.js.default
        stress/dataview-prototype-accessors.js.dfg-eager
        stress/dataview-prototype-accessors.js.dfg-eager-no-cjit-validate
        stress/dataview-prototype-accessors.js.eager-jettison-no-cjit
        stress/dataview-prototype-accessors.js.ftl-eager
        stress/dataview-prototype-accessors.js.ftl-eager-no-cjit
        stress/dataview-prototype-accessors.js.ftl-eager-no-cjit-b3o1
        stress/dataview-prototype-accessors.js.ftl-no-cjit-b3o0
        stress/dataview-prototype-accessors.js.ftl-no-cjit-no-inline-validate
        stress/dataview-prototype-accessors.js.ftl-no-cjit-no-put-stack-validate
        stress/dataview-prototype-accessors.js.ftl-no-cjit-small-pool
        stress/dataview-prototype-accessors.js.ftl-no-cjit-validate-sampling-profiler
        stress/dataview-prototype-accessors.js.mini-mode
        stress/dataview-prototype-accessors.js.no-cjit-validate-phases
        stress/dataview-prototype-accessors.js.no-ftl
        stress/dataview-prototype-accessors.js.no-llint

https://build.webkit.org/builders/Apple-Catalina-Debug-JSC-Tests/builds/570/steps/jscore-test/logs/stdio

 ASSERTION FAILED: !m_needExceptionCheck
stress/array-message-passing.js.no-llint: ./runtime/VM.cpp(1387) : void JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation &)
stress/array-message-passing.js.no-llint: 1   0x1104bbdb9 WTFCrash
stress/array-message-passing.js.no-llint: 2   0x110c1541b WTFCrashWithInfo(int, char const*, char const*, int)
stress/array-message-passing.js.no-llint: 3   0x111eb1a08 JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation&)
stress/array-message-passing.js.no-llint: 4   0x111e8a45d JSC::ThrowScope::~ThrowScope()
stress/array-message-passing.js.no-llint: 5   0x111e8a665 JSC::ThrowScope::~ThrowScope()
stress/array-message-passing.js.no-llint: 6   0x111c4af7b JSC::dataViewProtoGetterBuffer(JSC::JSGlobalObject*, JSC::CallFrame*)
stress/array-message-passing.js.no-llint: 7   0x1109c72dd vmEntryToNative
stress/array-message-passing.js.no-llint: 8   0x1117d49cc JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
stress/array-message-passing.js.no-llint: 9   0x111afa21c JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
stress/array-message-passing.js.no-llint: 10  0x111bc50c2 JSC::callGetter(JSC::JSGlobalObject*, JSC::JSValue, JSC::JSValue)
stress/array-message-passing.js.no-llint: 11  0x111de4c12 JSC::PropertySlot::functionGetter(JSC::JSGlobalObject*) const
stress/array-message-passing.js.no-llint: 12  0x111cf9f5c JSC::PropertySlot::getValue(JSC::JSGlobalObject*, JSC::PropertyName) const
stress/array-message-passing.js.no-llint: 13  0x1118a8fff operationGetByIdOptimize::$_1::operator()(bool, JSC::PropertySlot&) const
stress/array-message-passing.js.no-llint: 14  0x1118a8d9d std::__1::result_of<operationGetByIdOptimize::$_1 (bool, JSC::PropertySlot&)>::type JSC::JSValue::getPropertySlot<operationGetByIdOptimize::$_1>(JSC::JSGlobalObject*, JSC::PropertyName, JSC::PropertySlot&, operationGetByIdOptimize::$_1) const
stress/array-message-passing.js.no-llint: 15  0x111871e00 std::__1::result_of<operationGetByIdOptimize::$_1 (bool, JSC::PropertySlot&)>::type JSC::JSValue::getPropertySlot<operationGetByIdOptimize::$_1>(JSC::JSGlobalObject*, JSC::PropertyName, operationGetByIdOptimize::$_1) const
stress/array-message-passing.js.no-llint: 16  0x111871cd7 operationGetByIdOptimize
stress/array-message-passing.js.no-llint: 17  0x28e50d41a103
stress/array-message-passing.js.no-llint: 18  0x28e50d418e46
stress/array-message-passing.js.no-llint: 19  0x28e50d4134ed
stress/array-message-passing.js.no-llint: 20  0x28e50d411b1d
stress/array-message-passing.js.no-llint: 21  0x28e54d400ed3
stress/array-message-passing.js.no-llint: 22  0x1109c7133 vmEntryToJavaScript
stress/array-message-passing.js.no-llint: 23  0x1117d4227 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
stress/array-message-passing.js.no-llint: 24  0x1117d37eb JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*)
stress/array-message-passing.js.no-llint: 25  0x111b5b7ac JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
stress/array-message-passing.js.no-llint: 26  0x109c1462f runWithOptions(GlobalObject*, CommandLine&, bool&)
stress/array-message-passing.js.no-llint: 27  0x109be5a4a jscmain(int, char**)::$_6::operator()(JSC::VM&, GlobalObject*, bool&) const
stress/array-message-passing.js.no-llint: 28  0x109bc027b int runJSC<jscmain(int, char**)::$_6>(CommandLine const&, bool, jscmain(int, char**)::$_6 const&)
stress/array-message-passing.js.no-llint: 29  0x109bbed08 jscmain(int, char**)
stress/array-message-passing.js.no-llint: 30  0x109bbeade main
stress/array-message-passing.js.no-llint: 31  0x7fff704facc9 start

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200327/e37d91c0/attachment.htm>

More information about the webkit-unassigned mailing list