[Webkit-unassigned] [Bug 245887] New: REGRESSION (255003 at main): ASSERTION FAILED: currentDescriptor.attributes() == emptyAttributesDescriptor.attributes()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=245887

            Bug ID: 245887
           Summary: REGRESSION (255003 at main): ASSERTION FAILED:
                    currentDescriptor.attributes() ==
                    emptyAttributesDescriptor.attributes()
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: rackler at apple.com

Description:
** The following JSC stress test failures have been introduced:
        stress/stale-check-for-define-own-property-with-index.js.bytecode-cache
        stress/stale-check-for-define-own-property-with-index.js.default
        stress/stale-check-for-define-own-property-with-index.js.dfg-eager
        stress/stale-check-for-define-own-property-with-index.js.dfg-eager-no-cjit-validate
        stress/stale-check-for-define-own-property-with-index.js.eager-jettison-no-cjit
        stress/stale-check-for-define-own-property-with-index.js.ftl-eager
        stress/stale-check-for-define-own-property-with-index.js.ftl-eager-no-cjit-b3o1
        stress/stale-check-for-define-own-property-with-index.js.ftl-no-cjit-b3o0
        stress/stale-check-for-define-own-property-with-index.js.ftl-no-cjit-no-inline-validate
        stress/stale-check-for-define-own-property-with-index.js.ftl-no-cjit-no-put-stack-validate
        stress/stale-check-for-define-own-property-with-index.js.ftl-no-cjit-small-pool
        stress/stale-check-for-define-own-property-with-index.js.ftl-no-cjit-validate-sampling-profiler
        stress/stale-check-for-define-own-property-with-index.js.mini-mode
        stress/stale-check-for-define-own-property-with-index.js.no-cjit-validate-phases
        stress/stale-check-for-define-own-property-with-index.js.no-ftl
        stress/stale-check-for-define-own-property-with-index.js.no-llint

Build:
https://build.webkit.org/#/builders/378/builds/1751/steps/12/logs/stdio

History:
https://build.webkit.org/#/builders/Apple-Monterey-AppleSilicon-Debug-JSC-Tests?numbuilds=50

ASSERTION FAILED: currentDescriptor.attributes() == emptyAttributesDescriptor.attributes()
runtime/JSObject.cpp(2767) : bool JSC::JSObject::defineOwnIndexedProperty(JSC::JSGlobalObject *, unsigned int, const JSC::PropertyDescriptor &, bool)
1   0x16b8a1a90 (null)
2   0x1195734bd (null)
3   0x11170071e8 (null)
4   0x16b8a1a90 (null)
5   0x16b8a1a48 (null)
6   0x16b8a1a60 (null)
7   0x117007384 WTFPrintBacktrace
8   0x16b8a1a48 (null)
9   0x119f09738 vtable for CrashLogPrintStream
10  0x116b8a1a7c (null)
11  0x16b8a1a90 (null)
12  0x16b8a1ba0 (null)
13  0x11700731c WTFReportBacktrace
14  0x16b8a1a80 (null)
15  0x136b8a1e30 (null)
16  0x1170e576c WTFGetBacktrace
17  0x117007308 WTFReportBacktrace
test_script_31640: line 2:  5426 Segmentation fault: 11  ( "$@" ../../.vm/JavaScriptCore.framework/Helpers/jsc --useFTLJIT\=false --useFunctionDotArguments\=true --validateExceptionChecks\=true --useDollarVM\=true --maxPerThreadStackUsage\=1572864 --useArrayAllocationProfiling\=false --forcePolyProto\=true --useRandomizingExecutableIslandAllocation\=true --useFTLJIT\=true --useConcurrentJIT\=false --thresholdForJITAfterWarmUp\=100 --scribbleFreeCells\=true --maxDFGNodesInBasicBlockForPreciseAnalysis\=100 --defaultB3OptLevel\=0 --forceOSRExitToLLInt\=true stale-check-for-define-own-property-with-index.js )

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220930/5c59c9b6/attachment-0001.htm>