[Webkit-unassigned] [Bug 273957] New: REGRESSION (278369 at main): [ Ventura Debug ] 9X WebGL tests and js/dom/typed-array-set-different-types.html are crashing on Ventura

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=273957

            Bug ID: 273957
           Summary: REGRESSION (278369 at main): [ Ventura Debug ] 9X WebGL
                    tests and js/dom/typed-array-set-different-types.html
                    are crashing on Ventura
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: New Bugs
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: j_stfleur at apple.com

These 6 test are consistent crashing :
fast/canvas/webgl/array-message-passing.html 
fast/canvas/webgl/array-unit-tests.html 
fast/canvas/webgl/arraybuffer-transfer-of-control.html 
js/dom/typed-array-set-different-types.html
webgl/1.0.3/conformance/typedarrays/array-unit-tests.html 
webgl/2.0.0/conformance/typedarrays/array-unit-tests.html

These 3 are somewhat flaky:
fast/canvas/webgl/typed-arrays-in-workers.html 
webgl/1.0.3/conformance/typedarrays/typed-arrays-in-workers.html 
webgl/2.0.0/conformance/typedarrays/typed-arrays-in-workers.html

all 9 tests seemed to have regressed after changes on 278369 at main

Buildbot URL:
https://build.webkit.org/#/builders/701/builds/4618

History:
https://results.webkit.org/?suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&test=fast%2Fcanvas%2Fwebgl%2Farray-message-passing.html&test=fast%2Fcanvas%2Fwebgl%2Farray-unit-tests.html&test=fast%2Fcanvas%2Fwebgl%2Farraybuffer-transfer-of-control.html&test=fast%2Fcanvas%2Fwebgl%2Ftyped-arrays-in-workers.html&test=js%2Fdom%2Ftyped-array-set-different-types.html&test=webgl%2F1.0.3%2Fconformance%2Ftypedarrays%2Farray-unit-tests.html&test=webgl%2F1.0.3%2Fconformance%2Ftypedarrays%2Ftyped-arrays-in-workers.html&test=webgl%2F2.0.0%2Fconformance%2Ftypedarrays%2Farray-unit-tests.html&test=webgl%2F2.0.0%2Fconformance%2Ftypedarrays%2Ftyped-arrays-in-workers.html&version_name=Ventura&style=debug

Diff/Image Diff/Crash Log:

stderr:
ASSERTION FAILED: structure
/Volumes/Data/worker/Apple-Ventura-Debug-Build/build/Source/JavaScriptCore/runtime/StructureID.h(147) : static JSC::StructureID JSC::StructureID::encode(const JSC::Structure *)
com.apple.WebKit.WebContent.Development terminated (pid 55146) for reason: crash

Reproducibility: 
No crash log data was output but I was able to reproduce using command run-webkit-test webgl/2.0.0/conformance/typedarrays/array-unit-tests.html -v --iterations 5

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20240509/47f1fcc2/attachment.htm>