<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - DFG ASSERTION FAILED: m_plan.weakReferences.contains(structure) in ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default"
href="https://bugs.webkit.org/show_bug.cgi?id=164440">164440</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>DFG ASSERTION FAILED: m_plan.weakReferences.contains(structure) in ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>WebKit Local Build
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>OS</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>JavaScriptCore
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>mark.lam@apple.com
</td>
</tr></table>
<p>
<div>
<pre>I saw this DFG assert while running the JSC tests on a debug build of 208404 with the patch from <a class="bz_bug_link
bz_status_ASSIGNED "
title="ASSIGNED - Error description code should be able to handle Symbol values."
href="show_bug.cgi?id=164436">https://bugs.webkit.org/show_bug.cgi?id=164436</a>. I don't think the patch from <a class="bz_bug_link
bz_status_ASSIGNED "
title="ASSIGNED - Error description code should be able to handle Symbol values."
href="show_bug.cgi?id=164436">https://bugs.webkit.org/show_bug.cgi?id=164436</a> matters here. The issue seems to be intermittent (racy). I have not been able to reproduce it yet, but just want to record it.
The crash info and trace dumped by the JSC test:
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: DFG ASSERTION FAILED: m_plan.weakReferences.contains(structure)
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: /Volumes/Data/ws7/OpenSource/Source/JavaScriptCore/dfg/DFGGraph.cpp(1526) : void JSC::DFG::Graph::assertIsRegistered(JSC::Structure *)
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 1 0x10d96437d WTFCrash
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 2 0x10d964399 WTFCrashWithSecurityImplication
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 3 0x10cd6773f JSC::DFG::crash(JSC::DFG::Graph&, WTF::CString const&, char const*, int, char const*, char const*)
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 4 0x10cd67549 JSC::DFG::Graph::handleAssertionFailure(std::nullptr_t, char const*, int, char const*, char const*)
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 5 0x10cd63fd4 JSC::DFG::Graph::assertIsRegistered(JSC::Structure*)
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 6 0x10cfe50a9 JSC::DFG::StructureAbstractValue::assertIsRegistered(JSC::DFG::Graph&) const
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 7 0x10cba76bd JSC::DFG::AbstractValue::assertIsRegistered(JSC::DFG::Graph&) const
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 8 0x10cba778e JSC::DFG::AbstractValue::set(JSC::DFG::Graph&, JSC::Structure*)
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 9 0x10cc5a5ff JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::executeEffects(unsigned int, JSC::DFG::Node*)
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 10 0x10cc4b65b JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::execute(unsigned int)
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 11 0x10cc4a505 JSC::DFG::CFAPhase::performBlockCFA(JSC::DFG::BasicBlock*)
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 12 0x10cc49e92 JSC::DFG::CFAPhase::performForwardCFA()
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 13 0x10cc49917 JSC::DFG::CFAPhase::run()
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 14 0x10cc49112 bool JSC::DFG::runAndLog<JSC::DFG::CFAPhase>(JSC::DFG::CFAPhase&)
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 15 0x10cc4906e bool JSC::DFG::runPhase<JSC::DFG::CFAPhase>(JSC::DFG::Graph&)
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 16 0x10cc49035 JSC::DFG::performCFA(JSC::DFG::Graph&)
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 17 0x10cec0065 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&)
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 18 0x10cebee69 JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*)
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 19 0x10d031295 JSC::DFG::Worklist::ThreadBody::work()
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 20 0x10d9c2c35 WTF::AutomaticThread::start(WTF::Locker<WTF::LockBase> const&)::$_0::operator()() const
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 21 0x10d9c29fd void std::__1::__invoke_void_return_wrapper<void>::__call<WTF::AutomaticThread::start(WTF::Locker<WTF::LockBase> const&)::$_0&>(WTF::AutomaticThread::start(WTF::Locker<WTF::LockBase> const&)::$_0&&&)
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 22 0x10d9c2799 std::__1::__function::__func<WTF::AutomaticThread::start(WTF::Locker<WTF::LockBase> const&)::$_0, std::__1::allocator<WTF::AutomaticThread::start(WTF::Locker<WTF::LockBase> const&)::$_0>, void ()>::operator()()
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 23 0x10cf006ba std::__1::function<void ()>::operator()() const
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 24 0x10d9d3a77 WTF::threadEntryPoint(void*)
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 25 0x10d9d5441 WTF::wtfThreadEntryPoint(void*)
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 26 0x7fff97ec4aab _pthread_body
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 27 0x7fff97ec49f7 _pthread_body
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: 28 0x7fff97ec41fd thread_start
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: test_script_30122: line 2: 74605 Segmentation fault: 11 ( "$@" ../../../../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --useFunctionDotArguments\=true --maxPerThreadStackUsage\=1572864 --useFTLJIT\=true --thresholdForJITAfterWarmUp\=10 --thresholdForJITSoon\=10 --thresholdForOptimizeAfterWarmUp\=20 --thresholdForOptimizeAfterLongWarmUp\=20 --thresholdForOptimizeSoon\=20 --thresholdForFTLOptimizeAfterWarmUp\=20 --thresholdForFTLOptimizeSoon\=20 --maximumEvalCacheableSourceLength\=150000 --useEagerCodeBlockJettisonTiming\=true jsc-lib.js array_includes.js )
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default: ERROR: Unexpected exit code: 139
** The following JSC stress test failures have been introduced:
ChakraCore.yaml/ChakraCore/test/Array/array_includes.js.default</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>