Bug 162986

Summary:

[mac-wk1 debug] ASSERTION FAILED: thisObject->m_propertyTableUnsafe

Product:

WebKit

Reporter:

Ryan Haddad <ryanhaddad>

Component:

JavaScriptCore

Assignee:

Filip Pizlo <fpizlo>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

ap, commit-queue, fpizlo, ggaren, joepeck, keith_miller, mark.lam, msaboff, saam, webkit-bug-importer

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
the patch	saam: review+

Ryan Haddad

Reported 2016-10-05 14:24:44 PDT

LayoutTest inspector/formatting/formatting-javascript.html is a flaky crash https://build.webkit.org/builders/Apple%20Sierra%20Debug%20WK1%20(Tests)/builds/314 https://webkit-test-results.webkit.org/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=inspector%2Fformatting%2Fformatting-javascript.html ASSERTION FAILED: thisObject->m_propertyTableUnsafe /Volumes/Data/slave/sierra-debug/build/Source/JavaScriptCore/runtime/Structure.cpp(1127) : static void JSC::Structure::visitChildren(JSC::JSCell *, JSC::SlotVisitor &) 1 0x10ef71acd WTFCrash 2 0x10eda6bb2 JSC::Structure::visitChildren(JSC::JSCell*, JSC::SlotVisitor&) 3 0x10ed84496 JSC::SlotVisitor::visitChildren(JSC::JSCell const*) 4 0x10ed84280 JSC::SlotVisitor::drain() 5 0x10ed85172 JSC::SlotVisitor::donateAndDrain() 6 0x10e7dfc8a JSC::Heap::visitConservativeRoots(JSC::ConservativeRoots&) 7 0x10e7df5be JSC::Heap::markRoots(double, void*, void*, int (&) [37]) 8 0x10e7e32fc JSC::Heap::collectImpl(JSC::HeapOperation, void*, void*, int (&) [37]) 9 0x10e7e2bdd JSC::Heap::collectWithoutAnySweep(JSC::HeapOperation) 10 0x10e7e2d50 JSC::Heap::collect(JSC::HeapOperation) 11 0x10dfcb637 JSC::Heap::collectIfNecessaryOrDefer(JSC::GCDeferralContext*) 12 0x10dfcb4af JSC::Heap::decrementDeferralDepthAndGCIfNeeded() 13 0x10dfcb458 JSC::DeferGC::~DeferGC() 14 0x10dfcafc5 JSC::DeferGC::~DeferGC() 15 0x10eda9471 JSC::Structure::takePropertyTableOrCloneIfPinned(JSC::VM&) 16 0x10eda8e7a JSC::Structure::addNewPropertyTransition(JSC::VM&, JSC::Structure*, JSC::PropertyName, unsigned int, int&, JSC::PutPropertySlot::Context, JSC::DeferredStructureTransitionWatchpointFire*) 17 0x10e1f882b bool JSC::JSObject::putDirectInternal<(JSC::JSObject::PutMode)0>(JSC::VM&, JSC::PropertyName, JSC::JSValue, unsigned int, JSC::PutPropertySlot&) 18 0x10e1f7a95 JSC::JSObject::putInline(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) 19 0x10e1f2ff4 JSC::JSValue::putInline(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) 20 0x10e949dc3 operationPutByIdStrict 21 0x452ccf0481cf 22 0x452ccf0a8242 23 0x452ccf096126 24 0x452ccf047e73 25 0x452ccf0963dd 26 0x452ccf047e73 27 0x452ccf09ad93 28 0x452ccf047e73 29 0x452ccf096699 30 0x452ccf047e73 31 0x452ccf0a8242

Attachments
the patch (3.01 KB, patch) 2016-11-15 12:25 PST, Filip Pizlo	saam: review+	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.