Bug 194440

Summary:	stress/array-slice-intrinsic.js.bytecode-cache failing on debug builds, ASSERTION FAILED: m_container
Product:	WebKit	Reporter:	Saam Barati <saam>
Component:	JavaScriptCore	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED CONFIGURATION CHANGED
Severity:	Normal	CC:	ap, benjamin, fpizlo, ggaren, gskachkov, guijemont, keith_miller, mark.lam, msaboff, rmorisset, ryanhaddad, ticaiolima, tzagallo, webkit-bot-watchers-bugzilla, webkit-bug-importer, ysuzuki
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Saam Barati

Reported 2019-02-08 10:43:43 PST

stress/array-slice-intrinsic.js.bytecode-cache: ASSERTION FAILED: m_container stress/array-slice-intrinsic.js.bytecode-cache: ./heap/WeakBlock.cpp(142) : void JSC::WeakBlock::visit(JSC::SlotVisitor &) stress/array-slice-intrinsic.js.bytecode-cache: 1 0x10a2ecd29 WTFCrash stress/array-slice-intrinsic.js.bytecode-cache: 2 0x10a2edd1b WTFCrashWithInfo(int, char const*, char const*, int) stress/array-slice-intrinsic.js.bytecode-cache: 3 0x10b34460e JSC::WeakBlock::visit(JSC::SlotVisitor&) stress/array-slice-intrinsic.js.bytecode-cache: 4 0x10b30fe8c JSC::WeakSet::visit(JSC::SlotVisitor&) stress/array-slice-intrinsic.js.bytecode-cache: 5 0x10b32f5c0 JSC::MarkedSpace::visitWeakSets(JSC::SlotVisitor&)::$_10::operator()(JSC::WeakSet*) const stress/array-slice-intrinsic.js.bytecode-cache: 6 0x10b32293f void WTF::SentinelLinkedList<JSC::WeakSet, WTF::BasicRawSentinelNode<JSC::WeakSet> >::forEach<JSC::MarkedSpace::visitWeakSets(JSC::SlotVisitor&)::$_10>(JSC::MarkedSpace::visitWeakSets(JSC::SlotVisitor&)::$_10 const&) stress/array-slice-intrinsic.js.bytecode-cache: 7 0x10b322886 JSC::MarkedSpace::visitWeakSets(JSC::SlotVisitor&) stress/array-slice-intrinsic.js.bytecode-cache: 8 0x10b2e50f1 JSC::Heap::addCoreConstraints()::$_33::operator()(JSC::SlotVisitor&) const stress/array-slice-intrinsic.js.bytecode-cache: 9 0x10b2e5071 WTF::Function<void (JSC::SlotVisitor&)>::CallableWrapper<JSC::Heap::addCoreConstraints()::$_33>::call(JSC::SlotVisitor&) stress/array-slice-intrinsic.js.bytecode-cache: 10 0x10b337bf7 WTF::Function<void (JSC::SlotVisitor&)>::operator()(JSC::SlotVisitor&) const stress/array-slice-intrinsic.js.bytecode-cache: 11 0x10b337b4c JSC::SimpleMarkingConstraint::executeImpl(JSC::SlotVisitor&) stress/array-slice-intrinsic.js.bytecode-cache: 12 0x10b32404c JSC::MarkingConstraint::execute(JSC::SlotVisitor&) stress/array-slice-intrinsic.js.bytecode-cache: 13 0x10b325a80 JSC::MarkingConstraintSolver::runExecutionThread(JSC::SlotVisitor&, JSC::MarkingConstraintSolver::SchedulerPreference, WTF::ScopedLambda<WTF::Optional<unsigned int> ()>) stress/array-slice-intrinsic.js.bytecode-cache: 14 0x10b335de4 JSC::MarkingConstraintSolver::execute(JSC::MarkingConstraintSolver::SchedulerPreference, WTF::ScopedLambda<WTF::Optional<unsigned int> ()>)::$_31::operator()(JSC::SlotVisitor&) const stress/array-slice-intrinsic.js.bytecode-cache: 15 0x10b335d71 WTF::SharedTaskFunctor<void (JSC::SlotVisitor&), JSC::MarkingConstraintSolver::execute(JSC::MarkingConstraintSolver::SchedulerPreference, WTF::ScopedLambda<WTF::Optional<unsigned int> ()>)::$_31>::run(JSC::SlotVisitor&) stress/array-slice-intrinsic.js.bytecode-cache: 16 0x10b2bd81a JSC::Heap::runTaskInParallel(WTF::RefPtr<WTF::SharedTask<void (JSC::SlotVisitor&)>, WTF::DumbPtrTraits<WTF::SharedTask<void (JSC::SlotVisitor&)> > >) stress/array-slice-intrinsic.js.bytecode-cache: 17 0x10b325832 void JSC::Heap::runFunctionInParallel<JSC::MarkingConstraintSolver::execute(JSC::MarkingConstraintSolver::SchedulerPreference, WTF::ScopedLambda<WTF::Optional<unsigned int> ()>)::$_31>(JSC::MarkingConstraintSolver::execute(JSC::MarkingConstraintSolver::SchedulerPreference, WTF::ScopedLambda<WTF::Optional<unsigned int> ()>)::$_31 const&) stress/array-slice-intrinsic.js.bytecode-cache: 18 0x10b325572 JSC::MarkingConstraintSolver::execute(JSC::MarkingConstraintSolver::SchedulerPreference, WTF::ScopedLambda<WTF::Optional<unsigned int> ()>) stress/array-slice-intrinsic.js.bytecode-cache: 19 0x10b324e92 JSC::MarkingConstraintSolver::drain(WTF::BitVector&) stress/array-slice-intrinsic.js.bytecode-cache: 20 0x10b324b8f JSC::MarkingConstraintSet::executeConvergenceImpl(JSC::SlotVisitor&) stress/array-slice-intrinsic.js.bytecode-cache: 21 0x10b324a7d JSC::MarkingConstraintSet::executeConvergence(JSC::SlotVisitor&) stress/array-slice-intrinsic.js.bytecode-cache: 22 0x10b2b5f13 JSC::Heap::runFixpointPhase(JSC::GCConductor) stress/array-slice-intrinsic.js.bytecode-cache: 23 0x10b2b4e6b JSC::Heap::runCurrentPhase(JSC::GCConductor, JSC::CurrentThreadState*) stress/array-slice-intrinsic.js.bytecode-cache: 24 0x10b2debda JSC::Heap::collectInMutatorThread()::$_0::operator()(JSC::CurrentThreadState&) const stress/array-slice-intrinsic.js.bytecode-cache: 25 0x10b2deb5c WTF::ScopedLambdaFunctor<void (JSC::CurrentThreadState&), JSC::Heap::collectInMutatorThread()::$_0>::implFunction(void*, JSC::CurrentThreadState&) stress/array-slice-intrinsic.js.bytecode-cache: 26 0x10b3126bc void WTF::ScopedLambda<void (JSC::CurrentThreadState&)>::operator()<JSC::CurrentThreadState&>(JSC::CurrentThreadState&&&) const stress/array-slice-intrinsic.js.bytecode-cache: 27 0x10b31264e JSC::callWithCurrentThreadState(WTF::ScopedLambda<void (JSC::CurrentThreadState&)> const&) stress/array-slice-intrinsic.js.bytecode-cache: 28 0x10b2b9b5b JSC::Heap::collectInMutatorThread() stress/array-slice-intrinsic.js.bytecode-cache: 29 0x10b2b98ea JSC::Heap::stopIfNecessarySlow(unsigned int) stress/array-slice-intrinsic.js.bytecode-cache: 30 0x10b2b96b6 JSC::Heap::stopIfNecessarySlow() stress/array-slice-intrinsic.js.bytecode-cache: 31 0x10b2b46af JSC::Heap::stopIfNecessary()

Attachments
Add attachment proposed patch, testcase, etc.

Saam Barati

Comment 1 2019-02-08 10:47:14 PST

Also fails in: stress/array-slice-jettison-on-constructor-change.js.bytecode-cache

Radar WebKit Bug Importer

Comment 2 2019-02-12 15:56:54 PST

<rdar://problem/48019126>

Tadeu Zagallo

Comment 3 2019-02-13 08:39:45 PST

I couldn't repro this on ToT.

Note You need to log in before you can comment on or make changes to this bug.