Bug 266294 – ASSERTION FAILED: ptr under CodePtr.h(129) : static CodePtr<tag, attr> WTF::CodePtr<357>::fromTaggedPtr(void *) [tag = 357, attr = WTF::FunctionAttributes::None

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Karl Rackler]

https://build.webkit.org/#/builders/945/builds/2948

Description:
114 tests have the same assertion: Assert Failed ptr under CodePtr.h(129) : static CodePtr<tag, attr> WTF::CodePtr<357>::fromTaggedPtr(void *) [tag = 357, attr = WTF::FunctionAttributes::None

https://build.webkit.org/#/builders/945/builds/2948/steps/11/logs/stdio
Stdio:
 15.6.2 15.6.2 The Boolean Constructor; 15.6.2.1 new Boolean( value ); 15.6.2.2 new Boolean()
 ASSERTION FAILED: ptr
 /Volumes/Data/worker/Apple-Sonoma-LLINT-CLoop-BuildAndTest/build/WebKitBuild/Debug/usr/local/include/wtf/CodePtr.h(129) : static CodePtr<tag, attr> WTF::CodePtr<357>::fromTaggedPtr(void *) [tag = 357, attr = WTF::FunctionAttributes::None]
 1   0x110381ee9 WTFCrash
 2   0x1103845fb WTFCrashWithInfo(int, char const*, char const*, int)
 3   0x1109e050d WTF::CodePtr<(WTF::PtrTag)357, (WTF::FunctionAttributes)0>::fromTaggedPtr(void*)
 4   0x110e8cd4f WTF::CodePtr<(WTF::PtrTag)357, (WTF::FunctionAttributes)0> JSC::LLInt::getCodePtrImpl<(WTF::PtrTag)357>(void*, void const*)
 5   0x110e96787 WTF::CodePtr<(WTF::PtrTag)357, (WTF::FunctionAttributes)0> JSC::LLInt::getWide16CodePtr<(WTF::PtrTag)357>(JSC::OpcodeID)
 6   0x110e6c5d2 JSC::MacroAssemblerCodeRef<(WTF::PtrTag)357> JSC::LLInt::getWide16CodeRef<(WTF::PtrTag)357>(JSC::OpcodeID)
 7   0x110e6c541 JSC::LLInt::genericReturnPointEntrypoint(JSC::OpcodeSize)
 8   0x110e86362 llint_slow_path_call_direct_eval_wide16
 9   0x1106f5f07 JSC::LLInt::CLoop::execute(JSC::OpcodeID, void*, JSC::VM*, JSC::ProtoCallFrame*, bool)
 10  0x110e8bc4d vmEntryToJavaScript
 11  0x110e4820d JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*)
 12  0x110fc0f0d JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
 13  0x10b8248b1 runWithOptions(GlobalObject*, CommandLine&, bool&)
 14  0x10b7d020a jscmain(int, char**)::$_10::operator()(JSC::VM&, GlobalObject*, bool&) const
 15  0x10b7947fd int runJSC<jscmain(int, char**)::$_10>(CommandLine const&, bool, jscmain(int, char**)::$_10 const&)
 16  0x10b79202d jscmain(int, char**)
 17  0x10b791cd8 main
 18  0x7ff81229c3a6 start
 test_script_222: line 2: 84546 Segmentation fault: 11  ( "$@" ../../../../.vm/JavaScriptCore.framework/Helpers/jsc --useFTLJIT\=false --useFunctionDotArguments\=true --validateExceptionChecks\=true --useDollarVM\=true --maxPerThreadStackUsage\=1572864 --useJIT\=false ../shell.js 15.6.2.js )
 ERROR: Unexpected exit code: 139
FAIL: mozilla-tests.yaml/ecma/Boolean/15.6.2.js.mozilla-llint

[Radar WebKit Bug Importer]

<rdar://problem/119563251>

[Mark Lam]

Pull request: https://github.com/WebKit/WebKit/pull/21734

[EWS]

Committed 272012@main (aa62ce7b9059): <https://commits.webkit.org/272012@main>

Reviewed commits have been landed. Closing PR #21734 and removing active labels.