Bug 288931

Summary:	REGRESSION(291398@main): ASSERTION FAILED: expected.asNumber() == result.asNumber() in JSC::EncodedJSValue JSC::arrayProtoFuncIndexOf(JSGlobalObject , CallFrame )
Product:	WebKit	Reporter:	Fujii Hironori <fujii.hironori>
Component:	JavaScriptCore	Assignee:	Yijia Huang <yijia_huang>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	aosukeke, webkit-bug-importer, yijia_huang
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified
See Also:	https://bugs.webkit.org/show_bug.cgi?id=288548

Fujii Hironori

Reported 2025-03-01 16:17:16 PST

The following tests are crashing due to an assertion failure. imported/w3c/web-platform-tests/css/css-animations/inheritance.html imported/w3c/web-platform-tests/css/css-grid/grid-definition/grid-support-flexible-lengths-001.html History: https://results.webkit.org/?suite=layout-tests&suite=layout-tests&test=imported%2Fw3c%2Fweb-platform-tests%2Fcss%2Fcss-grid%2Fgrid-definition%2Fgrid-support-flexible-lengths-001.html&test=imported%2Fw3c%2Fweb-platform-tests%2Fcss%2Fcss-animations%2Finheritance.html&style=debug stderr: https://build.webkit.org/results/Apple-Sequoia-Debug-WK1-Tests/291412@main%20(1236)/imported/w3c/web-platform-tests/css/css-animations/inheritance-crash-log.txt ASSERTION FAILED: expected.asNumber() == result.asNumber() ./runtime/ArrayPrototype.cpp(1537) : JSC::EncodedJSValue JSC::arrayProtoFuncIndexOf(JSGlobalObject *, CallFrame *) 1 0x11d40e93e JSC::arrayProtoFuncIndexOf(JSC::JSGlobalObject*, JSC::CallFrame*) 2 0x186728118 1 ??? 0x0000000186728118 0x0 + 6550618392 3 0x11e3824df jsc_llint_commonCallOp__llintOpWithMetadata__llintOpWithReturn__llintOp__commonOp__fn__fn__makeReturn__fn__fn__fn__916_callHelper__dispatch_LowLevelInterpreter64_asm_2535 4 0x186a315f7 3 ??? 0x0000000186a315f7 0x0 + 6553802231 5 0x11e38391b jsc_llint_commonCallOp__llintOpWithMetadata__llintOpWithReturn__llintOp__commonOp__fn__fn__makeReturn__fn__fn__fn__934_callHelper__dispatch_LowLevelInterpreter64_asm_2535 6 0x11e38391b jsc_llint_commonCallOp__llintOpWithMetadata__llintOpWithReturn__llintOp__commonOp__fn__fn__makeReturn__fn__fn__fn__934_callHelper__dispatch_LowLevelInterpreter64_asm_2535 7 0x11e38391b jsc_llint_commonCallOp__llintOpWithMetadata__llintOpWithReturn__llintOp__commonOp__fn__fn__makeReturn__fn__fn__fn__934_callHelper__dispatch_LowLevelInterpreter64_asm_2535 8 0x11e3824df jsc_llint_commonCallOp__llintOpWithMetadata__llintOpWithReturn__llintOp__commonOp__fn__fn__makeReturn__fn__fn__fn__916_callHelper__dispatch_LowLevelInterpreter64_asm_2535 9 0x11e35a5ba llint_call_javascript 10 0x11d182d17 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*) 11 0x11d4e740b JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 12 0x11d4e756c JSC::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 13 0x1696e9fb8 WebCore::JSExecState::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 14 0x1696e997a WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) 15 0x1696e9609 WebCore::ScriptController::evaluateInWorldIgnoringException(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) 16 0x1696e9db5 WebCore::ScriptController::evaluateIgnoringException(WebCore::ScriptSourceCode const&) 17 0x16a59a556 WebCore::ScriptElement::executeClassicScript(WebCore::ScriptSourceCode const&) 18 0x16a509421 WebCore::LoadableClassicScript::execute(WebCore::ScriptElement&) 19 0x16a59cf79 WebCore::ScriptElement::executeScriptAndDispatchEvent(WebCore::LoadableScript&) 20 0x16a59d24b WebCore::ScriptElement::executePendingScript(WebCore::PendingScript&) 21 0x16ac68a71 WebCore::HTMLScriptRunner::executePendingScriptAndDispatchEvent(WebCore::PendingScript&) 22 0x16ac6935b WebCore::HTMLScriptRunner::executeParsingBlockingScripts() 23 0x16ac68c61 WebCore::HTMLScriptRunner::execute(WTF::Ref<WebCore::ScriptElement, WTF::RawPtrTraits<WebCore::ScriptElement>, WTF::DefaultRefDerefTraits<WebCore::ScriptElement>>&&, WTF::TextPosition const&) 24 0x16ac2b78e WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder() 25 0x16ac2bd1f WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&) 26 0x16ac2ae3d WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) 27 0x16ac2a4c2 WebCore::HTMLDocumentParser::pumpTokenizerIfPossible(WebCore::HTMLDocumentParser::SynchronousMode) 28 0x16ac2cac1 WebCore::HTMLDocumentParser::append(WTF::RefPtr<WTF::StringImpl, WTF::RawPtrTraits<WTF::StringImpl>, WTF::DefaultRefDerefTraits<WTF::StringImpl>>&&, WebCore::HTMLDocumentParser::SynchronousMode) 29 0x16ac2c87f WebCore::HTMLDocumentParser::append(WTF::RefPtr<WTF::StringImpl, WTF::RawPtrTraits<WTF::StringImpl>, WTF::DefaultRefDerefTraits<WTF::StringImpl>>&&) 30 0x16a2db0b4 WebCore::DecodedDataDocumentParser::appendBytes(WebCore::DocumentWriter&, std::__1::span<unsigned char const, 18446744073709551615ul>) 31 0x16b11c174 WebCore::DocumentWriter::addData(WebCore::SharedBuffer const&)

Attachments
Add attachment proposed patch, testcase, etc.

Sosuke Suzuki

Comment 1 2025-03-01 18:46:54 PST

Probably caused by https://commits.webkit.org/291398@main

Radar WebKit Bug Importer

Comment 2 2025-03-01 19:34:43 PST

<rdar://problem/145945591>

Yijia Huang

Comment 3 2025-03-03 16:12:00 PST

Pull request: https://github.com/WebKit/WebKit/pull/41818

EWS

Comment 4 2025-03-03 16:24:55 PST

Committed 291535@main (db2338357f30): <https://commits.webkit.org/291535@main> Reviewed commits have been landed. Closing PR #41818 and removing active labels.

Note You need to log in before you can comment on or make changes to this bug.