Bug 197885 – REGRESSION (r245249): ASSERTION FAILED: !m_needExceptionCheck seen with stress/proxy-delete.js and stress/proxy-property-descriptor.js

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Ryan Haddad]

ASSERTION FAILED: !m_needExceptionCheck seen with stress/proxy-delete.js and stress/proxy-property-descriptor.js on the JSC Debug bot

stress/proxy-delete.js.default: ERROR: Unchecked JS exception:
stress/proxy-delete.js.default:     This scope can throw a JS exception: getOwnPropertyDescriptor @ ./runtime/JSObject.cpp:3444
stress/proxy-delete.js.default:         (ExceptionScope::m_recursionDepth was 6)
stress/proxy-delete.js.default:     But the exception was unchecked as of this scope: performDelete @ ./runtime/ProxyObject.cpp:615
stress/proxy-delete.js.default:         (ExceptionScope::m_recursionDepth was 5)
stress/proxy-delete.js.default: 
stress/proxy-delete.js.default: Unchecked exception detected at:
stress/proxy-delete.js.default:     1   0x1140c10b3 JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation&)
stress/proxy-delete.js.default:     2   0x114098e21 JSC::ThrowScope::throwException(JSC::ExecState*, JSC::JSObject*)
stress/proxy-delete.js.default:     3   0x112e6ea15 JSC::throwException(JSC::ExecState*, JSC::ThrowScope&, JSC::JSObject*)
stress/proxy-delete.js.default:     4   0x113e17557 JSC::throwTypeError(JSC::ExecState*, JSC::ThrowScope&, WTF::String const&)
stress/proxy-delete.js.default:     5   0x113e176d0 JSC::throwTypeError(JSC::ExecState*, JSC::ThrowScope&, WTF::ASCIILiteral)
stress/proxy-delete.js.default:     6   0x1137364ad JSC::throwVMTypeError(JSC::ExecState*, JSC::ThrowScope&, WTF::ASCIILiteral)
stress/proxy-delete.js.default:     7   0x11400ad71 bool JSC::ProxyObject::performDelete<JSC::ProxyObject::deleteProperty(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName)::$_4>(JSC::ExecState*, JSC::PropertyName, JSC::ProxyObject::deleteProperty(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName)::$_4)
stress/proxy-delete.js.default:     8   0x1140057c5 JSC::ProxyObject::deleteProperty(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName)
stress/proxy-delete.js.default:     9   0x113b59523 operationDeleteById
stress/proxy-delete.js.default:     10  0x113b59345 operationDeleteByIdJSResult
stress/proxy-delete.js.default:     11  0x7491489f233
stress/proxy-delete.js.default:     12  0x112e3ce13 vmEntryToJavaScript
stress/proxy-delete.js.default:     13  0x113abc00e JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
stress/proxy-delete.js.default:     14  0x113abb5a0 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*)
stress/proxy-delete.js.default:     15  0x113de7345 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
stress/proxy-delete.js.default:     16  0x10fc5e277 runWithOptions(GlobalObject*, CommandLine&, bool&)
stress/proxy-delete.js.default:     17  0x10fc33daa jscmain(int, char**)::$_6::operator()(JSC::VM&, GlobalObject*, bool&) const
stress/proxy-delete.js.default:     18  0x10fc13204 int runJSC<jscmain(int, char**)::$_6>(CommandLine const&, bool, jscmain(int, char**)::$_6 const&)
stress/proxy-delete.js.default:     19  0x10fc11931 jscmain(int, char**)
stress/proxy-delete.js.default:     20  0x10fc1179e main
stress/proxy-delete.js.default:     21  0x7fff615ed015 start

https://build.webkit.org/builders/Apple%20High%20Sierra%20Debug%20JSC%20%28Tests%29/builds/2788

[Radar WebKit Bug Importer]

<rdar://problem/50770190>

[Radar WebKit Bug Importer]

<rdar://problem/50770194>

[Tadeu Zagallo]

Created attachment 369864 [details]
Patch

[Yusuke Suzuki]

Comment on attachment 369864 [details]
Patch

r=me

[WebKit Commit Bot]

Comment on attachment 369864 [details]
Patch

Clearing flags on attachment: 369864

Committed r245311: <https://trac.webkit.org/changeset/245311>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.