Bug 199139 - REGRESSION (r246714): ASSERTION FAILED: m_prototype.get().isEmpty() || isValidPrototype(m_prototype.get()) seen with API and JSC tests
Summary: REGRESSION (r246714): ASSERTION FAILED: m_prototype.get().isEmpty() || isVali...
Status: RESOLVED DUPLICATE of bug 196315
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-06-23 17:16 PDT by Ryan Haddad
Modified: 2019-06-24 20:38 PDT (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ryan Haddad 2019-06-23 17:16:48 PDT 
These tests are failing an assertion after r246714:

    TestWebKitAPI.WebKitLegacy.DidCreateJavaScriptContextAddCustomPropertiesFromJSTest
    TestWebKitAPI.WebKitLegacy.DidCreateJavaScriptContextAddCustomPropertiesFromObjCTest
    TestWebKitAPI.WebKitLegacy.DidCreateJavaScriptContextSanity2
    TestWebKitAPI.WebKitLegacy.DidCreateJavaScriptContextSanity1
    TestWebKitAPI.WebKitLegacy.DidCreateJavaScriptContextBackForwardCacheTest
    TestWebKitAPI.WebKitLegacy.DidCreateJavaScriptContextCallJSFunctionFromObjCCallbackTest
    TestWebKitAPI.WebKitLegacy.ReportExceptionTest

        ASSERTION FAILED: m_prototype.get().isEmpty() || isValidPrototype(m_prototype.get())
        /Volumes/Data/slave/mojave-debug/build/Source/JavaScriptCore/runtime/Structure.h(145) : void JSC::Structure::finishCreation(JSC::VM &)
        1   0x10442fdb9 WTFCrash
        2   0x104432b7b WTFCrashWithInfo(int, char const*, char const*, int)
        3   0x104985dc9 JSC::Structure::finishCreation(JSC::VM&)
        4   0x10496bff9 JSC::Structure::create(JSC::VM&, JSC::JSGlobalObject*, JSC::JSValue, JSC::TypeInfo const&, JSC::ClassInfo const*, unsigned char, unsigned int)
        5   0x10496be85 JSC::JSCallbackObject<JSC::JSAPIWrapperObject>::createStructure(JSC::VM&, JSC::JSGlobalObject*, JSC::JSValue)
        6   0x1049b6949 -[JSObjCClassInfo structureInContext:]
        7   0x1049b6409 -[JSObjCClassInfo wrapperForObject:inContext:]
        8   0x1049b73d1 -[JSWrapperMap jsWrapperForObject:inContext:]
        9   0x10496e6bd -[JSContext(Internal) wrapperForObjCObject:]
        10  0x10497a198 objectToValueWithoutCopy(JSContext*, objc_object*)
        11  0x104972e4f objectToValue(JSContext*, objc_object*)
        12  0x104975cc3 -[JSValue setValue:forProperty:]
        13  0x104978307 -[JSValue(SubscriptSupport) setObject:forKeyedSubscript:]
        14  0x10496e12c -[JSContext(SubscriptSupport) setObject:forKeyedSubscript:]
        15  0x102d1ae89 -[DidCreateJavaScriptContextFrameLoadDelegate webView:didCreateJavaScriptContext:forFrame:]
        16  0x10af79c39 objc_object* wtfCallIMP<objc_object*, WebView*, objc_object*, objc_object*>(void (*)(), objc_object*, objc_selector*, WebView*, objc_object*, objc_object*)
        17  0x10af77ed5 CallDelegate(void (*)(), WebView*, objc_object*, objc_selector*, objc_object*, objc_object*)
        18  0x10af77e75 CallFrameLoadDelegate(void (*)(), WebView*, objc_selector*, objc_object*, objc_object*)
        19  0x10afb406f WebFrameLoaderClient::dispatchDidClearWindowObjectInWorld(WebCore::DOMWrapperWorld&)
        20  0x1193018fc WebCore::FrameLoader::dispatchDidClearWindowObjectInWorld(WebCore::DOMWrapperWorld&)
        21  0x1184431f8 WebCore::ScriptController::initScriptForWindowProxy(WebCore::JSWindowProxy&)
        22  0x118497b73 WebCore::WindowProxy::createJSWindowProxyWithInitializedScript(WebCore::DOMWrapperWorld&)
        23  0x118431936 WebCore::WindowProxy::jsWindowProxy(WebCore::DOMWrapperWorld&)
        24  0x1184420bc WebCore::ScriptController::jsWindowProxy(WebCore::DOMWrapperWorld&)
        25  0x118441ead WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&, WebCore::ExceptionDetails*)
        26  0x11844233d WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&, WebCore::ExceptionDetails*)
        27  0x118b12af1 WebCore::ScriptElement::executeClassicScript(WebCore::ScriptSourceCode const&)
        28  0x118b10f58 WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport)
        29  0x118fb1037 WebCore::HTMLScriptRunner::runScript(WebCore::ScriptElement&, WTF::TextPosition const&)
        30  0x118fb0e5f WebCore::HTMLScriptRunner::execute(WTF::Ref<WebCore::ScriptElement, WTF::DumbPtrTraits<WebCore::ScriptElement> >&&, WTF::TextPosition const&)
        31  0x118f97dfb WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder()

https://build.webkit.org/builders/Apple%20Mojave%20Debug%20WK2%20%28Tests%29/builds/3224/steps/run-api-tests/logs/stdio
Comment 2 Ryan Haddad 2019-06-24 12:52:33 PDT 
Yusuke, is this fixed with https://bugs.webkit.org/show_bug.cgi?id=199144?
Comment 3 Ryan Haddad 2019-06-24 20:38:01 PDT 
The change was rolled out.

*** This bug has been marked as a duplicate of bug 196315 ***