Bug 209658 - REGRESSION: 40+ JSC tests have started to crash with an assertion failure: !m_needExceptionCheck
Summary: REGRESSION: 40+ JSC tests have started to crash with an assertion failure: !m...
Status: RESOLVED DUPLICATE of bug 209663
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2020-03-27 09:30 PDT by Jacob Uphoff
Modified: 2020-03-27 11:39 PDT (History)
3 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jacob Uphoff 2020-03-27 09:30:24 PDT 
Failing JSC Tests:

jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout
	jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout-dfg-eager-no-cjit
	jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout-ftl-eager-no-cjit
	jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout-ftl-no-cjit
	jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout-no-cjit
	jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout-no-ftl
	jsc-layout-tests.yaml/js/script-tests/arraybuffer-wrappers.js.layout-no-llint
	microbenchmarks/DataView-custom-properties.js.no-ftl
	stress/array-message-passing.js.bytecode-cache
	stress/array-message-passing.js.default
	stress/array-message-passing.js.dfg-eager
	stress/array-message-passing.js.dfg-eager-no-cjit-validate
	stress/array-message-passing.js.eager-jettison-no-cjit
	stress/array-message-passing.js.ftl-eager
	stress/array-message-passing.js.ftl-eager-no-cjit
	stress/array-message-passing.js.ftl-eager-no-cjit-b3o1
	stress/array-message-passing.js.ftl-no-cjit-b3o0
	stress/array-message-passing.js.ftl-no-cjit-no-inline-validate
	stress/array-message-passing.js.ftl-no-cjit-no-put-stack-validate
	stress/array-message-passing.js.ftl-no-cjit-small-pool
	stress/array-message-passing.js.ftl-no-cjit-validate-sampling-profiler
	stress/array-message-passing.js.mini-mode
	stress/array-message-passing.js.no-cjit-validate-phases
	stress/array-message-passing.js.no-ftl
	stress/array-message-passing.js.no-llint
	stress/dataview-prototype-accessors.js.bytecode-cache
	stress/dataview-prototype-accessors.js.default
	stress/dataview-prototype-accessors.js.dfg-eager
	stress/dataview-prototype-accessors.js.dfg-eager-no-cjit-validate
	stress/dataview-prototype-accessors.js.eager-jettison-no-cjit
	stress/dataview-prototype-accessors.js.ftl-eager
	stress/dataview-prototype-accessors.js.ftl-eager-no-cjit
	stress/dataview-prototype-accessors.js.ftl-eager-no-cjit-b3o1
	stress/dataview-prototype-accessors.js.ftl-no-cjit-b3o0
	stress/dataview-prototype-accessors.js.ftl-no-cjit-no-inline-validate
	stress/dataview-prototype-accessors.js.ftl-no-cjit-no-put-stack-validate
	stress/dataview-prototype-accessors.js.ftl-no-cjit-small-pool
	stress/dataview-prototype-accessors.js.ftl-no-cjit-validate-sampling-profiler
	stress/dataview-prototype-accessors.js.mini-mode
	stress/dataview-prototype-accessors.js.no-cjit-validate-phases
	stress/dataview-prototype-accessors.js.no-ftl
	stress/dataview-prototype-accessors.js.no-llint

https://build.webkit.org/builders/Apple-Catalina-Debug-JSC-Tests/builds/570/steps/jscore-test/logs/stdio

 ASSERTION FAILED: !m_needExceptionCheck
stress/array-message-passing.js.no-llint: ./runtime/VM.cpp(1387) : void JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation &)
stress/array-message-passing.js.no-llint: 1   0x1104bbdb9 WTFCrash
stress/array-message-passing.js.no-llint: 2   0x110c1541b WTFCrashWithInfo(int, char const*, char const*, int)
stress/array-message-passing.js.no-llint: 3   0x111eb1a08 JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation&)
stress/array-message-passing.js.no-llint: 4   0x111e8a45d JSC::ThrowScope::~ThrowScope()
stress/array-message-passing.js.no-llint: 5   0x111e8a665 JSC::ThrowScope::~ThrowScope()
stress/array-message-passing.js.no-llint: 6   0x111c4af7b JSC::dataViewProtoGetterBuffer(JSC::JSGlobalObject*, JSC::CallFrame*)
stress/array-message-passing.js.no-llint: 7   0x1109c72dd vmEntryToNative
stress/array-message-passing.js.no-llint: 8   0x1117d49cc JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
stress/array-message-passing.js.no-llint: 9   0x111afa21c JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
stress/array-message-passing.js.no-llint: 10  0x111bc50c2 JSC::callGetter(JSC::JSGlobalObject*, JSC::JSValue, JSC::JSValue)
stress/array-message-passing.js.no-llint: 11  0x111de4c12 JSC::PropertySlot::functionGetter(JSC::JSGlobalObject*) const
stress/array-message-passing.js.no-llint: 12  0x111cf9f5c JSC::PropertySlot::getValue(JSC::JSGlobalObject*, JSC::PropertyName) const
stress/array-message-passing.js.no-llint: 13  0x1118a8fff operationGetByIdOptimize::$_1::operator()(bool, JSC::PropertySlot&) const
stress/array-message-passing.js.no-llint: 14  0x1118a8d9d std::__1::result_of<operationGetByIdOptimize::$_1 (bool, JSC::PropertySlot&)>::type JSC::JSValue::getPropertySlot<operationGetByIdOptimize::$_1>(JSC::JSGlobalObject*, JSC::PropertyName, JSC::PropertySlot&, operationGetByIdOptimize::$_1) const
stress/array-message-passing.js.no-llint: 15  0x111871e00 std::__1::result_of<operationGetByIdOptimize::$_1 (bool, JSC::PropertySlot&)>::type JSC::JSValue::getPropertySlot<operationGetByIdOptimize::$_1>(JSC::JSGlobalObject*, JSC::PropertyName, operationGetByIdOptimize::$_1) const
stress/array-message-passing.js.no-llint: 16  0x111871cd7 operationGetByIdOptimize
stress/array-message-passing.js.no-llint: 17  0x28e50d41a103
stress/array-message-passing.js.no-llint: 18  0x28e50d418e46
stress/array-message-passing.js.no-llint: 19  0x28e50d4134ed
stress/array-message-passing.js.no-llint: 20  0x28e50d411b1d
stress/array-message-passing.js.no-llint: 21  0x28e54d400ed3
stress/array-message-passing.js.no-llint: 22  0x1109c7133 vmEntryToJavaScript
stress/array-message-passing.js.no-llint: 23  0x1117d4227 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
stress/array-message-passing.js.no-llint: 24  0x1117d37eb JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*)
stress/array-message-passing.js.no-llint: 25  0x111b5b7ac JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
stress/array-message-passing.js.no-llint: 26  0x109c1462f runWithOptions(GlobalObject*, CommandLine&, bool&)
stress/array-message-passing.js.no-llint: 27  0x109be5a4a jscmain(int, char**)::$_6::operator()(JSC::VM&, GlobalObject*, bool&) const
stress/array-message-passing.js.no-llint: 28  0x109bc027b int runJSC<jscmain(int, char**)::$_6>(CommandLine const&, bool, jscmain(int, char**)::$_6 const&)
stress/array-message-passing.js.no-llint: 29  0x109bbed08 jscmain(int, char**)
stress/array-message-passing.js.no-llint: 30  0x109bbeade main
stress/array-message-passing.js.no-llint: 31  0x7fff704facc9 start
Comment 1 Radar WebKit Bug Importer 2020-03-27 09:30:52 PDT 
<rdar://problem/60970920>
Comment 2 Keith Miller 2020-03-27 11:39:01 PDT 
Fixed this in a different bugzilla... >.>

*** This bug has been marked as a duplicate of bug 209663 ***