Bug 245887 – REGRESSION (255003@main): ASSERTION FAILED: currentDescriptor.attributes() == emptyAttributesDescriptor.attributes()

• Status: RESOLVED
• Resolution: DUPLICATE
• Component: JavaScriptCore

[Karl Rackler]

Description:
** The following JSC stress test failures have been introduced:
	stress/stale-check-for-define-own-property-with-index.js.bytecode-cache
	stress/stale-check-for-define-own-property-with-index.js.default
	stress/stale-check-for-define-own-property-with-index.js.dfg-eager
	stress/stale-check-for-define-own-property-with-index.js.dfg-eager-no-cjit-validate
	stress/stale-check-for-define-own-property-with-index.js.eager-jettison-no-cjit
	stress/stale-check-for-define-own-property-with-index.js.ftl-eager
	stress/stale-check-for-define-own-property-with-index.js.ftl-eager-no-cjit-b3o1
	stress/stale-check-for-define-own-property-with-index.js.ftl-no-cjit-b3o0
	stress/stale-check-for-define-own-property-with-index.js.ftl-no-cjit-no-inline-validate
	stress/stale-check-for-define-own-property-with-index.js.ftl-no-cjit-no-put-stack-validate
	stress/stale-check-for-define-own-property-with-index.js.ftl-no-cjit-small-pool
	stress/stale-check-for-define-own-property-with-index.js.ftl-no-cjit-validate-sampling-profiler
	stress/stale-check-for-define-own-property-with-index.js.mini-mode
	stress/stale-check-for-define-own-property-with-index.js.no-cjit-validate-phases
	stress/stale-check-for-define-own-property-with-index.js.no-ftl
	stress/stale-check-for-define-own-property-with-index.js.no-llint

Build:
https://build.webkit.org/#/builders/378/builds/1751/steps/12/logs/stdio

History:
https://build.webkit.org/#/builders/Apple-Monterey-AppleSilicon-Debug-JSC-Tests?numbuilds=50

ASSERTION FAILED: currentDescriptor.attributes() == emptyAttributesDescriptor.attributes()
runtime/JSObject.cpp(2767) : bool JSC::JSObject::defineOwnIndexedProperty(JSC::JSGlobalObject *, unsigned int, const JSC::PropertyDescriptor &, bool)
1   0x16b8a1a90 (null)
2   0x1195734bd (null)
3   0x11170071e8 (null)
4   0x16b8a1a90 (null)
5   0x16b8a1a48 (null)
6   0x16b8a1a60 (null)
7   0x117007384 WTFPrintBacktrace
8   0x16b8a1a48 (null)
9   0x119f09738 vtable for CrashLogPrintStream
10  0x116b8a1a7c (null)
11  0x16b8a1a90 (null)
12  0x16b8a1ba0 (null)
13  0x11700731c WTFReportBacktrace
14  0x16b8a1a80 (null)
15  0x136b8a1e30 (null)
16  0x1170e576c WTFGetBacktrace
17  0x117007308 WTFReportBacktrace
test_script_31640: line 2:  5426 Segmentation fault: 11  ( "$@" ../../.vm/JavaScriptCore.framework/Helpers/jsc --useFTLJIT\=false --useFunctionDotArguments\=true --validateExceptionChecks\=true --useDollarVM\=true --maxPerThreadStackUsage\=1572864 --useArrayAllocationProfiling\=false --forcePolyProto\=true --useRandomizingExecutableIslandAllocation\=true --useFTLJIT\=true --useConcurrentJIT\=false --thresholdForJITAfterWarmUp\=100 --scribbleFreeCells\=true --maxDFGNodesInBasicBlockForPreciseAnalysis\=100 --defaultB3OptLevel\=0 --forceOSRExitToLLInt\=true stale-check-for-define-own-property-with-index.js )

[Radar WebKit Bug Importer]

<rdar://problem/100624366>

[Karl Rackler]

*** This bug has been marked as a duplicate of bug 245819 ***