Bug 273659 – ASSERTION FAILED: cellsToMark.isEmpty() and crashes on 'neowin.net'

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Ahmad Saleem]

Hi Team,

Just built and new debug build on top of (278288@main) and I am hitting following assert on 'neowin.net':

ASSERTION FAILED: cellsToMark.isEmpty()
./bytecode/InlineCacheCompiler.cpp(4598) : AccessGenerationResult JSC::InlineCacheCompiler::regenerate(const GCSafeConcurrentJSLocker &, PolymorphicAccess &, CodeBlock *)

with following crash logs:

Translated Report (Full Report Below)
-------------------------------------

Process:               com.apple.WebKit.WebContent.Development [55579]
Path:                  /Users/USER/Documents/*/com.apple.WebKit.WebContent.Development
Identifier:            com.apple.WebKit.WebContent
Version:               619+ (619.1.12+)
Code Type:             ARM-64 (Native)
Parent Process:        launchd.developm [1]
Responsible:           MiniBrowser [55567]
User ID:               501

Date/Time:             2024-05-03 00:41:54.2318 +0100
OS Version:            macOS 14.5 (23F75)
Report Version:        12
Anonymous UUID:        FF42BCDB-E957-3E9D-F539-C08420776639

Sleep/Wake UUID:       CE378865-D96E-4397-B79F-3367D5877267

Time Awake Since Boot: 120000 seconds
Time Since Wake:       2367 seconds

System Integrity Protection: enabled

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BREAKPOINT (SIGTRAP)
Exception Codes:       0x0000000000000001, 0x000000013b9fdad4

Termination Reason:    Namespace SIGNAL, Code 5 Trace/BPT trap: 5
Terminating Process:   exc handler [55579]

Application Specific Information:
dyld config: DYLD_LIBRARY_PATH=/Users/ahmadsaleem/Documents/GitHub/WebKit/WebKitBuild/Debug DYLD_FRAMEWORK_PATH=/Users/ahmadsaleem/Documents/GitHub/WebKit/WebKitBuild/Debug


Thread 0 Crashed::  Dispatch queue: com.apple.main-thread
0   JavaScriptCore                	       0x13b9fdad4 WTFCrashWithInfo(int, char const*, char const*, int) + 100
1   JavaScriptCore                	       0x13c1a3ef8 JSC::InlineCacheCompiler::regenerate(JSC::GCSafeConcurrentJSLocker const&, JSC::PolymorphicAccess&, JSC::CodeBlock*) + 10912
2   JavaScriptCore                	       0x13c241e74 JSC::StructureStubInfo::addAccessCase(JSC::GCSafeConcurrentJSLocker const&, JSC::JSGlobalObject*, JSC::CodeBlock*, JSC::ECMAMode, JSC::CacheableIdentifier, WTF::RefPtr<JSC::AccessCase, WTF::RawPtrTraits<JSC::AccessCase>, WTF::DefaultRefDerefTraits<JSC::AccessCase>>)::$_1::operator()() const + 1236
3   JavaScriptCore                	       0x13c2418a0 JSC::StructureStubInfo::addAccessCase(JSC::GCSafeConcurrentJSLocker const&, JSC::JSGlobalObject*, JSC::CodeBlock*, JSC::ECMAMode, JSC::CacheableIdentifier, WTF::RefPtr<JSC::AccessCase, WTF::RawPtrTraits<JSC::AccessCase>, WTF::DefaultRefDerefTraits<JSC::AccessCase>>) + 280
4   JavaScriptCore                	       0x13c215770 JSC::tryCachePutBy(JSC::JSGlobalObject*, JSC::CodeBlock*, JSC::JSValue, JSC::Structure*, JSC::CacheableIdentifier, JSC::PutPropertySlot const&, JSC::StructureStubInfo&, JSC::PutByKind) + 5616
5   JavaScriptCore                	       0x13c213f94 JSC::repatchPutBy(JSC::JSGlobalObject*, JSC::CodeBlock*, JSC::JSValue, JSC::Structure*, JSC::CacheableIdentifier, JSC::PutPropertySlot const&, JSC::StructureStubInfo&, JSC::PutByKind) + 112
6   JavaScriptCore                	       0x13ccd2708 operationPutByIdSloppyOptimize + 996
7   ???                           	       0x148834420 ???
8   JavaScriptCore                	       0x13db8532c llint_entry + 157200
9   ???                           	       0x148899b6c ???
10  JavaScriptCore                	       0x13db8532c llint_entry + 157200
11  JavaScriptCore                	       0x13db8532c llint_entry + 157200
12  JavaScriptCore                	       0x13db86448 llint_entry + 161580
13  JavaScriptCore                	       0x13db86448 llint_entry + 161580
14  JavaScriptCore                	       0x13db86828 llint_entry + 162572
15  JavaScriptCore                	       0x13db86448 llint_entry + 161580
16  JavaScriptCore                	       0x13db8532c llint_entry + 157200
17  JavaScriptCore                	       0x13db5eab4 vmEntryToJavaScript + 176
18  JavaScriptCore                	       0x13cbef66c JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*) + 7944
19  JavaScriptCore                	       0x13cf2552c JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 524
20  JavaScriptCore                	       0x13cf256a8 JSC::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 80
21  WebCore                       	       0x3034736cc WebCore::JSExecState::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 164 (JSExecState.h:104)
22  WebCore                       	       0x303473184 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) + 388 (ScriptController.cpp:159)
23  WebCore                       	       0x303472fb8 WebCore::ScriptController::evaluateInWorldIgnoringException(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) + 48 (ScriptController.cpp:126)
24  WebCore                       	       0x303473954 WebCore::ScriptController::evaluateIgnoringException(WebCore::ScriptSourceCode const&) + 56 (ScriptController.cpp:178)
25  WebCore                       	       0x303f05a5c WebCore::ScriptElement::executeClassicScript(WebCore::ScriptSourceCode const&) + 1032 (ScriptElement.cpp:439)
26  WebCore                       	       0x303e52768 WebCore::LoadableClassicScript::execute(WebCore::ScriptElement&) + 216 (LoadableClassicScript.cpp:173)
27  WebCore                       	       0x303f06d04 WebCore::ScriptElement::executeScriptAndDispatchEvent(WebCore::LoadableScript&) + 712 (ScriptElement.cpp:556)
28  WebCore                       	       0x303f06fd4 WebCore::ScriptElement::executePendingScript(WebCore::PendingScript&) + 344 (ScriptElement.cpp:573)
29  WebCore                       	       0x304556fa0 WebCore::HTMLScriptRunner::executePendingScriptAndDispatchEvent(WebCore::PendingScript&) + 148 (HTMLScriptRunner.cpp:115)
30  WebCore                       	       0x30455773c WebCore::HTMLScriptRunner::executeParsingBlockingScripts() + 464 (HTMLScriptRunner.cpp:165)
31  WebCore                       	       0x304557174 WebCore::HTMLScriptRunner::execute(WTF::Ref<WebCore::ScriptElement, WTF::RawPtrTraits<WebCore::ScriptElement>, WTF::DefaultRefDerefTraits<WebCore::ScriptElement>>&&, WTF::TextPosition const&) + 192 (HTMLScriptRunner.cpp:149)
32  WebCore                       	       0x30451762c WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder() + 872 (HTMLDocumentParser.cpp:245)
33  WebCore                       	       0x304517b3c WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&) + 184 (HTMLDocumentParser.cpp:265)
34  WebCore                       	       0x304516ea8 WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) + 456 (HTMLDocumentParser.cpp:310)
35  WebCore                       	       0x304517240 WebCore::HTMLDocumentParser::resumeParsingAfterYield() + 52 (HTMLDocumentParser.cpp:213)
36  WebCore                       	       0x30454b228 WebCore::HTMLParserScheduler::continueNextChunkTimerFired() + 196 (HTMLParserScheduler.cpp:101)
37  WebCore                       	       0x304554e90 decltype(*std::declval<WebCore::HTMLParserScheduler*&>().*std::declval<void (WebCore::HTMLParserScheduler::*&)()>()()) std::__1::__invoke[abi:un170006]<void (WebCore::HTMLParserScheduler::*&)(), WebCore::HTMLParserScheduler*&, void>(void (WebCore::HTMLParserScheduler::*&)(), WebCore::HTMLParserScheduler*&) + 116 (invoke.h:308)
38  WebCore                       	       0x304554e10 std::__1::__bind_return<void (WebCore::HTMLParserScheduler::*)(), std::__1::tuple<WebCore::HTMLParserScheduler*>, std::__1::tuple<>, __is_valid_bind_return<void (WebCore::HTMLParserScheduler::*)(), std::__1::tuple<WebCore::HTMLParserScheduler*>, std::__1::tuple<>>::value>::type std::__1::__apply_functor[abi:un170006]<void (WebCore::HTMLParserScheduler::*)(), std::__1::tuple<WebCore::HTMLParserScheduler*>, 0ul, std::__1::tuple<>>(void (WebCore::HTMLParserScheduler::*&)(), std::__1::tuple<WebCore::HTMLParserScheduler*>&, std::__1::__tuple_indices<0ul>, std::__1::tuple<>&&) + 60 (bind.h:260)
39  WebCore                       	       0x304554dc8 std::__1::__bind_return<void (WebCore::HTMLParserScheduler::*)(), std::__1::tuple<WebCore::HTMLParserScheduler*>, std::__1::tuple<>, __is_valid_bind_return<void (WebCore::HTMLParserScheduler::*)(), std::__1::tuple<WebCore::HTMLParserScheduler*>, std::__1::tuple<>>::value>::type std::__1::__bind<void (WebCore::HTMLParserScheduler::*&)(), WebCore::HTMLParserScheduler*>::operator()[abi:un170006]<>() + 36 (bind.h:292)
40  WebCore                       	       0x304554d6c WTF::Detail::CallableWrapper<std::__1::__bind<void (WebCore::HTMLParserScheduler::*&)(), WebCore::HTMLParserScheduler*>, void>::call() + 28 (Function.h:53)
41  WebCore                       	       0x3033d094c WTF::Function<void ()>::operator()() const + 140 (Function.h:82)
42  WebCore                       	       0x30016a854 WebCore::Timer::fired() + 28 (Timer.h:168)
43  WebCore                       	       0x30505e4a4 WebCore::ThreadTimers::sharedTimerFiredInternal() + 600 (ThreadTimers.cpp:125)
44  WebCore                       	       0x30506869c WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0::operator()() const + 28 (ThreadTimers.cpp:65)
45  WebCore                       	       0x305068648 WTF::Detail::CallableWrapper<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0, void>::call() + 28 (Function.h:53)
46  WebCore                       	       0x3033d094c WTF::Function<void ()>::operator()() const + 140 (Function.h:82)
47  WebCore                       	       0x3050074c4 WebCore::MainThreadSharedTimer::fired() + 136 (MainThreadSharedTimer.cpp:83)
48  WebCore                       	       0x30510a630 WebCore::timerFired(__CFRunLoopTimer*, void*) + 40 (MainThreadSharedTimerCF.cpp:85)
49  CoreFoundation                	       0x1984465b8 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 32
50  CoreFoundation                	       0x19844625c __CFRunLoopDoTimer + 972
51  CoreFoundation                	       0x198445d94 __CFRunLoopDoTimers + 356
52  CoreFoundation                	       0x1984291cc __CFRunLoopRun + 1856
53  CoreFoundation                	       0x198428434 CFRunLoopRunSpecific + 608
54  Foundation                    	       0x19955ca88 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 212
55  Foundation                    	       0x1995d66c4 -[NSRunLoop(NSRunLoop) run] + 64
56  libxpc.dylib                  	       0x198063468 _xpc_objc_main + 684
57  libxpc.dylib                  	       0x198072e58 _xpc_main + 324
58  libxpc.dylib                  	       0x198063014 xpc_main + 64
59  WebKit                        	       0x11eef80cc WebKit::XPCServiceMain(int, char const**) + 136 (XPCServiceMain.mm:311)
60  WebKit                        	       0x12156bb34 WKXPCServiceMain + 56 (WKMain.mm:42)
61  com.apple.WebKit.WebContent.Development	       0x100287f90 main + 52 (AuxiliaryProcessMain.cpp:32)
62  dyld

__

Just wanted to raise so we can fix it.

Thanks!

[Radar WebKit Bug Importer]

<rdar://problem/127462893>

[Yusuke Suzuki]

This is stale assertion. Let's just wipe it.

[Yusuke Suzuki]

Pull request: https://github.com/WebKit/WebKit/pull/28072

[EWS]

Committed 278291@main (4717bf604b18): <https://commits.webkit.org/278291@main>

Reviewed commits have been landed. Closing PR #28072 and removing active labels.