Bug 288931 – REGRESSION(291398@main): ASSERTION FAILED: expected.asNumber() == result.asNumber() in JSC::EncodedJSValue JSC::arrayProtoFuncIndexOf(JSGlobalObject *, CallFrame *)

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Fujii Hironori]

The following tests are crashing due to an assertion failure.

imported/w3c/web-platform-tests/css/css-animations/inheritance.html
imported/w3c/web-platform-tests/css/css-grid/grid-definition/grid-support-flexible-lengths-001.html

History:
  https://results.webkit.org/?suite=layout-tests&suite=layout-tests&test=imported%2Fw3c%2Fweb-platform-tests%2Fcss%2Fcss-grid%2Fgrid-definition%2Fgrid-support-flexible-lengths-001.html&test=imported%2Fw3c%2Fweb-platform-tests%2Fcss%2Fcss-animations%2Finheritance.html&style=debug

stderr:

https://build.webkit.org/results/Apple-Sequoia-Debug-WK1-Tests/291412@main%20(1236)/imported/w3c/web-platform-tests/css/css-animations/inheritance-crash-log.txt

ASSERTION FAILED: expected.asNumber() == result.asNumber()
./runtime/ArrayPrototype.cpp(1537) : JSC::EncodedJSValue JSC::arrayProtoFuncIndexOf(JSGlobalObject *, CallFrame *)
1   0x11d40e93e JSC::arrayProtoFuncIndexOf(JSC::JSGlobalObject*, JSC::CallFrame*)
2   0x186728118 1   ???                                 0x0000000186728118 0x0 + 6550618392
3   0x11e3824df jsc_llint_commonCallOp__llintOpWithMetadata__llintOpWithReturn__llintOp__commonOp__fn__fn__makeReturn__fn__fn__fn__916_callHelper__dispatch_LowLevelInterpreter64_asm_2535
4   0x186a315f7 3   ???                                 0x0000000186a315f7 0x0 + 6553802231
5   0x11e38391b jsc_llint_commonCallOp__llintOpWithMetadata__llintOpWithReturn__llintOp__commonOp__fn__fn__makeReturn__fn__fn__fn__934_callHelper__dispatch_LowLevelInterpreter64_asm_2535
6   0x11e38391b jsc_llint_commonCallOp__llintOpWithMetadata__llintOpWithReturn__llintOp__commonOp__fn__fn__makeReturn__fn__fn__fn__934_callHelper__dispatch_LowLevelInterpreter64_asm_2535
7   0x11e38391b jsc_llint_commonCallOp__llintOpWithMetadata__llintOpWithReturn__llintOp__commonOp__fn__fn__makeReturn__fn__fn__fn__934_callHelper__dispatch_LowLevelInterpreter64_asm_2535
8   0x11e3824df jsc_llint_commonCallOp__llintOpWithMetadata__llintOpWithReturn__llintOp__commonOp__fn__fn__makeReturn__fn__fn__fn__916_callHelper__dispatch_LowLevelInterpreter64_asm_2535
9   0x11e35a5ba llint_call_javascript
10  0x11d182d17 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*)
11  0x11d4e740b JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
12  0x11d4e756c JSC::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
13  0x1696e9fb8 WebCore::JSExecState::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
14  0x1696e997a WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&)
15  0x1696e9609 WebCore::ScriptController::evaluateInWorldIgnoringException(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&)
16  0x1696e9db5 WebCore::ScriptController::evaluateIgnoringException(WebCore::ScriptSourceCode const&)
17  0x16a59a556 WebCore::ScriptElement::executeClassicScript(WebCore::ScriptSourceCode const&)
18  0x16a509421 WebCore::LoadableClassicScript::execute(WebCore::ScriptElement&)
19  0x16a59cf79 WebCore::ScriptElement::executeScriptAndDispatchEvent(WebCore::LoadableScript&)
20  0x16a59d24b WebCore::ScriptElement::executePendingScript(WebCore::PendingScript&)
21  0x16ac68a71 WebCore::HTMLScriptRunner::executePendingScriptAndDispatchEvent(WebCore::PendingScript&)
22  0x16ac6935b WebCore::HTMLScriptRunner::executeParsingBlockingScripts()
23  0x16ac68c61 WebCore::HTMLScriptRunner::execute(WTF::Ref<WebCore::ScriptElement, WTF::RawPtrTraits<WebCore::ScriptElement>, WTF::DefaultRefDerefTraits<WebCore::ScriptElement>>&&, WTF::TextPosition const&)
24  0x16ac2b78e WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder()
25  0x16ac2bd1f WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&)
26  0x16ac2ae3d WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode)
27  0x16ac2a4c2 WebCore::HTMLDocumentParser::pumpTokenizerIfPossible(WebCore::HTMLDocumentParser::SynchronousMode)
28  0x16ac2cac1 WebCore::HTMLDocumentParser::append(WTF::RefPtr<WTF::StringImpl, WTF::RawPtrTraits<WTF::StringImpl>, WTF::DefaultRefDerefTraits<WTF::StringImpl>>&&, WebCore::HTMLDocumentParser::SynchronousMode)
29  0x16ac2c87f WebCore::HTMLDocumentParser::append(WTF::RefPtr<WTF::StringImpl, WTF::RawPtrTraits<WTF::StringImpl>, WTF::DefaultRefDerefTraits<WTF::StringImpl>>&&)
30  0x16a2db0b4 WebCore::DecodedDataDocumentParser::appendBytes(WebCore::DocumentWriter&, std::__1::span<unsigned char const, 18446744073709551615ul>)
31  0x16b11c174 WebCore::DocumentWriter::addData(WebCore::SharedBuffer const&)

[Sosuke Suzuki]

Probably caused by https://commits.webkit.org/291398@main

[Radar WebKit Bug Importer]

<rdar://problem/145945591>

[Yijia Huang]

Pull request: https://github.com/WebKit/WebKit/pull/41818

[EWS]

Committed 291535@main (db2338357f30): <https://commits.webkit.org/291535@main>

Reviewed commits have been landed. Closing PR #41818 and removing active labels.