REGRESSION (r80598?): Assertion failure in MarkStack::internalAppend when running various regression tests

[Adam Roben (:aroben)]

The Windows XP Debug (Tests) bots have been seeing an assertion failure in MarkStack::internalAppend when running various tests since about r80598. Here are some crash logs:

http://build.webkit.org/results/Windows%20XP%20Debug%20(Tests)/r80712%20(26179)/inspector/cookie-parser-crash-log.txt
http://build.webkit.org/results/Windows%20XP%20Debug%20(Tests)/r80652%20(26150)/http/tests/inspector-enabled/console-log-before-frame-navigation-crash-log.txt

[Adam Roben (:aroben)]

Looks like this is happening on Mac, too:

http://build.webkit.org/results/SnowLeopard%20Intel%20Leaks/r80712%20(15465)/inspector/debugger/source-frame-crash-log.txt

[Jessie Berlin]

<rdar://problem/9115252>

[Adam Roben (:aroben)]

This will crash in Release builds.

[Adam Roben (:aroben)]

I wonder if this Release crash is related:

http://build.webkit.org/results/SnowLeopard%20Intel%20Release%20(Tests)/r80729%20(26572)/jquery/effects-crash-log.txt

[Adam Roben (:aroben)]

Here's the failing code from the Windows crash logs:

FAULTING_SOURCE_CODE:  
   343: 
   344:     ALWAYS_INLINE void MarkStack::internalAppend(JSCell* cell)
   345:     {
   346:         ASSERT(!m_isCheckingForDefaultMarkViolation);
>  347:         ASSERT(cell);
   348:         if (Heap::testAndSetMarked(cell))
   349:             return;
   350:         if (cell->structure()->typeInfo().type() >= CompoundType)
   351:             m_values.append(cell);
   352:     }

[Adam Roben (:aroben)]

Oliver thinks r80738 will probably have fixed this.

[Adam Roben (:aroben)]

Looks like Oliver was right!