186989 2018-06-24 22:23:33 -0700 ASSERTION FAILED: !getDirect(offset) || !JSValue::encode(getDirect(offset)) on nytimes.com 2018-07-03 07:48:51 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED DUPLICATE 187091 https://bugs.webkit.org/show_bug.cgi?id=187255 https://bugs.webkit.org/show_bug.cgi?id=187170 InRadar P2 Normal --- 1 simon.fraser mark.lam ap calvaris cturner fpizlo fujii mark.lam saam simon.fraser webkit-bug-importer oldest_to_newest 1435983 0 simon.fraser 2018-06-24 22:23:33 -0700 Had nytimes.com loaded in debug MiniBrowser, WebKit1, and hit this assertion: offset was 114, this was a FinalObjectType ASSERTION FAILED: !getDirect(offset) || !JSValue::encode(getDirect(offset)) /Volumes/Data/Development/apple/webkit/OpenSource/Source/JavaScriptCore/runtime/JSObjectInlines.h(335) : bool JSC::JSObject::putDirectInternal(JSC::VM &, JSC::PropertyName, JSC::JSValue, unsigned int, JSC::PutPropertySlot &) 1 0x11517bac9 WTFCrash 2 0x115b7b99d bool JSC::JSObject::putDirectInternal<(JSC::JSObject::PutMode)0>(JSC::VM&, JSC::PropertyName, JSC::JSValue, unsigned int, JSC::PutPropertySlot&) 3 0x115b7af6b JSC::JSObject::putInlineForJSObject(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) 4 0x1164e6835 JSC::JSObject::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) 5 0x115b7a89e JSC::JSValue::put(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) 6 0x115b04b3f void JSC::DFG::putByValInternal<false, false>(JSC::ExecState*, JSC::VM&, long long, long long, long long) 7 0x115b0480f operationPutByValNonStrict 8 0x2bbff2887cb 9 0x2bbff57fa17 10 0x2bbff3c3663 11 0x2bbff22dcc2 12 0x115280bf2 llint_entry 13 0x115280bf2 llint_entry 14 0x2bbff35f082 15 0x115280bf2 llint_entry 16 0x2bbff58ffc1 17 0x2bbff592122 18 0x2bbff3d206f 19 0x115278652 vmEntryToJavaScript 20 0x116113afa JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) 21 0x1161140d3 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 22 0x1163aa7ea JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 23 0x1163aa8cc JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) 24 0x1163aab6d JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) 25 0x10719377b WebCore::JSMainThreadExecState::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) 26 0x107215036 WebCore::ScheduledAction::executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue, WebCore::ScriptExecutionContext&) 27 0x107214ae0 WebCore::ScheduledAction::execute(WebCore::Document&) 28 0x1072149a3 WebCore::ScheduledAction::execute(WebCore::ScriptExecutionContext&) 29 0x108009899 WebCore::DOMTimer::fired() 30 0x108250b54 WebCore::ThreadTimers::sharedTimerFiredInternal() 31 0x1082668c1 WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0::operator()() const (lldb) 1435984 1 simon.fraser 2018-06-24 22:24:17 -0700 Was at WebKit r233132. 1435988 2 simon.fraser 2018-06-24 22:52:30 -0700 I can hit this pretty reliably. Just load nytimes.com and wait for a while. 1435989 3 webkit-bug-importer 2018-06-24 22:52:53 -0700 <rdar://problem/41415280> 1436004 4 saam 2018-06-25 00:57:56 -0700 Nice. This is revealing another bug that could lead to concurrent GC crashes 1438794 5 ap 2018-07-03 02:33:06 -0700 Is this still an issue? It's supposed to be a duplicate of bug 187091 per Radar, but 32-bit tests are still hitting this (see bug 187255). 1438838 6 mcatanzaro 2018-07-03 07:17:42 -0700 *** Bug 187170 has been marked as a duplicate of this bug. *** 1438845 7 mark.lam 2018-07-03 07:48:51 -0700 This is a dupe of https://bugs.webkit.org/show_bug.cgi?id=187091. The 32-bit issue is separate. I'll investigate that in bug 187255. *** This bug has been marked as a duplicate of bug 187091 ***