css3/shapes/shape-outside/values/shape-outside-ellipse-004.html is crashing and this started on commit 254969 I did not try to reproduce the crash. It is happening on debug with wk1 and wk2 on macOS and iOS. History: https://results.webkit.org/?suite=layout-tests&test=css3%2Fshapes%2Fshape-outside%2Fvalues%2Fshape-outside-ellipse-004.html Crasher: No crash log found for com.apple.WebKit.WebContent.Development:19258. stdout: stderr: ASSERTION FAILED: bits < (1ULL << maxBits) /Volumes/Data/slave/ios-simulator-13-debug/build/Source/JavaScriptCore/bytecode/Operands.h(79) : uint64_t JSC::Operand::asBits() const 1 0x3e4f76be9 WTFCrash 2 0x3e61777fb WTFCrashWithInfo(int, char const*, char const*, int) 3 0x3e57137ee JSC::Operand::asBits() const 4 0x3e572eac1 JSC::DFG::OpInfo::OpInfo(JSC::Operand) 5 0x3e572ea2d JSC::DFG::OpInfo::OpInfo(JSC::Operand) 6 0x3e5752b67 JSC::DFG::ByteCodeParser::setDirect(JSC::Operand, JSC::DFG::Node*, JSC::DFG::ByteCodeParser::SetMode) 7 0x3e579b4d8 JSC::DFG::ByteCodeParser::handleVarargsInlining(JSC::DFG::Node*, JSC::VirtualRegister, JSC::CallLinkStatus const&, int, JSC::VirtualRegister, JSC::VirtualRegister, unsigned int, JSC::DFG::NodeType, JSC::InlineCallFrame::Kind)::$_3::operator()(JSC::CodeBlock*) const 8 0x3e5751b3a void JSC::DFG::ByteCodeParser::inlineCall<JSC::DFG::ByteCodeParser::handleVarargsInlining(JSC::DFG::Node*, JSC::VirtualRegister, JSC::CallLinkStatus const&, int, JSC::VirtualRegister, JSC::VirtualRegister, unsigned int, JSC::DFG::NodeType, JSC::InlineCallFrame::Kind)::$_3>(JSC::DFG::Node*, JSC::VirtualRegister, JSC::CallVariant, int, int, JSC::InlineCallFrame::Kind, JSC::DFG::BasicBlock*, JSC::DFG::ByteCodeParser::handleVarargsInlining(JSC::DFG::Node*, JSC::VirtualRegister, JSC::CallLinkStatus const&, int, JSC::VirtualRegister, JSC::VirtualRegister, unsigned int, JSC::DFG::NodeType, JSC::InlineCallFrame::Kind)::$_3 const&) 9 0x3e5751815 JSC::DFG::ByteCodeParser::handleVarargsInlining(JSC::DFG::Node*, JSC::VirtualRegister, JSC::CallLinkStatus const&, int, JSC::VirtualRegister, JSC::VirtualRegister, unsigned int, JSC::DFG::NodeType, JSC::InlineCallFrame::Kind) 10 0x3e57748dc JSC::DFG::ByteCodeParser::Terminality JSC::DFG::ByteCodeParser::handleVarargsCall<JSC::OpCallVarargs>(JSC::Instruction const*, JSC::DFG::NodeType, JSC::CallMode) 11 0x3e5768b93 JSC::DFG::ByteCodeParser::parseBlock(unsigned int) 12 0x3e5778ba4 JSC::DFG::ByteCodeParser::parseCodeBlock() 13 0x3e57792b0 JSC::DFG::ByteCodeParser::parse() 14 0x3e577a7bb JSC::DFG::parse(JSC::DFG::Graph&) 15 0x3e59f4af8 JSC::DFG::Plan::compileInThreadImpl() 16 0x3e59f4298 JSC::DFG::Plan::compileInThread(JSC::DFG::ThreadData*) 17 0x3e5b3a8c0 JSC::DFG::Worklist::ThreadBody::work() 18 0x3e4f8d139 WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0::operator()() const 19 0x3e4f8cd29 WTF::Detail::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0, void>::call() 20 0x3e4fa10aa WTF::Function<void ()>::operator()() const 21 0x3e504a610 WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) 22 0x3e5056795 WTF::wtfThreadEntryPoint(void*) 23 0x10e8cad76 _pthread_start 24 0x10e8c75d7 thread_start LEAK: 1 WebPageProxy