[Webkit-unassigned] [Bug 52156] New: Assertion failure in JSC::Heap::destroy() when running JS tests

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=52156

           Summary: Assertion failure in JSC::Heap::destroy() when running
                    JS tests
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
               URL: http://build.webkit.org/builders/Windows%20XP%20Debug%
                    20%28Tests%29/builds/24054/steps/jscore-test/logs/stdi
                    o
        OS/Version: Windows XP
            Status: NEW
          Keywords: LayoutTestFailure, NeedsRadar, PlatformOnly
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: aroben at apple.com
                CC: ggaren at apple.com, oliver at apple.com,
                    barraclough at apple.com, msaboff at apple.com


To reproduce:

1. run-javascriptcore-tests

Three tests will hit an assertion. The tests are:

    js1_5/Regress/regress-152646.js
    js1_5/Regress/regress-192414.js
    js1_5/Regress/regress-96526-002.js

The assertion is in Heap::destroy. It is:

    ASSERT(!m_globalData->dynamicGlobalObject);

m_globalData->dynamicGlobalObject seems always to be 0x01500000.

Here's the backtrace:

>	JavaScriptCore.dll!JSC::Heap::destroy()  Line 90 + 0x28 bytes	C++
     jsc.exe!cleanupGlobalData(JSC::JSGlobalData * globalData=0x00f2be88)  Line 364    C++
     jsc.exe!main(int argc=6, char * * argv=0x00cfed00)  Line 356 + 0x9 bytes    C++
     jsc.exe!__tmainCRTStartup()  Line 597 + 0x17 bytes    C
     kernel32.dll!_BaseProcessStart at 4()  + 0x23 bytes

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.