[Webkit-unassigned] [Bug 131901] REGRESSION(r167501): DYEBench times out

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Sat Apr 19 22:29:12 PDT 2014


https://bugs.webkit.org/show_bug.cgi?id=131901





--- Comment #8 from Mark Hahnenberg <mhahnenberg at apple.com>  2014-04-19 22:29:32 PST ---
I can catch the error in a debugger at the time it throws. It seems like the object in question has a Structure that is a descendent of a Structure that was the result of a delete transition. The current Structure and the ancestor Structure have different size property tables. My current theory is that we're somehow copying properties over incorrectly due to the resize of the property table when materializing.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.



More information about the webkit-unassigned mailing list