[Webkit-unassigned] [Bug 143859] A odd crash

Sun Jun 7 23:29:52 PDT 2015

https://bugs.webkit.org/show_bug.cgi?id=143859

--- Comment #9 from Peng Xinchao <xinchao.peng at samsung.com> ---
In the newest version (x86_gtk),The crash is still exist .

    case ToThis: {
        printf(" node->child1().useKind() =%d\n",node->child1().useKind());
        ASSERT(node->child1().useKind() == UntypedUse); ---> crash here

TestCase :
<html>
<head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
    <title>Tutorial Video Widget</title>
    <script>
function onLoad() {

            setInterval(function() {
                var d = new Date();
                var time = d.getHours().addNulls() + ":" + d.getMinutes().addNulls();            
                document.write("time="+time);
                document.write("<br>");
            }, 1000);

        }
Number.prototype.addNulls = function () {
            if (this < 100) {
                return "0" + this;
            }
            return this.toString();
        }
</script>
</head>
<body onload="onLoad();">

</body>
</html>

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150608/34b92302/attachment.html>