[Webkit-unassigned] [Bug 149253] New: ASSERTION FAILED: s.length() > 1 in JSC::jsNontrivialString

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=149253

            Bug ID: 149253
           Summary: ASSERTION FAILED: s.length() > 1 in
                    JSC::jsNontrivialString
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Local Build
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: rhodovan.u-szeged at partner.samsung.com
                CC: mark.lam at apple.com, msaboff at apple.com
            Blocks: 116980

Created attachment 261377
  --> https://bugs.webkit.org/attachment.cgi?id=261377&action=review
Test case

Load this test with debug jsc:

SyntaxError.prototype.name = 0;
SyntaxError.prototype.toString();


Backtrace:

ASSERTION FAILED: s.length() > 1
../../Source/JavaScriptCore/runtime/JSString.h(491) : JSC::JSString* JSC::jsNontrivialString(JSC::VM*, const WTF::String&)

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff71b9ab6 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321
321     *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt
#0  0x00007ffff71b9ab6 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321
#1  0x00007ffff6db58e0 in JSC::jsNontrivialString (vm=0x7ffff1002000, s=...) at ../../Source/JavaScriptCore/runtime/JSString.h:491
#2  0x00007ffff6db5a4c in JSC::jsNontrivialString (exec=0x7fffffffc620, s=...) at ../../Source/JavaScriptCore/runtime/JSString.h:621
#3  0x00007ffff6fd6254 in JSC::errorProtoFuncToString (exec=0x7fffffffc620) at ../../Source/JavaScriptCore/runtime/ErrorPrototype.cpp:125
#4  0x00007fffb0fff0c8 in ?? ()
#5  0x00007fffffffc690 in ?? ()
#6  0x00007ffff7163101 in llint_entry () from WebKit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150917/3ee8db54/attachment.html>