[Webkit-unassigned] [Bug 160666] New: ASSERTION FAILED: hasInlineStorage() in JSFinalObject::visitChildren().
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Mon Aug 8 11:49:31 PDT 2016
https://bugs.webkit.org/show_bug.cgi?id=160666
Bug ID: 160666
Summary: ASSERTION FAILED: hasInlineStorage() in
JSFinalObject::visitChildren().
Classification: Unclassified
Product: WebKit
Version: WebKit Local Build
Hardware: Unspecified
OS: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: JavaScriptCore
Assignee: webkit-unassigned at lists.webkit.org
Reporter: mark.lam at apple.com
This assertion is benign. JSFinalObject::visitChildren() calls JSObject::inlineStorage() to get a pointer to the object's inline storage, and later passes it to visitor.appendValuesHidden() with a previously computed storageSize. When storageSize is 0, appendValuesHidden() ends up doing nothing. However, before we get there, JSObject::inlineStorage() will be asserting hasInlineStorage() and this assertion will fail when storageSize is 0.
We can fix this assertion failure by simply adding a storageSize check before calling hasInlineStorage() and visitor.appendValuesHidden().
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160808/4ba9f851/attachment.html>
More information about the webkit-unassigned
mailing list