[Webkit-unassigned] [Bug 158791] New: Assertion failure when redefining array length

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=158791

            Bug ID: 158791
           Summary: Assertion failure when redefining array length
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Local Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: andre.bargull at gmail.com

SVN: rev202088
Build with: perl Tools/Scripts/build-jsc --gtk --debug


The following test case triggers this assertion error:
---
ASSERTION FAILED: isLengthWritable() || !writable
---


Test case:
---
var a = [];
Object.defineProperty(a, "length", {
  writable: true,
  value: {
    valueOf() {
      Object.defineProperty(a, "length", {writable: false});
      return 0;
    }
  }
});
---


Stack trace:
---
#0  0x00007ffff6de7098 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:317
#1  0x00007ffff6b8f827 in JSC::JSArray::setLengthWritable (this=0x7fffaf1c7ed0, exec=0x7fffffffcb20, writable=true)
    at ../../Source/JavaScriptCore/runtime/JSArray.cpp:65
#2  0x00007ffff6b8fc31 in JSC::JSArray::defineOwnProperty (object=0x7fffaf1c7ed0, exec=0x7fffffffcb20, propertyName=..., descriptor=..., throwException=true)
    at ../../Source/JavaScriptCore/runtime/JSArray.cpp:118
#3  0x00007ffff6c8d2f2 in JSC::objectConstructorDefineProperty (exec=0x7fffffffcb20) at ../../Source/JavaScriptCore/runtime/ObjectConstructor.cpp:433
#4  0x00007fffb0bff028 in ?? ()
#5  0x00007fffffffcba0 in ?? ()
#6  0x00007ffff69f26a1 in llint_entry () at ../../Source/JavaScriptCore/runtime/JSCJSValueInlines.h:1054
---

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160615/513ff50c/attachment.html>