[Webkit-unassigned] [Bug 202343] New: ASSERTION FAILED: this->prototypeChainMayInterceptStoreTo(vm, propertyName) || obj == this
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Sat Sep 28 01:55:10 PDT 2019
https://bugs.webkit.org/show_bug.cgi?id=202343
Bug ID: 202343
Summary: ASSERTION FAILED:
this->prototypeChainMayInterceptStoreTo(vm,
propertyName) || obj == this
Product: WebKit
Version: WebKit Local Build
Hardware: PC
OS: Linux
Status: NEW
Severity: Major
Priority: P2
Component: JavaScriptCore
Assignee: webkit-unassigned at lists.webkit.org
Reporter: hexiaoyu at iie.ac.cn
Created attachment 379784
--> https://bugs.webkit.org/attachment.cgi?id=379784&action=review
poc
ASSERTION FAILED: this->prototypeChainMayInterceptStoreTo(vm, propertyName) || obj == this
../../Source/JavaScriptCore/runtime/JSObject.cpp(797) : bool JSC::JSObject::putInlineSlow(JSC::ExecState *, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot &)
Aborted (core dumped)
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20190928/26d99b01/attachment.html>
More information about the webkit-unassigned
mailing list