<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>101869</bug_id>
          
          <creation_ts>2012-11-11 15:49:34 -0800</creation_ts>
          <short_desc>assertion failure in JSObject::tryGetIndexQuickly()</short_desc>
          <delta_ts>2012-11-11 23:49:46 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>0</everconfirmed>
          <reporter name="Michael Pruett">michael</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>fpizlo</cc>
    
    <cc>webkit.review.bot</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>763902</commentid>
    <comment_count>0</comment_count>
    <who name="Michael Pruett">michael</who>
    <bug_when>2012-11-11 15:49:34 -0800</bug_when>
    <thetext>Currently JSObject::tryGetIndexQuickly() triggers an assertion failure when the indexing type of an object is ArrayWithUndecided. This case is currently not handled but should be treated the same as a blank indexing type.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>763907</commentid>
    <comment_count>1</comment_count>
      <attachid>173521</attachid>
    <who name="Michael Pruett">michael</who>
    <bug_when>2012-11-11 16:01:02 -0800</bug_when>
    <thetext>Created attachment 173521
Fix assertion failure in JSObject::tryGetIndexQuickly()</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>763908</commentid>
    <comment_count>2</comment_count>
      <attachid>173521</attachid>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2012-11-11 16:02:44 -0800</bug_when>
    <thetext>Comment on attachment 173521
Fix assertion failure in JSObject::tryGetIndexQuickly()

If it was possible to add a test case to LayoutTests, then that would be super awesome.  R=me for the patch as-is and RS=me for a test.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>763912</commentid>
    <comment_count>3</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2012-11-11 16:09:50 -0800</bug_when>
    <thetext>Btw, if you want to land the patch then set &apos;cq&apos; to &apos;?&apos;.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>764041</commentid>
    <comment_count>4</comment_count>
      <attachid>173556</attachid>
    <who name="Michael Pruett">michael</who>
    <bug_when>2012-11-11 22:19:37 -0800</bug_when>
    <thetext>Created attachment 173556
Fix assertion failure in JSObject::tryGetIndexQuickly()

I&apos;ve updated the original patch with a test case.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>764105</commentid>
    <comment_count>5</comment_count>
      <attachid>173556</attachid>
    <who name="WebKit Review Bot">webkit.review.bot</who>
    <bug_when>2012-11-11 23:49:43 -0800</bug_when>
    <thetext>Comment on attachment 173556
Fix assertion failure in JSObject::tryGetIndexQuickly()

Clearing flags on attachment: 173556

Committed r134193: &lt;http://trac.webkit.org/changeset/134193&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>764106</commentid>
    <comment_count>6</comment_count>
    <who name="WebKit Review Bot">webkit.review.bot</who>
    <bug_when>2012-11-11 23:49:46 -0800</bug_when>
    <thetext>All reviewed patches have been landed.  Closing bug.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>173521</attachid>
            <date>2012-11-11 16:01:02 -0800</date>
            <delta_ts>2012-11-11 22:19:37 -0800</delta_ts>
            <desc>Fix assertion failure in JSObject::tryGetIndexQuickly()</desc>
            <filename>JSObject.patch</filename>
            <type>text/plain</type>
            <size>1337</size>
            <attacher name="Michael Pruett">michael</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cgYi9Tb3VyY2UvSmF2
YVNjcmlwdENvcmUvQ2hhbmdlTG9nCmluZGV4IDI5NmM3M2EuLmRkZGU4ZmUgMTAwNjQ0Ci0tLSBh
L1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL0phdmFTY3JpcHRD
b3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDEyLTExLTExICBNaWNoYWVsIFBydWV0
dCAgPG1pY2hhZWxANjhrLm9yZz4KKworICAgICAgICBGaXggYXNzZXJ0aW9uIGZhaWx1cmUgaW4g
SlNPYmplY3Q6OnRyeUdldEluZGV4UXVpY2tseSgpCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr
aXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMDE4NjkKKworICAgICAgICBSZXZpZXdlZCBieSBGaWxp
cCBQaXpsby4KKworICAgICAgICBDdXJyZW50bHkgSlNPYmplY3Q6OnRyeUdldEluZGV4UXVpY2ts
eSgpIHRyaWdnZXJzIGFuIGFzc2VydGlvbgorICAgICAgICBmYWlsdXJlIHdoZW4gdGhlIG9iamVj
dCBoYXMgYW4gdW5kZWNpZGVkIGluZGV4aW5nIHR5cGUuIFRoaXMKKyAgICAgICAgY2FzZSBzaG91
bGQgYmUgdHJlYXRlZCB0aGUgc2FtZSBhcyBhIGJsYW5rIGluZGV4aW5nIHR5cGUuCisKKyAgICAg
ICAgKiBydW50aW1lL0pTT2JqZWN0Lmg6CisgICAgICAgIChKU0M6OkpTT2JqZWN0Ojp0cnlHZXRJ
bmRleFF1aWNrbHkpOgorCiAyMDEyLTExLTExICBLZW5pY2hpIElzaGliYXNoaSAgPGJhc2hpQGNo
cm9taXVtLm9yZz4KIAogICAgICAgICBXVEZTdHJpbmc6OnV0ZjgoKSBzaG91bGQgaGF2ZSBhIG1v
ZGUgb2YgY29udmVyc2lvbiB0byB1c2UgcmVwbGFjZW1lbnQgY2hhcmFjdGVyCmRpZmYgLS1naXQg
YS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9KU09iamVjdC5oIGIvU291cmNlL0phdmFT
Y3JpcHRDb3JlL3J1bnRpbWUvSlNPYmplY3QuaAppbmRleCBmOWFlNzNlLi40MWJiNGIxIDEwMDY0
NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9KU09iamVjdC5oCisrKyBiL1Nv
dXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0pTT2JqZWN0LmgKQEAgLTI0MSw2ICsyNDEsNyBA
QCBwdWJsaWM6CiAgICAgewogICAgICAgICBzd2l0Y2ggKHN0cnVjdHVyZSgpLT5pbmRleGluZ1R5
cGUoKSkgewogICAgICAgICBjYXNlIEFMTF9CTEFOS19JTkRFWElOR19UWVBFUzoKKyAgICAgICAg
Y2FzZSBBTExfVU5ERUNJREVEX0lOREVYSU5HX1RZUEVTOgogICAgICAgICAgICAgYnJlYWs7CiAg
ICAgICAgIGNhc2UgQUxMX0lOVDMyX0lOREVYSU5HX1RZUEVTOgogICAgICAgICBjYXNlIEFMTF9D
T05USUdVT1VTX0lOREVYSU5HX1RZUEVTOgo=
</data>
<flag name="review"
          id="188235"
          type_id="1"
          status="+"
          setter="fpizlo"
    />
          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>173556</attachid>
            <date>2012-11-11 22:19:37 -0800</date>
            <delta_ts>2012-11-11 23:49:43 -0800</delta_ts>
            <desc>Fix assertion failure in JSObject::tryGetIndexQuickly()</desc>
            <filename>sparse.patch</filename>
            <type>text/plain</type>
            <size>3349</size>
            <attacher name="Michael Pruett">michael</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv
ZwppbmRleCBiYTUwZDE5Li45NGRmNjIyIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VM
b2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTItMTEt
MTEgIE1pY2hhZWwgUHJ1ZXR0ICA8bWljaGFlbEA2OGsub3JnPgorCisgICAgICAgIEZpeCBhc3Nl
cnRpb24gZmFpbHVyZSBpbiBKU09iamVjdDo6dHJ5R2V0SW5kZXhRdWlja2x5KCkKKyAgICAgICAg
aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEwMTg2OQorCisgICAgICAg
IFJldmlld2VkIGJ5IEZpbGlwIFBpemxvLgorCisgICAgICAgIEFkZCB0ZXN0IGNhc2UgZm9yIGFu
IGFzc2VydGlvbiBmYWlsdXJlIHRyaWdnZXJlZCB3aGVuIGNvbnN0cnVjdGluZworICAgICAgICBh
IEJsb2Igd2l0aCBhIHNwYXJzZSBhcnJheS4KKworICAgICAgICAqIGZhc3QvY29uc3RydWN0b3Jz
L2Jsb2Itc3BhcnNlLWFycmF5LWFzc2VydGlvbi1mYWlsdXJlLmh0bWw6IEFkZGVkLgorCiAyMDEy
LTExLTExICBLZWlzaGkgSGF0dG9yaSAgPGtlaXNoaUB3ZWJraXQub3JnPgogCiAgICAgICAgIFJl
YmFzZWxpbmUgbW9udGgvd2VlayBhcHBlYXJhbmNlIHRlc3RzCmRpZmYgLS1naXQgYS9MYXlvdXRU
ZXN0cy9mYXN0L2NvbnN0cnVjdG9ycy9ibG9iLXNwYXJzZS1hcnJheS1hc3NlcnRpb24tZmFpbHVy
ZS1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9mYXN0L2NvbnN0cnVjdG9ycy9ibG9iLXNwYXJz
ZS1hcnJheS1hc3NlcnRpb24tZmFpbHVyZS1leHBlY3RlZC50eHQKbmV3IGZpbGUgbW9kZSAxMDA2
NDQKaW5kZXggMDAwMDAwMC4uOTAwYjIyZAotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3Rz
L2Zhc3QvY29uc3RydWN0b3JzL2Jsb2Itc3BhcnNlLWFycmF5LWFzc2VydGlvbi1mYWlsdXJlLWV4
cGVjdGVkLnR4dApAQCAtMCwwICsxLDQgQEAKK1Rlc3QgdGhhdCBjb25zdHJ1Y3RpbmcgYSBCbG9i
IHdpdGggYSBzcGFyc2UgYXJyYXkgZG9lc24ndCB0cmlnZ2VyIGFuIGFzc2VydGlvbiBmYWlsdXJl
LiAKK2h0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMDE4NjkKK0RPTkUK
KwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9jb25zdHJ1Y3RvcnMvYmxvYi1zcGFyc2Ut
YXJyYXktYXNzZXJ0aW9uLWZhaWx1cmUuaHRtbCBiL0xheW91dFRlc3RzL2Zhc3QvY29uc3RydWN0
b3JzL2Jsb2Itc3BhcnNlLWFycmF5LWFzc2VydGlvbi1mYWlsdXJlLmh0bWwKbmV3IGZpbGUgbW9k
ZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uY2UxOWY5MwotLS0gL2Rldi9udWxsCisrKyBiL0xheW91
dFRlc3RzL2Zhc3QvY29uc3RydWN0b3JzL2Jsb2Itc3BhcnNlLWFycmF5LWFzc2VydGlvbi1mYWls
dXJlLmh0bWwKQEAgLTAsMCArMSwyNiBAQAorPCFET0NUWVBFIGh0bWw+Cis8aHRtbD4KKzxoZWFk
PgorPHNjcmlwdD4KK2Z1bmN0aW9uIGxvZyhtZXNzYWdlKQoreworICAgIGRvY3VtZW50LmdldEVs
ZW1lbnRCeUlkKCdjb25zb2xlJykuYXBwZW5kQ2hpbGQoZG9jdW1lbnQuY3JlYXRlVGV4dE5vZGUo
bWVzc2FnZSArICJcbiIpKTsKK30KKworZnVuY3Rpb24gdGVzdCgpCit7CisgICAgbmV3IEJsb2Io
QXJyYXkoMTAwKSk7CisgICAgbG9nKCJET05FIik7Cit9CisKK2lmICh3aW5kb3cudGVzdFJ1bm5l
cikKKyAgICB0ZXN0UnVubmVyLmR1bXBBc1RleHQoKTsKKzwvc2NyaXB0PgorPC9oZWFkPgorPGJv
ZHkgb25sb2FkPSJ0ZXN0KCkiPgorVGVzdCB0aGF0IGNvbnN0cnVjdGluZyBhIEJsb2Igd2l0aCBh
IHNwYXJzZSBhcnJheSBkb2Vzbid0IHRyaWdnZXIgYW4gYXNzZXJ0aW9uIGZhaWx1cmUuCis8YnI+
Cis8YSBocmVmPSJodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTAxODY5
Ij5odHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTAxODY5PC9hPgorPHBy
ZSBpZD0nY29uc29sZSc+PC9wcmU+Cis8L2JvZHk+Cis8L2h0bWw+CmRpZmYgLS1naXQgYS9Tb3Vy
Y2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5n
ZUxvZwppbmRleCA0ZmYwY2FhLi43MzdlNjBhIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlw
dENvcmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAg
LTEsMyArMSwxNyBAQAorMjAxMi0xMS0xMSAgTWljaGFlbCBQcnVldHQgIDxtaWNoYWVsQDY4ay5v
cmc+CisKKyAgICAgICAgRml4IGFzc2VydGlvbiBmYWlsdXJlIGluIEpTT2JqZWN0Ojp0cnlHZXRJ
bmRleFF1aWNrbHkoKQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j
Z2k/aWQ9MTAxODY5CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgRmlsaXAgUGl6bG8uCisKKyAgICAg
ICAgQ3VycmVudGx5IEpTT2JqZWN0Ojp0cnlHZXRJbmRleFF1aWNrbHkoKSB0cmlnZ2VycyBhbiBh
c3NlcnRpb24KKyAgICAgICAgZmFpbHVyZSB3aGVuIHRoZSBvYmplY3QgaGFzIGFuIHVuZGVjaWRl
ZCBpbmRleGluZyB0eXBlLiBUaGlzCisgICAgICAgIGNhc2Ugc2hvdWxkIGJlIHRyZWF0ZWQgdGhl
IHNhbWUgYXMgYSBibGFuayBpbmRleGluZyB0eXBlLgorCisgICAgICAgICogcnVudGltZS9KU09i
amVjdC5oOgorICAgICAgICAoSlNDOjpKU09iamVjdDo6dHJ5R2V0SW5kZXhRdWlja2x5KToKKwog
MjAxMi0xMS0xMSAgRmlsaXAgUGl6bG8gIDxmcGl6bG9AYXBwbGUuY29tPgogCiAgICAgICAgIERG
RyByZWdpc3RlciBhbGxvY2F0aW9uIHNob3VsZCBiZSBncmVlZHkgcmF0aGVyIHRoYW4gcm91bmQt
cm9iaW4KZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0pTT2JqZWN0
LmggYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9KU09iamVjdC5oCmluZGV4IGY5YWU3
M2UuLjQxYmI0YjEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0pT
T2JqZWN0LmgKKysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvSlNPYmplY3QuaApA
QCAtMjQxLDYgKzI0MSw3IEBAIHB1YmxpYzoKICAgICB7CiAgICAgICAgIHN3aXRjaCAoc3RydWN0
dXJlKCktPmluZGV4aW5nVHlwZSgpKSB7CiAgICAgICAgIGNhc2UgQUxMX0JMQU5LX0lOREVYSU5H
X1RZUEVTOgorICAgICAgICBjYXNlIEFMTF9VTkRFQ0lERURfSU5ERVhJTkdfVFlQRVM6CiAgICAg
ICAgICAgICBicmVhazsKICAgICAgICAgY2FzZSBBTExfSU5UMzJfSU5ERVhJTkdfVFlQRVM6CiAg
ICAgICAgIGNhc2UgQUxMX0NPTlRJR1VPVVNfSU5ERVhJTkdfVFlQRVM6Cg==
</data>

          </attachment>
      

    </bug>

</bugzilla>