127146 2014-01-16 14:47:32 -0800 throwing an objc object (or general binding object) triggers an assertion 2014-01-16 14:51:26 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 oliver oliver oldest_to_newest 968947 0 oliver 2014-01-16 14:47:32 -0800 So Bindings::Instance consumes all property assignment including the "stack" assignment when throwing an exception. This trigger the following assertion which should probably just be removed. frame #1: 0x0000000100493acb JavaScriptCore`JSC::Interpreter::unwind(this=0x000000010e4124c0, callFrame=0x00007fff5fbfcfd0, exceptionValue=0x00007fff5fbfcfc8) + 587 at Interpreter.cpp:680 677 } 678 679 ASSERT(callFrame->vm().exceptionStack().size()); -> 680 ASSERT(!exceptionValue.isObject() || asObject(exceptionValue)->hasProperty(callFrame, callFrame->vm().propertyNames->stack)); 681 968948 1 221416 oliver 2014-01-16 14:49:19 -0800 Created attachment 221416 Patch 968950 2 oliver 2014-01-16 14:51:26 -0800 Committed r162156: <http://trac.webkit.org/changeset/162156> 221416 2014-01-16 14:49:19 -0800 2014-01-16 14:50:30 -0800 Patch bug-127146-20140116144918.patch text/plain 1634 oliver U3VidmVyc2lvbiBSZXZpc2lvbjogMTYyMTUxCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCBi MjliOTI4ODg5ZjBhM2EyYTNjZDEwNDg4Yjk1ZjdkNTczMjA1NTk4Li45N2E3YzRiZjQ1N2NkNGY4 Njc3ZDkyMzcyMmZiMGQ1OWQ0NDY4ZTUwIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxNiBAQAorMjAxNC0wMS0xNiAgT2xpdmVyIEh1bnQgIDxvbGl2ZXJAYXBwbGUuY29tPgor CisgICAgICAgIHRocm93aW5nIGFuIG9iamMgb2JqZWN0IChvciBnZW5lcmFsIGJpbmRpbmcgb2Jq ZWN0KSB0cmlnZ2VycyBhbiBhc3NlcnRpb24KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5v cmcvc2hvd19idWcuY2dpP2lkPTEyNzE0NgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo T09QUyEpLgorCisgICAgICAgIFRoaXMgaXMgc2ltcGx5IGEgYm9ndXMgYXNzZXJ0aW9uIGFzIHdl IGNhbid0IGd1YXJhbnRlZSBhIGJpbmRpbmdzIG9iamVjdAorICAgICAgICB3b24ndCBpbnRlcmNl cHQgYXNzaWdubWVudCB0byAuc3RhY2sKKworICAgICAgICAqIGludGVycHJldGVyL0ludGVycHJl dGVyLmNwcDoKKyAgICAgICAgKEpTQzo6SW50ZXJwcmV0ZXI6OnVud2luZCk6CisKIDIwMTQtMDEt MTYgIFBldGVyIE1vbG5hciAgPHBtb2xuYXIudS1zemVnZWRAcGFydG5lci5zYW1zdW5nLmNvbT4K IAogICAgICAgICBSZW1vdmUgd29ya2Fyb3VuZCBmb3IgY29tcGlsZXJzIG5vdCBzdXBwb3J0aW5n IGV4cGxpY2l0IG92ZXJyaWRlIGNvbnRyb2wKZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0 Q29yZS9pbnRlcnByZXRlci9JbnRlcnByZXRlci5jcHAgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUv aW50ZXJwcmV0ZXIvSW50ZXJwcmV0ZXIuY3BwCmluZGV4IGYyMDc1NGE2Y2EyMDMyZjYwNDkyZGQ1 YzU5NTgyMmY2NzIxNTIzYzQuLjEyMjQ0Y2VlYWVhYjhlNzI5ZDcyYzRjNGM3NjM4ZDlkZWI4ZmVi MWUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9pbnRlcnByZXRlci9JbnRlcnBy ZXRlci5jcHAKKysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2ludGVycHJldGVyL0ludGVycHJl dGVyLmNwcApAQCAtNjc3LDcgKzY3Nyw2IEBAIE5FVkVSX0lOTElORSBIYW5kbGVySW5mbyogSW50 ZXJwcmV0ZXI6OnVud2luZChDYWxsRnJhbWUqJiBjYWxsRnJhbWUsIEpTVmFsdWUmIGV4CiAgICAg fQogCiAgICAgQVNTRVJUKGNhbGxGcmFtZS0+dm0oKS5leGNlcHRpb25TdGFjaygpLnNpemUoKSk7 Ci0gICAgQVNTRVJUKCFleGNlcHRpb25WYWx1ZS5pc09iamVjdCgpIHx8IGFzT2JqZWN0KGV4Y2Vw dGlvblZhbHVlKS0+aGFzUHJvcGVydHkoY2FsbEZyYW1lLCBjYWxsRnJhbWUtPnZtKCkucHJvcGVy dHlOYW1lcy0+c3RhY2spKTsKIAogICAgIERlYnVnZ2VyKiBkZWJ1Z2dlciA9IGNhbGxGcmFtZS0+ dm1FbnRyeUdsb2JhbE9iamVjdCgpLT5kZWJ1Z2dlcigpOwogICAgIGlmIChkZWJ1Z2dlciAmJiBk ZWJ1Z2dlci0+bmVlZHNFeGNlcHRpb25DYWxsYmFja3MoKSkgewo=