149253 2015-09-17 01:32:03 -0700 ASSERTION FAILED: s.length() > 1 in JSC::jsNontrivialString 2016-08-04 17:22:14 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build PC Linux RESOLVED DUPLICATE 160324 P2 Normal --- 116980 1 rhodovan.u-szeged webkit-unassigned bfulgham mark.lam msaboff oldest_to_newest 1126646 0 261377 rhodovan.u-szeged 2015-09-17 01:32:03 -0700 Created attachment 261377 Test case Load this test with debug jsc: SyntaxError.prototype.name = 0; SyntaxError.prototype.toString(); Backtrace: ASSERTION FAILED: s.length() > 1 ../../Source/JavaScriptCore/runtime/JSString.h(491) : JSC::JSString* JSC::jsNontrivialString(JSC::VM*, const WTF::String&) Program received signal SIGSEGV, Segmentation fault. 0x00007ffff71b9ab6 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 321 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007ffff71b9ab6 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321 #1 0x00007ffff6db58e0 in JSC::jsNontrivialString (vm=0x7ffff1002000, s=...) at ../../Source/JavaScriptCore/runtime/JSString.h:491 #2 0x00007ffff6db5a4c in JSC::jsNontrivialString (exec=0x7fffffffc620, s=...) at ../../Source/JavaScriptCore/runtime/JSString.h:621 #3 0x00007ffff6fd6254 in JSC::errorProtoFuncToString (exec=0x7fffffffc620) at ../../Source/JavaScriptCore/runtime/ErrorPrototype.cpp:125 #4 0x00007fffb0fff0c8 in ?? () #5 0x00007fffffffc690 in ?? () #6 0x00007ffff7163101 in llint_entry () from WebKit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18 1217677 1 bfulgham 2016-08-04 17:17:09 -0700 This problem does not reproduce under r204037, most likely due to changes in the JavaScript implementation. If you believe there is still a problem, please reopen this bug with a revised test case. 1217682 2 mark.lam 2016-08-04 17:22:14 -0700 This was fixed independently in https://bugs.webkit.org/show_bug.cgi?id=160324. So, duping to 160324 to track when the fix landed. *** This bug has been marked as a duplicate of bug 160324 *** 261377 2015-09-17 01:32:03 -0700 2015-09-17 01:32:03 -0700 Test case crash.js application/javascript 65 rhodovan.u-szeged U3ludGF4RXJyb3IucHJvdG90eXBlLm5hbWUgPSAwOwpTeW50YXhFcnJvci5wcm90b3R5cGUudG9T dHJpbmcoKTs=