160666 2016-08-08 11:49:31 -0700 ASSERTION FAILED: hasInlineStorage() in JSFinalObject::visitChildren(). 2016-08-08 11:58:58 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 mark.lam mark.lam commit-queue keith_miller msaboff saam oldest_to_newest 1218539 0 mark.lam 2016-08-08 11:49:31 -0700 This assertion is benign. JSFinalObject::visitChildren() calls JSObject::inlineStorage() to get a pointer to the object's inline storage, and later passes it to visitor.appendValuesHidden() with a previously computed storageSize. When storageSize is 0, appendValuesHidden() ends up doing nothing. However, before we get there, JSObject::inlineStorage() will be asserting hasInlineStorage() and this assertion will fail when storageSize is 0. We can fix this assertion failure by simply adding a storageSize check before calling hasInlineStorage() and visitor.appendValuesHidden(). 1218541 1 285577 mark.lam 2016-08-08 11:54:00 -0700 Created attachment 285577 proposed patch. 1218542 2 285577 keith_miller 2016-08-08 11:56:06 -0700 Comment on attachment 285577 proposed patch. r=me. 1218544 3 mark.lam 2016-08-08 11:58:58 -0700 Thanks for the review. Landed in r204261: <http://trac.webkit.org/r204261>. 285577 2016-08-08 11:54:00 -0700 2016-08-08 11:56:06 -0700 proposed patch. bug-160666.patch text/plain 3168 mark.lam SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyMDQyNjApCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDEyIEBACisyMDE2LTA4LTA4ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNv bT4KKworICAgICAgICBBU1NFUlRJT04gRkFJTEVEOiBoYXNJbmxpbmVTdG9yYWdlKCkgaW4gSlNG aW5hbE9iamVjdDo6dmlzaXRDaGlsZHJlbigpLgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0 Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTYwNjY2CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisKKyAgICAgICAgKiBzdHJlc3Mvb2JqZWN0LWNvbnN0cnVjdG9yLXNob3VsZC1i ZS1uZXctdGFyZ2V0LWF3YXJlLmpzOgorCiAyMDE2LTA4LTA3ICBZdXN1a2UgU3V6dWtpICA8dXRh dGFuZS50ZWFAZ21haWwuY29tPgogCiAgICAgICAgIFtFUzZdIE1vZHVsZSBuYW1lc3BhY2Ugb2Jq ZWN0IHNob3VsZCBub3QgYWxsb3cgdW5zZXQgSUMKSW5kZXg6IEpTVGVzdHMvc3RyZXNzL29iamVj dC1jb25zdHJ1Y3Rvci1zaG91bGQtYmUtbmV3LXRhcmdldC1hd2FyZS5qcwo9PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0t LSBKU1Rlc3RzL3N0cmVzcy9vYmplY3QtY29uc3RydWN0b3Itc2hvdWxkLWJlLW5ldy10YXJnZXQt YXdhcmUuanMJKHJldmlzaW9uIDIwNDI1OSkKKysrIEpTVGVzdHMvc3RyZXNzL29iamVjdC1jb25z dHJ1Y3Rvci1zaG91bGQtYmUtbmV3LXRhcmdldC1hd2FyZS5qcwkod29ya2luZyBjb3B5KQpAQCAt MTQsMyArMTQsNSBAQCB2YXIgaGVsbG8gPSBuZXcgSGVsbG8oKTsKIHNob3VsZEJlKGhlbGxvLl9f cHJvdG9fXywgSGVsbG8ucHJvdG90eXBlKTsKIAogc2hvdWxkQmUoUmVmbGVjdC5jb25zdHJ1Y3Qo T2JqZWN0LCBbXSwgSGVsbG8pLl9fcHJvdG9fXywgSGVsbG8ucHJvdG90eXBlKTsKKworZ2MoKTsg Ly8gUmVncmVzc2lvbiB0ZXN0IGZvciBodHRwczovd2Via2l0Lm9yZy9iLzE2MDY2Ni4KSW5kZXg6 IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0ph dmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjA0MjU5KQorKysgU291cmNlL0phdmFT Y3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIzIEBACisyMDE2 LTA4LTA4ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBBU1NFUlRJ T04gRkFJTEVEOiBoYXNJbmxpbmVTdG9yYWdlKCkgaW4gSlNGaW5hbE9iamVjdDo6dmlzaXRDaGls ZHJlbigpLgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9 MTYwNjY2CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg VGhpcyBhc3NlcnRpb24gaXMgYmVuaWduLiAgSlNGaW5hbE9iamVjdDo6dmlzaXRDaGlsZHJlbigp IGNhbGxzCisgICAgICAgIEpTT2JqZWN0OjppbmxpbmVTdG9yYWdlKCkgdG8gZ2V0IGEgcG9pbnRl ciB0byB0aGUgb2JqZWN0J3MgaW5saW5lIHN0b3JhZ2UsIGFuZAorICAgICAgICBsYXRlciBwYXNz ZXMgaXQgdG8gdmlzaXRvci5hcHBlbmRWYWx1ZXNIaWRkZW4oKSB3aXRoIGEgcHJldmlvdXNseSBj b21wdXRlZAorICAgICAgICBzdG9yYWdlU2l6ZS4gIFdoZW4gc3RvcmFnZVNpemUgaXMgMCwgYXBw ZW5kVmFsdWVzSGlkZGVuKCkgZW5kcyB1cCBkb2luZyBub3RoaW5nLgorICAgICAgICBIb3dldmVy LCBiZWZvcmUgd2UgZ2V0IHRoZXJlLCBKU09iamVjdDo6aW5saW5lU3RvcmFnZSgpIHdpbGwgYmUg YXNzZXJ0aW5nCisgICAgICAgIGhhc0lubGluZVN0b3JhZ2UoKSBhbmQgdGhpcyBhc3NlcnRpb24g d2lsbCBmYWlsIHdoZW4gc3RvcmFnZVNpemUgaXMgMC4KKworICAgICAgICBXZSBjYW4gZml4IHRo aXMgYXNzZXJ0aW9uIGZhaWx1cmUgYnkgc2ltcGx5IGFkZGluZyBhIHN0b3JhZ2VTaXplIGNoZWNr IGJlZm9yZQorICAgICAgICBjYWxsaW5nIGhhc0lubGluZVN0b3JhZ2UoKSBhbmQgdmlzaXRvci5h cHBlbmRWYWx1ZXNIaWRkZW4oKS4KKworICAgICAgICAqIHJ1bnRpbWUvSlNPYmplY3QuY3BwOgor ICAgICAgICAoSlNDOjpKU0ZpbmFsT2JqZWN0Ojp2aXNpdENoaWxkcmVuKToKKwogMjAxNi0wOC0w OCAgQnJpYW4gQnVyZyAgPGJidXJnQGFwcGxlLmNvbT4KIAogICAgICAgICBXZWIgSW5zcGVjdG9y OiBjbGVhbiB1cCBwcmVmaXhpbmcgb2YgQXV0b21hdGlvbiBwcm90b2NvbCBnZW5lcmF0ZWQgZmls ZXMKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0pTT2JqZWN0LmNwcAo9PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9KU09iamVjdC5jcHAJKHJl dmlzaW9uIDIwNDI1OSkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0pTT2JqZWN0 LmNwcAkod29ya2luZyBjb3B5KQpAQCAtMjkzLDcgKzI5Myw4IEBAIHZvaWQgSlNGaW5hbE9iamVj dDo6dmlzaXRDaGlsZHJlbihKU0NlbGwKICAgICAgICAgdGhpc09iamVjdC0+dmlzaXRCdXR0ZXJm bHkodmlzaXRvciwgYnV0dGVyZmx5LCBzdHJ1Y3R1cmUpOwogCiAgICAgc2l6ZV90IHN0b3JhZ2VT aXplID0gc3RydWN0dXJlLT5pbmxpbmVTaXplKCk7Ci0gICAgdmlzaXRvci5hcHBlbmRWYWx1ZXNI aWRkZW4odGhpc09iamVjdC0+aW5saW5lU3RvcmFnZSgpLCBzdG9yYWdlU2l6ZSk7CisgICAgaWYg KHN0b3JhZ2VTaXplKQorICAgICAgICB2aXNpdG9yLmFwcGVuZFZhbHVlc0hpZGRlbih0aGlzT2Jq ZWN0LT5pbmxpbmVTdG9yYWdlKCksIHN0b3JhZ2VTaXplKTsKIAogI2lmICFBU1NFUlRfRElTQUJM RUQKICAgICB2aXNpdG9yLm1faXNDaGVja2luZ0ZvckRlZmF1bHRNYXJrVmlvbGF0aW9uID0gd2Fz Q2hlY2tpbmdGb3JEZWZhdWx0TWFya1Zpb2xhdGlvbjsK