Summary: | js/dom/dfg-custom-getter-throw.html and js/dom/dfg-custom-getter-throw-inlined.html hit assertions after r161051 | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Ryosuke Niwa <rniwa> | ||||
Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | ap, fpizlo, ggaren, mark.lam, oliver, webkit-bug-importer | ||||
Priority: | P2 | Keywords: | InRadar, Regression | ||||
Version: | 528+ (Nightly build) | ||||||
Hardware: | Unspecified | ||||||
OS: | Unspecified | ||||||
Bug Depends on: | |||||||
Bug Blocks: | 45994 | ||||||
Attachments: |
|
Description
Ryosuke Niwa
2013-12-24 12:34:24 PST
Looks like this is a fairly recent regression in JSC. I certainly did not encounter it at r158715, and reverting the WebCore code change in r161051 confirms that the assertion failure exists without the patch. Created attachment 219979 [details]
The version of js/dom/dfg-custom-getter-throw.html that reproduces the assertion failure
Committed r161059: <http://trac.webkit.org/changeset/161059> Sorry, didn't mean to close this bug. Testing with a recent build (r165197), I don't see this issue manifest anymore. There also have been numerous changes and bug fixes in the area of exception handling and stack management since the time this bug was filed. Those changes appear to have resolved the issue. There doesn't seem to be anything left to do for this bug. Will close. Mark, did you unskip the skipped tests? (In reply to comment #7) > Mark, did you unskip the skipped tests? They were already unskipped. See https://bugs.webkit.org/show_bug.cgi?id=126219#c4. |