Bug 162988

Summary:

Bad ASSERT in ClonedArguments::createByCopyingFrom()

Product:

WebKit

Reporter:

Michael Saboff <msaboff>

Component:

JavaScriptCore

Assignee:

Michael Saboff <msaboff>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

commit-queue, keith_miller, mark.lam, saam

Priority:

Keywords:

InRadar

Version:

Other

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Patch	none

Description Michael Saboff 2016-10-05 16:18:52 PDT

The ASSERT:
    ASSERT(exec->lexicalGlobalObject()->clonedArgumentsStructure() == result->structure());
can erroneously fires when we inline a function with a different lexicalGlocalObject.

<rdar://problem/28028373>

Comment 1 Michael Saboff 2016-10-05 16:20:28 PDT

Created attachment 290757 [details]
Patch

Comment 2 Keith Miller 2016-10-05 16:22:22 PDT

Comment on attachment 290757 [details]
Patch

r=me.

Comment 3 WebKit Commit Bot 2016-10-05 16:50:04 PDT

Comment on attachment 290757 [details]
Patch

Clearing flags on attachment: 290757

Committed r206836: <http://trac.webkit.org/changeset/206836>

Comment 4 WebKit Commit Bot 2016-10-05 16:50:07 PDT

All reviewed patches have been landed.  Closing bug.