Bug 22460 – Calls to console.trace() ASSERT due to JSFunction's incomplete inheritance chain

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Dimitri Glazkov (Google)]

The issue occurs because JSFunction instance's prototype chain is walked to see if it is an InternalFunction (and it turns out it's not!) in JSCell::isObject.

The fix is to add the InternalFunctio::info as a parent in JSFunction::info.

[Dimitri Glazkov (Google)]

Created attachment 25439 [details]
Add InternalFunction as JSFunction's parent class

run-javascriptcore-tests passes with no changes.

[Eric Seidel (no email)]

Comment on attachment 25439 [details]
Add InternalFunction as JSFunction's parent class

Looks fine, but should have a test case.  Is there no way to make a test case?  Does console.trace() make no sense from within DRT?  If there is no reasonable way to make a test case, you can consider this an r+.

[Dimitri Glazkov (Google)]

Created attachment 25530 [details]
Fix inheritance chain v2

Now with a layout test. No MSG. Still "Mmm, good".

[Eric Seidel (no email)]

Comment on attachment 25530 [details]
Fix inheritance chain v2

Looks good.  I'm a little confused by this sentence:

 19     <p>Tests for absence of ASSERT in console.trace() due to incomplete inheritance chain.</p>

But it's fine as-is.

[Eric Seidel (no email)]

Committing to http://svn.webkit.org/repository/webkit/trunk ...
	M	JavaScriptCore/ChangeLog
	M	JavaScriptCore/runtime/JSFunction.cpp
	M	LayoutTests/ChangeLog
	A	LayoutTests/fast/dom/Window/console-trace-expected.txt
	A	LayoutTests/fast/dom/Window/console-trace.html
Committed r38913