Summary: | ASSERT in JSC::PropertySlot::slotBase @ iGoogle homepage | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Xan Lopez <xan.lopez> | ||||||
Component: | JavaScriptCore | Assignee: | Cameron Zwarich (cpst) <zwarich> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | CC: | zwarich | ||||||
Priority: | P2 | Keywords: | InRadar, NeedsReduction | ||||||
Version: | 528+ (Nightly build) | ||||||||
Hardware: | PC | ||||||||
OS: | Linux | ||||||||
Attachments: |
|
Description
Xan Lopez
2009-03-14 11:35:14 PDT
I can't reproduce this on the Mac with the plain iGoogle homepage. I can reproduce this if I log into iGoogle and go to the "Date & Time" gadget page. I'll assign this to myself. Created attachment 28711 [details]
Steps towards a reduction
This is a lot better than the page itself, but it might be futile to actually reduce this. We'll see.
This is a debug-only bug. It is caused by a custom getOwnPropertySlot implementation calling PropertySlot::setUndefined(), which clears m_slotBase in debug builds. I think that setUndefined() shouldn't be calling clearBase(), because of situations like this. The original intent of the assertion is to catch code that reads the base without setting it. Unfortunately, setUndefined() can be called even after the base has been set, so this assertion is bad. There are two possible fixes: 1) Remove the assertion. 2) Change the assertion so it uses a debug-only bool that records whether m_slotBase was ever set. I am tending towards option 2, but I need to make a test before I can land anything. I'll mark this as P2 because it's debug-only. Created attachment 28748 [details]
Proposed patch
Here is a different approach.
Comment on attachment 28748 [details]
Proposed patch
r=me
|