Bug 63947

Summary: ASSERT running Object.preventExtensions(Math.sin)
Product: WebKit Reporter: Gavin Barraclough <barraclough>
Component: JavaScriptCoreAssignee: Gavin Barraclough <barraclough>
Severity: Normal CC: eric, mrobinson, ossy, xan.lopez
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Description Flags
The patch oliver: review+

Description Gavin Barraclough 2011-07-05 11:20:42 PDT
This is due to calling scope() on a hostFunction as a part of calling createPrototypeProperty to reify the prototype property.  But host functions don't have a prototype property anyway!
Comment 1 Gavin Barraclough 2011-07-05 11:23:40 PDT
Created attachment 99732 [details]
The patch
Comment 2 Gavin Barraclough 2011-07-05 12:03:24 PDT
Fixed in r90402
Comment 4 Eric Seidel (no email) 2011-07-05 23:02:29 PDT
They're all crashing in JSC.  webkit-patch what-broke tells me this is the most likely change.
Comment 5 Eric Seidel (no email) 2011-07-05 23:03:37 PDT
Actually, it may have been http://trac.webkit.org/changeset/90401.