Bug 131798 – REGRESSION: ASSERT(!typeInfo().hasImpureGetOwnPropertySlot() || typeInfo().newImpurePropertyFiresWatchpoints()) on jquery tests

• Status: RESOLVED
• Resolution: FIXED
• Component: CSS

[Alexey Proskuryakov]

jquery tests started to fail with assertions very frequently yesterday:

http://build.webkit.org/results/Apple%20MountainLion%20(Leaks)/r167385%20(10109)/jquery/attributes-crash-log.txt

ASSERT(!typeInfo().hasImpureGetOwnPropertySlot() || typeInfo().newImpurePropertyFiresWatchpoints())
Thread 17 Crashed:: JSC Compilation Thread
0   com.apple.JavaScriptCore      	0x000000010e5e544a WTFCrash + 42 (Assertions.cpp:333)
1   com.apple.JavaScriptCore      	0x000000010e20453e JSC::Structure::takesSlowPathInDFGForImpureProperty() + 174 (Structure.h:149)
2   com.apple.JavaScriptCore      	0x000000010e203172 JSC::GetByIdStatus::computeForStubInfo(JSC::ConcurrentJITLocker const&, JSC::CodeBlock*, JSC::StructureStubInfo*, WTF::StringImpl*) + 1586 (GetByIdStatus.cpp:221)
3   com.apple.JavaScriptCore      	0x000000010e2029a3 JSC::GetByIdStatus::computeFor(JSC::CodeBlock*, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, unsigned int, WTF::StringImpl*) + 179 (GetByIdStatus.cpp:151)
4   com.apple.JavaScriptCore      	0x000000010e203eef JSC::GetByIdStatus::computeFor(JSC::CodeBlock*, JSC::CodeBlock*, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, WTF::HashMap<JSC::CodeOrigin, JSC::StructureStubInfo*, JSC::CodeOriginApproximateHash, WTF::HashTraits<JSC::CodeOrigin>, WTF::HashTraits<JSC::StructureStubInfo*> >&, JSC::CodeOrigin, WTF::StringImpl*) + 703 (GetByIdStatus.cpp:325)
5   com.apple.JavaScriptCore      	0x000000010e019514 JSC::DFG::ByteCodeParser::parseBlock(unsigned int) + 15412 (DFGByteCodeParser.cpp:2660)
6   com.apple.JavaScriptCore      	0x000000010e013a02 JSC::DFG::ByteCodeParser::parseCodeBlock() + 1970 (DFGByteCodeParser.cpp:3600)
7   com.apple.JavaScriptCore      	0x000000010e01f8d8 JSC::DFG::ByteCodeParser::parse() + 968 (DFGByteCodeParser.cpp:3660)
8   com.apple.JavaScriptCore      	0x000000010e01fc0e JSC::DFG::parse(JSC::DFG::Graph&) + 62 (DFGByteCodeParser.cpp:3685)
9   com.apple.JavaScriptCore      	0x000000010e13a111 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) + 193 (DFGPlan.cpp:193)

[Alexey Proskuryakov]

Hmm, looks like most of the tests crashes once, and were good since then, but jquery/attributes.html is not.

[Alexey Proskuryakov]

s/crashes/crashed/

[Filip Pizlo]

OMG I hate this assertion so much.  It's time to kill it.

[Filip Pizlo]

Created attachment 229571 [details]
the patch

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/167452

[David Kilzer (:ddkilzer)]

<rdar://problem/15705242>