The Type Profiler might profile JS code that uses DebuggerScope and accesses properties on it. Therefore, it may have a DebuggerScope object in its log. Objects in the log are subject to having their getOwnPropertySlot method called. Therefore, the DebuggerScope might not always be in a valid state when this happens. The assertion is therefore invalid.
Created attachment 275923 [details] patch
Comment on attachment 275923 [details] patch r=me
Comment on attachment 275923 [details] patch Clearing flags on attachment: 275923 Committed r199182: <http://trac.webkit.org/changeset/199182>
All reviewed patches have been landed. Closing bug.
<rdar://problem/20790971>