RESOLVED DUPLICATE of bug 157548 157524
[JSC] Assertion failure in JSC::JSObject::putInline (super-property-access.js)
https://bugs.webkit.org/show_bug.cgi?id=157524
Summary [JSC] Assertion failure in JSC::JSObject::putInline (super-property-access.js)
Caitlin Potter (:caitp)
Reported 2016-05-10 09:50:31 PDT
Failure in ftl-eager variants of super-property-access.js (introduced in http://trac.webkit.org/changeset/200586) ``` 56 ALWAYS_INLINE bool JSObject::putInline(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot) 57 { 58 JSObject* thisObject = jsCast<JSObject*>(cell); -> 59 ASSERT(value); 60 ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(thisObject)); 61 VM& vm = exec->vm(); 62 ``` reached via operationPutByValWithThisStrict
Attachments
Saam Barati
Comment 1 2016-05-11 12:14:02 PDT
*** This bug has been marked as a duplicate of bug 157548 ***
Note You need to log in before you can comment on or make changes to this bug.