Bug 158698 - Assertion in setObjectToStringValue
Summary: Assertion in setObjectToStringValue
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2016-06-13 11:10 PDT by Oliver Hunt
Modified: 2016-06-13 14:25 PDT (History)
6 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Oliver Hunt 2016-06-13 11:10:11 PDT
String coercion triggers an exciting assertion, when i futz with the this object:
(this % (this.__proto__ = Math)) + ""

Produces:
ASSERTION FAILED: conditionSet.hasOneSlotBaseCondition()
/Volumes/Untitled/WebKit/WebKit/Source/JavaScriptCore/runtime/StructureRareData.cpp(129) : void JSC::StructureRareData::setObjectToStringValue(JSC::ExecState *, JSC::VM &, JSC::Structure *, JSC::JSString *, JSC::PropertySlot)
1   0x1041686fd WTFCrash
2   0x103fccbd4 JSC::StructureRareData::setObjectToStringValue(JSC::ExecState*, JSC::VM&, JSC::Structure*, JSC::JSString*, JSC::PropertySlot)
3   0x103e1a70d JSC::Structure::setObjectToStringValue(JSC::ExecState*, JSC::VM&, JSC::JSString*, JSC::PropertySlot)
4   0x103e1a3eb JSC::objectProtoFuncToString(JSC::ExecState*)::$_0::operator()(bool, JSC::PropertySlot&) const
5   0x103e1a1bf std::__1::result_of<JSC::objectProtoFuncToString(JSC::ExecState*)::$_0 (bool, JSC::PropertySlot&)>::type JSC::JSObject::getPropertySlot<JSC::objectProtoFuncToString(JSC::ExecState*)::$_0>(JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&, JSC::objectProtoFuncToString(JSC::ExecState*)::$_0) const
6   0x103e19fcd std::__1::result_of<JSC::objectProtoFuncToString(JSC::ExecState*)::$_0 (bool, JSC::PropertySlot&)>::type JSC::JSObject::getPropertySlot<JSC::objectProtoFuncToString(JSC::ExecState*)::$_0>(JSC::ExecState*, JSC::PropertyName, JSC::objectProtoFuncToString(JSC::ExecState*)::$_0) const
7   0x103e18a6d JSC::objectProtoFuncToString(JSC::ExecState*)
8   0x103d9643a vmEntryToNative

...
Comment 1 Radar WebKit Bug Importer 2016-06-13 14:25:57 PDT
<rdar://problem/26775657>