I'm getting an assertion failure with today's ToT, see attached test case.
Created attachment 23940 [details] test case (assertion failure) ASSERTION FAILED: getValue (/Users/ap/Safari/OpenSource/WebKitBuild/Debug/JavaScriptCore.framework/PrivateHeaders/PropertySlot.h:136 void JSC::PropertySlot::setCustom(JSC::JSValue*, JSC::JSValue* (*)(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&))) 0 com.apple.WebCore 0x035dbb1b JSC::PropertySlot::setCustom(JSC::JSValue*, JSC::JSValue* (*)(JSC::ExecState*, JSC::Identifier const&, JSC::PropertySlot const&)) + 125 (PropertySlot.h:136) 1 com.apple.WebCore 0x039ab857 bool JSC::getStaticValueSlot<WebCore::JSRGBColor, WebCore::DOMObject>(JSC::ExecState*, JSC::HashTable const*, WebCore::JSRGBColor*, JSC::Identifier const&, JSC::PropertySlot&) + 197 (lookup.h:199) 2 com.apple.WebCore 0x039ab5d3 WebCore::JSRGBColor::getOwnPropertySlot(JSC::ExecState*, JSC::Identifier const&, JSC::PropertySlot&) + 55 (JSRGBColor.cpp:55) 3 com.apple.JavaScriptCore 0x008f09fb JSC::JSValue::get(JSC::ExecState*, JSC::Identifier const&, JSC::PropertySlot&) const + 187 (JSObject.h:430)
OK, looks like this is just how bug 21235 looks in debug builds.
This is also detectable in Release builds, because the actual value returned is the getter function, rather than a CSSPrimitiveValue.
*** Bug 21235 has been marked as a duplicate of this bug. ***
This is caused by r36977: http://trac.webkit.org/changeset/36977 I am assigning this to Sam, because he knows the fix.
Fixed in 37432.
Thanks!