The issue occurs because JSFunction instance's prototype chain is walked to see if it is an InternalFunction (and it turns out it's not!) in JSCell::isObject. The fix is to add the InternalFunctio::info as a parent in JSFunction::info.
Created attachment 25439 [details] Add InternalFunction as JSFunction's parent class run-javascriptcore-tests passes with no changes.
Comment on attachment 25439 [details] Add InternalFunction as JSFunction's parent class Looks fine, but should have a test case. Is there no way to make a test case? Does console.trace() make no sense from within DRT? If there is no reasonable way to make a test case, you can consider this an r+.
Created attachment 25530 [details] Fix inheritance chain v2 Now with a layout test. No MSG. Still "Mmm, good".
Comment on attachment 25530 [details] Fix inheritance chain v2 Looks good. I'm a little confused by this sentence: 19 <p>Tests for absence of ASSERT in console.trace() due to incomplete inheritance chain.</p> But it's fine as-is.
Committing to http://svn.webkit.org/repository/webkit/trunk ... M JavaScriptCore/ChangeLog M JavaScriptCore/runtime/JSFunction.cpp M LayoutTests/ChangeLog A LayoutTests/fast/dom/Window/console-trace-expected.txt A LayoutTests/fast/dom/Window/console-trace.html Committed r38913