Bug 48178 - ASSERT running the fast/js/kde tests in a row
Summary: ASSERT running the fast/js/kde tests in a row
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC OS X 10.5
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-10-23 03:22 PDT by Xan Lopez
Modified: 2010-10-23 13:14 PDT (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Xan Lopez 2010-10-23 03:22:16 PDT 
When running all the tests in fast/js/kde, I get an ASSERT right after function-length.html is finished, so I believe the crash comes from garbage-n.html.


SHOULD NEVER BE REACHED
(../../JavaScriptCore/runtime/JSCell.cpp:195 virtual bool JSC::JSCell::toBoolean(JSC::ExecState*) const)

Program received signal SIGSEGV, Segmentation fault.
0x01248961 in JSC::JSCell::toBoolean (this=0xb6756580) at ../../JavaScriptCore/runtime/JSCell.cpp:195
195	    ASSERT_NOT_REACHED();
(gdb) bt
#0  0x01248961 in JSC::JSCell::toBoolean (this=0xb6756580) at ../../JavaScriptCore/runtime/JSCell.cpp:195
#1  0x004c3f36 in JSC::JSValue::toBoolean (this=0xbfffd4d4, exec=0xb6200038) at ../../JavaScriptCore/runtime/JSCell.h:296
#2  0x011cce00 in JSC::cti_op_jtrue (args=0xbfffd500) at ../../JavaScriptCore/jit/JITStubs.cpp:2878
#3  0x011c431a in JSC::JITThunks::tryCacheGetByID (callFrame=0xb6756580, codeBlock=0xfffffffe, returnAddress=..., baseValue=..., propertyName=..., 
    slot=..., stubInfo=0xbfffd55c) at ../../JavaScriptCore/jit/JITStubs.cpp:999
#4  0x00000000 in ?? ()