Bug 63947 - ASSERT running Object.preventExtensions(Math.sin)
Summary: ASSERT running Object.preventExtensions(Math.sin)
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Gavin Barraclough
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-07-05 11:20 PDT by Gavin Barraclough
Modified: 2011-07-05 23:03 PDT (History)
4 users (show)

See Also:


Attachments
The patch (4.17 KB, patch)
2011-07-05 11:23 PDT, Gavin Barraclough
oliver: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Gavin Barraclough 2011-07-05 11:20:42 PDT
This is due to calling scope() on a hostFunction as a part of calling createPrototypeProperty to reify the prototype property.  But host functions don't have a prototype property anyway!
Comment 1 Gavin Barraclough 2011-07-05 11:23:40 PDT
Created attachment 99732 [details]
The patch
Comment 2 Gavin Barraclough 2011-07-05 12:03:24 PDT
Fixed in r90402
Comment 4 Eric Seidel (no email) 2011-07-05 23:02:29 PDT
They're all crashing in JSC.  webkit-patch what-broke tells me this is the most likely change.
Comment 5 Eric Seidel (no email) 2011-07-05 23:03:37 PDT
Actually, it may have been http://trac.webkit.org/changeset/90401.