In r262727, I suggested that Alexey Shvayka add an assertion in Stringifier::appendStringifiedValue() that it is safe to recurse because we don't expect it to recurse into itself. Turns out this is a bad idea because a client may be doing the recursing, and Stringifier::appendStringifiedValue() ends up being executed with stack that is already in the reserved zone. This is legal, and is what the reserved zone is intended for as long as we don't recurse from here. However, this also means that the assertion vm.isSafeToRecurseSoft() will be fail because we're may already be in the reserved zone area. The fix is simply to remove this faulty assertion.
<rdar://problem/64154840>
Created attachment 401503 [details] proposed patch.
Comment on attachment 401503 [details] proposed patch. r=me
Thanks for the review. Landed in r262830: <http://trac.webkit.org/r262830>.