Changeset 196051 in webkit
- Timestamp:
- Feb 2, 2016 10:34:06 PM (8 years ago)
- Location:
- trunk/Source/JavaScriptCore
- Files:
-
- 1 added
- 3 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/Source/JavaScriptCore/ChangeLog
r196045 r196051 1 2016-02-02 Caitlin Potter <caitp@igalia.com> 2 3 JSSymbolTableObject::deleteProperty() crashes deleting Symbols 4 https://bugs.webkit.org/show_bug.cgi?id=153816 5 6 Reviewed by Darin Adler. 7 8 Changes JSSymbolTableObject::deleteProperty() to check if its 9 symbolTable() contains the property's uid() rather than publicName(). 10 This ensures that it will not crash in the case of Symbols. 11 12 * runtime/JSSymbolTableObject.cpp: 13 (JSC::JSSymbolTableObject::deleteProperty): 14 * tests/es6/Object_static_methods_Object.getOwnPropertyDescriptors.js: 15 (testGlobalProxy): 16 * tests/stress/regress-153816.js: Added. 17 (deleteSymbolFromJSSymbolTableObject): 18 1 19 2016-02-02 Benjamin Poulain <benjamin@webkit.org> 2 20 -
trunk/Source/JavaScriptCore/runtime/JSSymbolTableObject.cpp
r187969 r196051 48 48 { 49 49 JSSymbolTableObject* thisObject = jsCast<JSSymbolTableObject*>(cell); 50 if (thisObject->symbolTable()->contains(propertyName. publicName()))50 if (thisObject->symbolTable()->contains(propertyName.uid())) 51 51 return false; 52 52 -
trunk/Source/JavaScriptCore/tests/es6/Object_static_methods_Object.getOwnPropertyDescriptors.js
r196042 r196051 90 90 91 91 shouldBeDataProperty(result[symbol], 'Symbol(test)', 'global[Symbol(test)]'); 92 // FIXME: Can't delete Symbol properties from a JSSymbolTableObject. 93 // delete global[symbol]; 92 delete global[symbol]; 94 93 })(this);
Note: See TracChangeset
for help on using the changeset viewer.